All Good Things: End of Life and End of Support in Policy and Practice
summary
CISA frames end-of-life as security support — a predictable, effective response to new security risks — and proposes machine-readable data (OpenEoX under OASIS) that links product IDs, hashes and package URLs to support status; pilots cite endoflife.date, ChainGuard container-age findings and CRA’s five-year floor. Vision uses federated vendor-published assertions, SBOM linking, automation-friendly schemas and organizational risk workflows; mitigations include network segmentation, rapid exploit analysis and kill switches rather than blanket rip-and-replace.
AI-written summary · about
chapters (13)
- 0:00End of life support challenges
- 1:47Outdated software risks
- 5:51Rip and replace limitations
- 8:05Government's legacy role
- 11:50Sector regulations and models
- 15:44Open source maintenance risks
- 21:52Data-driven policy vision
- 24:47Security support definition
- 27:18Naming software challenges
- 32:48Automation-friendly EOL data
- 36:24Managing EOL risks
- 41:25Next steps and adoption
- 47:03Q&A
related talks
41mPlanning for Retirement: How Can We Prepare for Software’s...- 41mPlanning for Retirement: How Can We Prepare for Software’s...
42mEnd of Life of Software: Can Expired Milk Become a Security Breach?
35mEnd of Life of Software: Can expired milk become a security breach?
37mSecuring OSS across the whole supply chain and beyond
44mNavigating Open Source and Open Standards for Better Cybersecurity
13mGerman National Guideline on SOSS-Lifecycle: Community Outreach
51mA Roadmap for Your OSS Security Lifecyle Journey to Protect Customers