CISA releases roadmap for securing open-source software
Summary
The roadmap lists four key priorities: establishing its own role in supporting security of open source, driving visibility into usage and risks of open source, reducing risks to the federal government, and hardening the open-source ecosystem. According to CISA, this will all help it achieve its vision for open-source software, which is one in which “every critical OSS project is not only secure but sustainable and resilient, supported by a healthy, diverse, and vibrant community.” Dan Lorenc, co-founder and CEO of supply chain security company Chainguard, feels that CISA has done a good job in segmenting the problems in this field and then prioritizing work to address them. He also said they did a good job at recognizing that the work needs to “happen upstream, and CISA employees will need to engage directly with communities,” though he said he still remains skeptical on how that will actually go, but is trying to stay optimistic. Lorenc recommends the government put some efforts into actually funding open-source projects, which the roadmap currently doesn’t address at all. “The government doesn’t have a great reputation for helping out with direct code or other contributions, but they do have the ability to help fund work already being done to achieve many of these roadmap items, such as memory safety, vulnerability remediation and SBOM tooling,” Lorenc told SD Times.