"Making Open Source Secure by Design"
summary
CISA frames open source as critical national infrastructure and says memory safety remains the largest source of remotely exploitable bugs with buffer overflows persisting across hardware, IoT, and cars. The agency cites $8 trillion vs $4 billion yearly value-to-investment gap and that 96% of value comes from 5% of developers. Ongoing work includes a published memory safety study, a memory-safe roadmap over 10 years, stress-testing incident response with the Rust community, and an SBOM dependency graph project.
AI-written summary · about
chapters (8)
- 0:00Intro
- 3:48History of Open Source
- 7:32Lenas Law
- 9:38Open Source Roadmap
- 11:23Open Source Framework
- 12:35Accomplishments
- 14:40Sustaining Open Source
- 16:15Software Bill Materials
related talks
27mDriving Policy To Secure the Open Source Ecosystem
40mUnsafe At Any Speed: CISA's Plan to Foster Tech Ecosystem Security
15mKeynote: Government's Continuing Path Contributing Towards a Secure Open Source Ecosystem
44mNavigating Open Source and Open Standards for Better Cybersecurity
34mCan Open Source be Secure by Design?
42mBuilding Resilience: The Next Decade of Open Source
31mMobilizing the Open Source Industry in the Fight For Better Security By Default
29mNavigating the Open Source Policy Labyrinth: Unraveling Global Policy Efforts for a Secure Future