August 14th – In the United States, the White House and the Department of Homeland Security (DHS) have launched an initiative to get a handle on just how prevalent open source code is within critical infrastructure; from that belonging to telecommunications providers, to healthcare institutions, to government agencies.
“…open source underlies our digital infrastructure and it’s vital that, as a government, we contribute back to the community“ through the recognition of open source’s ubiquity and the need for corresponding cyber security, noted National Cyber Director Harry Coker Jr., during his Def Con presentation in Las Vegas.
Once the information gathering phase has been completed, experts will roll out new recommended cyber security measures.
An $11 million initiative
This open source initiative is due to receive $11 million in funding. Beyond the basics, the Office of the National Cyber Director did not disclose specifics around the initiative, likely in an effort to protect it.
As the initiative has seen professional review, experts have recommended a number of action items; from security for package repositories, to further developing the use of Software Bill of Materials, to strengthening the software supply chain.
Cybersecurity and Infrastructure Security Agency Director Jen Easterly also mentioned a software liability regime, which would include “articulable standards of care,” along with safe harbor provisions for vendors that “responsibly innovate using secure development processes.”
Easterly stated, “I think there is more we can do but that is where the war will be won.”
Further information
Cyber threats targeting open source code are not only increasing, but have the potential to wreak havoc on a large number of industries, in an outsized modality.
The lack of security around open source software has been described as a “tragedy of the commons,” especially since important security tasks are completed on a volunteer-basis, and not by paid professionals.
The Biden administration began to prioritize open source software security following the Log4J incident, in 2021. Years later, vulnerable versions of the Log4J software are still accessible throughout the ecosystem.
For more on this story, click here. For further insights into code security and solutions, click here. Lastly, to receive cyber security thought leadership articles, groundbreaking research and emerging threat analyses each week, subscribe to the CyberTalk.org newsletter.