Additional software is available as part of TTU site license agreements. Visit Technology Support Site License Software for more information.

Securing Open Source Software Act (2022)

The United States Securing Open Source Software Act: What You Need to Know

The Act begins by defining terms we in the open source ecosystem may find interest in reviewing:

• Open Source Software means "software for which the human-readable source code is made available to the public for use, study, re-use, modification, enhancement, and re-distribution."
• Open Source Software Community means "the community of individuals, foundations, nonprofit organizations, corporations, and other entities that:
• develop, contribute to, maintain, and publish open source software; or
• otherwise work to ensure the security of the open source software ecosystem."
• Open Source Software Component means "an individual repository of open source software that is made available to the public."

Open Source Software Challenges

Forbes, 2022

• Lack Of Accountable Parties: Open-source projects are often delivered for free and with no expectations on either end of the transaction. That means if there's a security flaw in the project, no one can be held accountable for that flaw. You can't exactly sue someone for a defect in a digital product that they gave away for free.
• Inexperienced Developers: Oftentimes, open-source projects are created by inexperienced developers who are looking for ways to gain industry experience before picking up a full-time job. This isn't always the case, but inexperienced developers do often lead to less secure projects.
• Busy Developers: Other times, open-source projects are side projects or hobbies of people who are committed to full-time work somewhere else. If there is a problem with the code, they may not be able to address it for weeks, or even months.
• Total Transparency: The transparency of open-source projects is a massive strength, but it can also be a weakness. When a bug is discovered, the entire community knows about it. If there is a massive security vulnerability, cybercriminals will learn how to exploit it quickly.

Guidelines (Forbes, 2022; CERN, 2022)

How To Use Open-Source Software Without Security Issues

1. Choose the right projects. First, make sure you're choosing the right projects. Not all open-source projects are worth using; some are the product of more experienced, more responsible developers. Analyze the quality of the product and get to know the people who created it. And if there are multiple software options, compare them directly to figure out which one is superior.
2. Analyze the risks and compensate for them. Every open-source project is going to come with some risks. Be sure to analyze those risks and find a way to compensate for them on your end.
3. Tap into the power of the community. The open-source community is a huge strength, so take advantage of it. Ask lots of questions, work with experienced community programmers and contribute your own knowledge when you can.
4. Track your dependencies. Keep meticulous track of all open-source dependencies in your software environment; these will be vital to address in the event of a newly identify security risk.
5. Keep watch for patches, updates, and warnings. Stay plugged into the community to learn about new bugs, new patches, new updates and posted warnings. The sooner you act in response to these new threats, the better.