Open Source Security
Open source software is part of the foundation of the digital infrastructure we all rely upon.
Find out here how CISA is working to help secure it.
Open source software is widely used across the federal government and every critical infrastructure sector. As America’s Cyber Defense Agency, CISA works to understand and reduce cyber threats to the federal government and critical infrastructure. Ensuring secure open source software is a critical part of this effort.
CISA’s Open Source Software Security Roadmap establishes CISA’s role in helping to secure open source software by aligning it with CISA’s mission to identify and reduce risks to the federal government and critical infrastructure. In turn, CISA’s efforts will contribute to the improved security of the broader open source ecosystem.
CISA has several ongoing initiatives around open source security, including our community-driven work around software bill of materials. We also actively contribute by open sourcing much of our code via our “open-by-default” software development policy.
CISA Open Source Software Security Roadmap
CISA’s path forward to help ensure a secure open source ecosystem.
Featured Content
Fact Sheet: Biden-Harris Administration Releases Summary Report of 2023 RFI on Open Source-Software Security Initiative
On August 9, 2024, the White House, in partnership with the Open-Source Software Security Initiative, published a summary report on the Request for Information: Open-Source Software Security: Areas of Long-Term Focus and Prioritization.
Open Source CISA Tabletop Exercise Package (CTEP)
During the Open Source Software (OSS) Security Summit in March 2024, the participants were led through a open source tabletop exercise scenario. All organizations can use this same exercise package to assess their preparedness and response.
CISA Announces New Efforts to Help Secure Open Source Ecosystem
On March 5-6, CISA hosted an Open Source Software (OSS) Security Summit to develop actions and steps towards achieving a more secure open source ecosystem. To learn more, read our press release which includes a readout of the OSS Security Summit.
CISA GitHub
Check out CISA’s open source code on our GitHub.
Software Bill of Materials (SBOM)
A SBOM is a nested inventory, a list of ingredients that make up software components. CISA will advance the SBOM work by facilitating community engagement, development, and progress.
Enduring Security Framework Recommendations for Open Source Software and Software Bill of Materials
The Enduring Security Framework recommends practices for managing open source software and software bill of materials.
White House Releases End of Year Report on Open Source Software Security Initiative
On January 30, 2024, the Office of the National Cyber Director published the 2023 End of Year Report on the Open Source Software Security Initiative detailing the Administration's commitment to a safe and secure digital ecosystem.
CISA Partners With OpenSSF Securing Software Repositories Working Group to Release Principles for Package Repository Security
CISA partners with the Open Source Security Foundation Securing Software Repositories Working Group to publish "Principles for Package Repository Security" framework which lays out voluntary security maturity levels for package repositories.
CISA, DHS S&T and OpenSSF Announce Global Launch of Software Supply Chain Open Source Project
CISA, in collaboration with the Open Source Security Foundation and the Department of Homeland Security Science and Technology Directorate, launched Protobom, a new and innovative open source software supply chain tool.
Exploring Memory Safety in Critical Open Source Projects
CISA, in partnership with the FBI, Australian Cyber Security Centre, and Canadian Cyber Security Center, crafted this joint guidance to provide organizations with findings on the scale of memory safety risk in selected open source software.
SVIP Software Artifact Dependency Graph Generation Industry Day - October 17
On Thursday, October 17, the Department of Homeland Security Science and Technology Directorate Silicon Valley Innovation Program, in partnership with CISA, is hosting an Industry Day featuring a panel discussion with experts who have worked on different parts of the software identification puzzle over the past decade, provide descriptive use cases and detailed information about the technical requirements, submission process, and resources available to startups interested in submitting applications to the Software ADG Generation Topic Call.
The event will be held in person in Menlo Park, CA and livestreamed via Zoom.
Blogs
Blog: With Open Source Artificial Intelligence, Don’t Forget the Lessons of Open Source Software
CISA highlights its recent work in Open Source Artificial Intelligence.
Blog: Continued Progress Towards a Secure Open Source Ecosystem
CISA highlights its work to across the federal government to secure Open Source Software (OSS) since it held its first Summit on OSS Security.
Blog: Lessons from XZ Utils: Achieving a More Sustainable Open Source Ecosystem
CISA describes how the agency has responded to the XZ Utils compromise and how every technology manufacturer can take a Secure by Design approach to securing open source software.
Blog: Memory Safe and Secure Coding
Director Jen Easterly stresses the importance of safe and responsible coding.
Blog: Open Source Software Must Start with Secure Code
CISA calls upon developers to make open source software secure from the start.
Watch Our CISA Live! on Open Source Software Security
On March 7, CISA held a CISA Live! on LinkedIn Live on open source software security. CISA’s Aeva Black, Open Source Security Section Chief, and Jack Cable, Senior Technical Advisor, discussed how CISA is collaborating with the open source community, federal partners, and the private sector to foster a more secure and resilient OSS ecosystem. This event offered participants an opportunity to learn about how CISA is working to strengthen the security of open source ecosystems, including package managers, along with ensuring the secure use of OSS within the federal government.
Contact Us
Do you have feedback on our Open Source Security work, or ideas where we can help contribute? Please share your thoughts by emailing us at: OpenSource@cisa.dhs.gov.