Security of Open Source Components Requires More Collaborative Efforts

guest · Aug 11, 2021

Security of Open Source Components Requires More Collaborative Efforts
August 9, 2021
https://www.darkreading.com/edge-ar...omponents-requires-more-collaborative-efforts

BLACK HAT USA 2021, Las Vegas — When security researchers and the open source community disclosed the Heartbleed vulnerability in OpenSSL in April 2014, the project — which underpins much of the secure communications for the Web — only had two full-time developers. The lack of resources for such a critical open source project highlights the issues open source projects and components continue to have: a lack of funding, slow patching, and — increasingly — a great deal of interest from attackers.

Speaking at the Black Hat USA briefings in Las Vegas, two open source security advocates called for more coordinated funding of open source projects, especially critical ones, and a greater scale of collaboration between security researchers and developers. The security of open source software is foundational to every part of the technological ecosystem, said Jennifer Fernick, the NCC Group's global head of research in North America, during the talk "Securing Open Source Software."
Click to expand...

During the talk, Fernick and her co-speaker, Christopher Robinson, Intel's director of security communications, said companies need to give back more extensively to the open source community. If developers use open source software, they said, they need to give back to the open source community.

The two security experts, both leaders in the Open Source Security Foundation (OpenSSF), highlighted the current broken economics of open source software, where many companies rely on its security but very few are putting employee hours toward that goal.
Security researchers and developers are not incentivized to write patches for vulnerabilities, while attackers' top priority is to exploit those vulnerabilities. No wonder attackers are winning, Fernick said.

The economics have to change, she said.
Click to expand...

Log in or Sign up

Security of Open Source Components Requires More Collaborative Efforts

guest Guest

Log in or Sign up

Security of Open Source Components Requires More Collaborative Efforts

guest Guest

Useful Searches