View all newsletters
Receive our newsletter - data, insights and analysis delivered to you
  1. Technology
  2. Cybersecurity
May 13, 2022updated 16 May 2022 8:59am

Tech’s big names team up to launch $30m open source software security plan

Tech's biggest names have teamed up to tackle open source software security after a spate of recent cyberattacks.

By Claudia Glover

Proposals to improve the security of open source software have been unveiled at a summit attended by some of the biggest names in tech. The Open Source Security summit, convened by The Linux Foundation and Open Source Software Security Foundation with the support of the US government, follows a spate of supply chain cyberattacks which have been made possible by flaws in open source code.

Last year saw a 650% increase in software supply chain cyberattacks, according to one study, with many exploiting open source libraries. (Photo by Peach_iStock/iStock)

Held on the one year anniversary of President Joe Biden’s executive order on improving the Nation’s Cybersecurity, yesterday’s summit was attended by over 90 executives from 37 companies as well as government leaders from six government agencies including the National Security Council (NSC)  and the Cybersecurity Infrastructure and Security Agency (CISA). Companies including Amazon, Ericsson, Google, Intel, Microsoft, and VMWare are part of the initiative, and have pledged a collective $30m to fund the measures in a ten-point plan to boost security.

The plan was unveiled as part of the summit, which includes promoting better training of developers, introducing digital signatures and auditing the most popular 10,000 open source code libraries. Open source experts believe some elements of the plan are promising, but others may prove too prescriptive to benefit the open source community.

Why does open source security need improving?

The proposals in the ten-point plan have been designed by The Linux Foundation and the Open Source Software Security Foundation to standardise security practices within the open source community. Open source repositories are widely used by developers, and research from open source security vendor Sonatype found that, on average, 85% of every application is comprised of open source code.

Flaws in this code can cause serious problems if exploited by hackers. The most high-profile recent example is the Log4Shell vulnerability, which came to light before Christmas last year. The flaw in a commonly used java library was used by hackers to perpetrate supply chain attacks on customers of businesses whose systems were compromised, including some of the world’s biggest software vendors.

Globally, the number of software supply chain attacks has rocketed lately, with a 650% year-on-year increase last year, according to research by specialist security provider Sonatype.

Open source software security: how can it be improved?

Potential solutions laid out in the ten-point plan include delivering free security coding courses to software developers who want to contribute to the open source community, implementing digital signatures in order to verify the developers and weed out malicious actors, and third party security checks of the most commonly used open source components.

Content from our partners
Rethinking cloud: challenging assumptions, learning lessons
DTX Manchester welcomes leading tech talent from across the region and beyond
The hidden complexities of deploying AI in your business

Security experts who spoke to Tech Monitor say the plan should put more responsibility on end users. “The problem is that all of these rules are the developers that make this software and putting more of a burden on them,” argues Peter Chestna, CISO of open source security testing platform Checkmarx. “I see nothing in this about the consumer." Chestna says there should be some onus on the users of open-source code to "have an action plan if a [vulnerability] gets announced or if a malicious code is announced." 

Brian Fox, CTO at Sonatype, agrees. “Software is created for humans and by extension, it's going to be fallible," he says. "So if you don't take ownership of the things you're consuming, and don't have procedures in place to be able to respond [to security incidents] it doesn't matter what happens [with the software] - it will never be perfect."

Is greater training for open source software security realistic?

Some of the ideas laid out in the plan may push software developers away from open source, as imposing standards of education on developers before they can contribute to the repositories may deter people from volunteering, Chestna argues.

“Some of these people in open source are paid contributors," he explains. "But many are just developers doing it as a hobby. Are we now going to shut them out and say, 'you can't you can't do this anymore'? I think that would be a mistake.” 

However, educating them for free will eventually have the desired effect, believes Fox. “If you're a developer and you don't have this minimum standard of training, it might be harder for you to find the job," he says. "In some industries, that alone is incentive. Is that forcing people? Not quite, but certainly heavily encouraging them, and enabling and empowering them to do it.”

Another controversial point is auditing of the top 10,000 libraries, which could extend to hundreds of thousands or millions of pieces of code once sub-libraries are included, Chestna says.

If that code has been secured, he adds, other libraries will become targets for hackers instead. "When you start to say I'm going to target the top 10,000, this is like saying I'm going to lock the doors and windows on the front side of my house," Chestna says. "You're not watching the back door. We're just moving the problem."

Overall, Chestna believes the plan is on the right track but may be too prescriptive for the open source landscape. "I would say that about half of it is is right headed and should be prioritised," he says. "The other half is is talking about mandates and forcing people to do things that they frankly may not want to do."

However, it may prove to be a first step on the journey of securing open source software, Sonatype's Fox says. "This is a marathon, not a sprint," he adds. "So some of these things will take a long time before they are effectively rolled out across the ecosystem."

Read more: Mailchimp hacked to launch ‘exceptional’ supply chain attack

Websites in our network
Select and enter your corporate email address Tech Monitor's research, insight and analysis examines the frontiers of digital transformation to help tech leaders navigate the future. Our Changelog newsletter delivers our best work to your inbox every week.
  • CIO
  • CTO
  • CISO
  • CSO
  • CFO
  • CDO
  • CEO
  • Architect Founder
  • MD
  • Director
  • Manager
  • Other
Visit our privacy policy for more information about our services, how Progressive Media Investments may use, process and share your personal data, including information on your rights in respect of your personal data and how you can unsubscribe from future marketing communications. Our services are intended for corporate subscribers and you warrant that the email address submitted is your corporate email address.