A first-of-its-kind plan to broadly address open source and software supply chain security is waiting for White House support.
The Linux Foundation and the Open Source Software Security Foundation (OpenSSF) brought together over 90 executives from 37 companies and government leaders from the NSC, ONCD, CISA, NIST, DOE, and OMB on Thursday to reach a consensus on key actions to take to improve the resiliency and security of open-source software.
A subset of participating organizations has collectively pledged an initial tranche of funding towards the implementation of the plan. Those companies are Amazon, Ericsson, Google, Intel, Microsoft, and VMWare, pledging over $30 million. As the plan evolves further, more funding will be identified and work will begin as individual streams are agreed upon.
Open Source Software Security Summit II is a follow-up to the first Summit held in January, led by the White House’s National Security Council. That meeting, convened by the Linux Foundation and OpenSSF, came on the one-year anniversary of President Biden’s Executive Order on Improving the Nation’s Cybersecurity.
As part of this second White House Open Source Security Summit, open source leaders called on the software industry to standardize on the Sigstore developer tools and support a 10-point plan to upgrade open source’s collective cybersecurity resilience and improve trust in software itself, according to Dan Lorenc, CEO and co-founder of Chainguard, co-creator of Sigstore.
“On the one year anniversary of President Biden’s executive order, today we are here to respond with a plan that is actionable, because open source is a critical component of our national security, and it is fundamental to billions of dollars being invested in software innovation today,” announced Jim Zemlin, executive director of the Linux Foundation, during his organization’s press conference on Thursday.
Pushing the Support Envelope
Most major software packages contain elements of open source software, including code used by the national security community and critical infrastructure. Open-source software supports billions of dollars in innovation but also carries with it unique challenges for managing cybersecurity across its software supply chains.
“This plan represents our unified voice and our common call to action. The most important task ahead of us is leadership,” said Zemlin. “This is the first time I have seen a plan and industry will to foster a plan that will work.”
The Summit II plan outlines approximately $150 million of funding over two years to rapidly advance well-vetted solutions to the 10 major problems the plan identifies. The 10 streams of investment include concrete action steps for both more immediate improvements and building strong foundations for a more secure future.
“What we are doing here together is converging a set of ideas and principles of what is broken out there and what we can do to fix it. The plan we have put together represents the 10 flags in the ground as the base for getting started. We are eager to get further input and commitments that move us from plan to action,” said Brian Behlendorf, executive director of Open Source Security Foundation.
Highlighting the Plan
The proposed plan is founded on three primary goals:
- Securing open source security production
- Improving vulnerability discovery and remediation
- Shorten ecosystem patching response time
The full plan contains elements to achieve those goals. They include security education that delivers a baseline for software development education and certification. Another element is to establish a public, vendor-neutral objective-metrics-based risk assessment dashboard for the top 10,000 (or more) OSS components.
The plan proposes the adoption of digital signatures on software releases and establishing the OpenSSF Open Source Security Incident Response Team to assist open source projects during critical times when responding to a vulnerability.
Another plan detail focuses on better code scanning to accelerate the discovery of new vulnerabilities by maintainers and experts through advanced security tools and expert guidance.
Code audits conducted by third-party code reviews and any necessary remediation work would detect up to 200 of the most-critical OSS components once per year.
Coordinated data sharing industry wide would improve the research that helps determine the most critical OSS components. Providing Software Bill of Materials (SBOM) everywhere would improve tooling and training to drive adoption and provide build systems, package managers, and distribution systems with better supply chain security tools and best practices.
The Storehouse Factor
Chainguard, who co-created the Sigstore repository, is committing financial resources towards the public infrastructure and network proposed by OpenSSF and will collaborate with industry peers to deepen work on interoperability to ensure Sigstore’s impact is felt across the software supply chain and every corner of the software ecosystem. This commitment includes a minimum of $1 million a year in support of Sigstore and a pledge to run it on its own node.
Designed and built with maintainers for maintainers, it has already been widely adopted by millions of developers worldwide. Now is the time to formalize its role as the de facto standard for digital signatures in software development, said Lorenc.
“We know the importance of interoperability in increasing adoption of these critical tools because of our work on the SLSA Framework and SBOM. Interoperability is the linchpin in securing software throughout the supply chain,” he said.
Related Support
Google on Thursday announced that it is creating an “open -source maintenance crew” tasked with improving the security of critical open-source projects.
Google also unveiled Google Cloud Dataset and Open-Source Insights projects to help developers better understand the structure and security of the software they use.
“This dataset provides access to critical software supply chain information for developers, maintainers and consumers of open-source software,” according to Google.
“Security risks will continue to span all software companies and open-source projects and only an industry-wide commitment involving a global community of developers, governments, and businesses can make real progress. Google will continue to play our part to make an impact,” said Eric Brewer, vice president of infrastructure at Google Cloud and Google Fellow, at the security summit conference.
