EUs Efforts to Secure Open Source Software
Talkat OSPOCon @ Open Source Summit Europe 2022 · on Wednesday, 2022-09-14· at 14:20· EcoCem Room (Level 2), Convention Centre Dublin, Spencer Dock, N Wall Quay, North Wall Dublin 1, D01 T1·
summary
EU establishes an OSPO inventory inside the Commission and runs a bug bounty program (active since 2014, finding hundreds of bugs) but funding is ad hoc and not permanent; NIS2 forces critical sectors to report incidents and creates a new European vulnerability database; upcoming Cyber Resilience Act may reference software bill of materials and build on SBOM tooling, but EU-wide procurement rules, maintainer funding, and coordinated training remain limited and awareness at parliamentary level is low.
AI-written summary · about
chapters (20)
- 0:00Introduction
- 0:19Ciaras background
- 1:30Agenda
- 2:53Open Source Software
- 3:30Attacks on Open Source
- 4:38Why Care
- 6:09EU Cyber Security
- 6:58Open Source Security
- 8:42Supply Chain Attacks
- 9:30US vs EU
- 10:47US Executive Order
- 12:42US Vulnerability Management
- 13:29Training
- 14:17Awareness
- 15:35Awareness done
- 16:37EU Cybersecurity Legislation
- 19:08EU Open Source Strategy
- 20:07EU Open Source Response
- 25:02The Good
- 29:17Whats Next
related talks
01h 03mHow EU regulations affect OSPOs work and why you should care
27mOpen Source at the European Commission
45mWhy EU Policy Making matters to everyone in the Open Source Ecosystem
39mAll your code belongs to Policy Makers, Politicians and the Law
33mEU cybersecurity regulation and Open Source governance
36mSoftware security, trust, and public policy
16mIntervention: Europe and Software Security
10mThe State of Play of Open Source in Europe