The Open-Source Software Security Initiative (OS3I) recently released Securing the Open-Source Software Ecosystem report, which details the members’ current priorities and recommended cybersecurity solutions. The accompanying fact sheet also provides the highlights of the report. The OS3I includes both federal departments and agencies working together to deliver policy solutions to secure and defend the ecosystem. The new initiative is part of the overall National Cybersecurity Strategy.
After the Log4Shell vulnerability in 2021, the Biden-Harris administration committed to improving the security of the open-source software. Before the incident, the administration and government as a whole did not have a significant focus on open-source security. The delay in response to creating the Cyber Safety Review Board also prompted some concern.
The National Cybersecurity Strategy, released in March 2023, stated the federal government’s commitment to open-source and created the OS3I. Over the past year, President Biden’s National Cybersecurity Strategy and the Office of the National Cyber Director have focused on improving open-source software security along with both data security and data privacy.
In August 2023, the Cybersecurity and Infrastructure Security Agency (CISA) and the White House Office of the National Cyber Director (ONCD) released a request for information on the OS3I. They received over 100 responses from the open-source software community, including open-source software nonprofits, individuals, industry, academia and research organizations. The majority of responses related to security.
After reviewing the responses, leaders incorporated the input into the OS3I. Here are the four key areas of focus according to the report.
1. Unifying the federal government’s voice on open-source software security.
Open-source affects everyone involved in technology in even the remotest way, which pretty much includes all individuals, businesses and organizations. One of the main goals of the OS3I is to create alignment and partnership across sectors to improve the security of open-source. By inviting members from agencies, industry and academia, as well as soliciting widespread feedback, the OS3I has developed through the same collaborative approach it hopes to continue to grow.
What is open source software?
2. Establishing a strategic approach for the federal government’s secure use of open-source software and efforts to secure the broader ecosystem.
Because all 16 critical infrastructure sectors use open-source software as their foundation, vulnerabilities cause widespread issues ranging from public safety to economic security. The OS3I uses the CISA’s Open-Source Software Security Roadmap as a guide to manage risks by following its four goals. The roadmap includes:
- Establishing CISA’s role by building relationships with open-source software communities
- Understanding open-source software prevalence
- Reducing risks to the federal government
- Hardening the open-source software ecosystem.
3. Advancing President Biden’s Invest in America agenda by encouraging long-term, sustained security investment in the open-source software ecosystem.
Improving the security of open-source software requires resources, time and money. Through the OS3I, the federal government pledges its commitment to investing resources in open-source software security efforts.
4. Engaging and building trust with the open-source software community.
The OS3I will also focus on engaging the open-source software community, which is key to creating the collaborative partnerships needed to improve security. The OS3I plans to do this by:
- Fostering the proliferation of memory-safe programming languages
- Advancing sustainable development and utilization of open-source software
- Bolstering the security of package managers and other centralized infrastructure
- Identifying new focus areas to prioritize
What’s next with OS3I
After the publication of the report, the OSC3I will continue its work collaborating with the open-source software community to build the ecosystem needed to reduce cybersecurity risk. One of the key ways the committee will work towards the goal is by evaluating input through the RFI and continually determining the priorities in terms of open-source cybersecurity. By continuing to work with the federal government, open-source software community, civil society and private stakeholders, the OSC3I will continue its goal of reducing cybersecurity risk.