{"id":46637,"date":"2022-05-13T19:41:47","date_gmt":"2022-05-13T19:41:47","guid":{"rendered":"http:\/\/57116fe7-e2fb-4ce1-82f6-b48e094d1a12"},"modified":"2022-05-13T19:41:47","modified_gmt":"2022-05-13T19:41:47","slug":"white-house-joins-openssf-and-the-linux-foundation-in-securing-open-source-software","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/white-house-joins-openssf-and-the-linux-foundation-in-securing-open-source-software\/","title":{"rendered":"White House joins OpenSSF and the Linux Foundation in securing open-source software"},"content":{"rendered":"
\n
\n
\"Steven<\/span> <\/a> <\/div>\n<\/p><\/div>\n<\/p><\/div>\n

Securing the open-source software supply chain is a huge deal. Last year, the Biden administration issued an executive order to improve software supply chain security<\/a>. This came after the Colonial Pipeline ransomware attack<\/a> shut down gas and oil deliveries throughout the southeast and the SolarWinds software supply chain attack<\/a>. Securing software became a top priority. In response, The Open Source Security Foundation (OpenSSF)<\/a> and Linux Foundation<\/a> rose to this security challenge<\/a>. Now, they’re calling for $150 million in funding over two years to fix ten major open-source security problems.<\/p>\n

\n

Open Source<\/span> <\/h3>\n<\/p><\/div>\n

They’ll need every penny of it and more.<\/p>\n

The government will not be paying the freight for these changes. $30 million has already been pledged by Amazon, Ericsson, Google, Intel, Microsoft, and VMWare. More is already on the way. Amazon Web Services (AWS) has already pledged an additional $10 million<\/a>. <\/p>\n

At the White House press conference, OpenSSF general manager Brian Behlendorf said, “I want to be clear: We’re not here to fundraise from the government. We did not anticipate needing to go directly to the government to get funding for anyone to be successful.”<\/p>\n

Here are the ten goals the open-source industry is committed to meeting.<\/p>\n

    \n
  1. \n

    Security Education: Deliver baseline secure software development education and certification to all.<\/p>\n<\/li>\n

  2. \n

    Risk Assessment: Establish a public, vendor-neutral, objective-metrics-based risk assessment dashboard for the top 10,000 (or more) OSS components.<\/p>\n<\/li>\n

  3. \n

    Digital Signatures: Accelerate the adoption of digital signatures on software releases.<\/p>\n<\/li>\n

  4. \n

    Memory Safety: Eliminate root causes of many vulnerabilities through the replacement of non-memory-safe languages.<\/p>\n<\/li>\n

  5. \n

    Incident Response: Establish the OpenSSF Open Source Security Incident Response Team, security experts who can step in to assist open source projects during critical times when responding to a vulnerability.<\/p>\n<\/li>\n

  6. \n

    Better Scanning: Accelerate the discovery of new vulnerabilities by maintainers and experts through advanced security tools and expert guidance.<\/p>\n<\/li>\n

  7. \n

    Code Audits: Conduct third-party code reviews (and any necessary remediation work) of up to 200 of the most-critical OSS components once per year.<\/p>\n<\/li>\n

  8. \n

    Data Sharing: Coordinate industry-wide data sharing to improve the research that helps determine the most critical OSS components.<\/p>\n<\/li>\n

  9. \n

    Software Bill of Materials (SBOMs)<\/a>: Everywhere Improve SBOM tooling and training to drive adoption.<\/p>\n<\/li>\n

  10. \n

    Improved Supply Chains: Enhance the 10 most critical open-source software build systems, package managers, and distribution systems with better supply chain security tools and best practices.<\/p>\n<\/li>\n<\/ol>\n

    I’ll go into more detail about those in later stories, but even at a glance, this is a massive undertaking. For instance, C, which is core to the Linux kernel, the most important of all open-source projects, has many vulnerabilities within it. While the memory-safe Rust language is now being used in Linux<\/a>, it’s years, decades away, from replacing C in Linux’s over 27.8 million lines of code. Indeed, I doubt we’ll ever see all of Linux’s C code replaced by Rust. <\/p>\n

    We’re already close to solving some of the others. The open-source security company Chainguard<\/a> is calling on the software industry to standardize on Sigstore<\/a>. Sigstore<\/a> enables developers to securely sign software artifacts such as release files, container images, binaries, bills of material manifests. and more. This Linux Foundation project is backed by Google, Red Hat, and Purdue University.<\/p>\n

    Sigstore has several great features. These include:<\/p>\n