Comparing Software Supply Chain Protection Approaches

Software supply chain attacks are not entirely new. Still, in recent years, a series of relevant high-impact incidents demonstrated they evolved in complexity and have brought them to scrutiny and at-tention. In response, several initiatives concerning pro-tecting against the associated risks formulated frame-works and best practice guides. This study compares some of these initiatives, analyzing taxonomies, threats, and security controls. As a result, knowledge about these initiatives was organized, verifying their simi-larities, and discussing security controls they propose to categorize and understand them. This paper contributes to understanding the subject, suggests ad-vances and future works, and properly identifies controls to prevent incidents.