Open Source Software Security
Open source software is part of the foundation of the digital infrastructure we all rely upon.
Find out here how CISA is working to help secure it.
Open source software is widely used across the federal government and every critical infrastructure sector. As America’s Cyber Defense Agency, CISA works to understand and reduce cyber threats to the federal government and critical infrastructure. Ensuring secure open source software is a critical part of this effort.
CISA’s Open Source Software Security Roadmap establishes CISA’s role in helping to secure open source software by aligning it with CISA’s mission to identify and reduce risks to the federal government and critical infrastructure. In turn, CISA’s efforts will contribute to the improved security of the broader open source ecosystem.
CISA has several ongoing initiatives around open source security, including our community-driven work around software bill of materials. We also actively contribute by open sourcing much of our code via our “open-by-default” software development policy.
CISA Open Source Software Security Roadmap
CISA’s path forward to help ensure a secure open source ecosystem.
Featured Content
Open Source CISA Tabletop Exercise Package (CTEP)
During the Open Source Software (OSS) Security Summit in March 2024, the participants were led through a open source tabletop exercise scenario. All organizations can use this same exercise package to assess their preparedness and response.
CISA Announces New Efforts to Help Secure Open Source Ecosystem
On March 5-6, CISA hosted an Open Source Software (OSS) Security Summit to develop actions and steps towards achieving a more secure open source ecosystem. To learn more, read our press release which includes a readout of the OSS Security Summit.
CISA GitHub
Check out CISA’s open source code on our GitHub.
Software Bill of Materials (SBOM)
A SBOM is a nested inventory, a list of ingredients that make up software components. CISA will advance the SBOM work by facilitating community engagement, development, and progress.
Enduring Security Framework Recommendations for Open Source Software and Software Bill of Materials
The Enduring Security Framework recommends practices for managing open source software and software bill of materials.
White House Releases End of Year Report on Open Source Software Security Initiative
On January 30, 2024, the Office of the National Cyber Director published the 2023 End of Year Report on the Open Source Software Security Initiative detailing the Administration's commitment to a safe and secure digital ecosystem.
CISA Partners With OpenSSF Securing Software Repositories Working Group to Release Principles for Package Repository Security
CISA partners with the Open Source Security Foundation Securing Software Repositories Working Group to publish "Principles for Package Repository Security" framework which lays out voluntary security maturity levels for package repositories.
CISA, DHS S&T and OpenSSF Announce Global Launch of Software Supply Chain Open Source Project
CISA, in collaboration with the Open Source Security Foundation and the Department of Homeland Security Science and Technology Directorate, launched Protobom, a new and innovative open source software supply chain tool.
Blogs
Blog: Lessons from XZ Utils: Achieving a More Sustainable Open Source Ecosystem
CISA describes how the agency has responded to the XZ Utils compromise and how every technology manufacturer can take a Secure by Design approach to securing open source software.
Blog: Memory Safe and Secure Coding
Director Jen Easterly stresses the importance of safe and responsible coding.
Blog: Open Source Software Must Start with Secure Code
CISA calls upon developers to make open source software secure from the start.
Watch Our CISA Live! on Open Source Software Security
On March 7, CISA held a CISA Live! on LinkedIn Live on open source software security. CISA’s Aeva Black, Open Source Security Section Chief, and Jack Cable, Senior Technical Advisor, discussed how CISA is collaborating with the open source community, federal partners, and the private sector to foster a more secure and resilient OSS ecosystem. This event offered participants an opportunity to learn about how CISA is working to strengthen the security of open source ecosystems, including package managers, along with ensuring the secure use of OSS within the federal government.
Contact Us
Do you have feedback on our Open Source Security work, or ideas where we can help contribute? Please share your thoughts by emailing us at: OpenSource@cisa.dhs.gov.