Introduction to Open-Source Security Challenges
An epidemic of cyberattacks on open-source software has mounted in recent months, making clear how uniquely difficult it is to protect the publicly available code, from both a policy and a technical perspective, that serves as the foundation for so much of the digital world.
Background on Open-Source Security
While open-source software security got a boost in attention under President Joe Biden — whose administration grappled with the fallout from the potentially catastrophic Log4j flaw that emerged in 2021 — a number of open-source experts say that government protection efforts have suffered setbacks under President Donald Trump.
Many also say companies that heavily rely on open-source software, which is basically all of them, haven’t shouldered enough of the responsibility for safeguarding it. “What we’re seeing is years of lack of investment sustainment in open-source software that is finally starting to catch up to us, where it seems like every week there’s a new supply chain compromise,” said Jack Cable, who held a role at the Cybersecurity and Infrastructure Security Agency where he worked on open-source security before departing under Trump.
The Evolution of Open-Source Risk
There are a series of factors contributing to the current threat to open-source software, experts say. One is simply that attackers go to the area where they can get the highest return on their work. Compromising open-source software gives them the chance to get into the supply chain and exploit additional targets.
“Twenty years ago, open source was still fairly niche,” said Æva Black, who also worked on open-source security at CISA but left when Trump came back into power. “The potential blast radius if you managed to compromise open source was relatively small, because back then the world didn’t run on open source. Now almost everything runs on open source,” she said, from modern cars to satellites.
Challenges in Open-Source Maintenance
Another part is the nature of open-source software itself. “It’s a symptom [of having] lots of open source [that] is a little bit under-maintained or not cared for enough, so that we spend too little effort and money and infrastructure on them,” said Daniel Stenberg, who is the creator and maintainer of cURL, a popular open-source project.
“Lots of open source is being maintained by small teams, lots of volunteers, and I think that that’s a tough situation.” That doesn’t mean the maintainers are to blame, Stenberg said. The companies that rely on open-source need to be diligent about using it, Black said.
Government Efforts to Address Open-Source Security
The US government has taken some steps to address open-source security, including the creation of the Open-Source Software Security Initiative and hires of well-regarded open-source security experts at CISA. However, many of these efforts have languished under the Trump administration.
CISA’s acting director, Nick Andersen, said last month that open-source security was an area of particular concern for him. Andersen responded to concerns about CISA staffing levels on open-source security and spoke more broadly on the topic in a statement.
International Efforts to Secure Open-Source Software
Europe is also taking action to secure open-source software that the United States doesn’t seem ready or willing to do right now. Germany, for instance, devotes grants to the security of open-source projects, although Stenberg pointed out that sometimes money doesn’t equate to maintainers being able to fix flaws more quickly, depending on the project’s size.
The Cyber Resilience Act (CRA) adopted by the Council of the European Union in 2024 could offer another road on open-source security. The CRA requires those who use open-source software products as part of any commercial activity to take certain security measures.
Conclusion
The US government faces unique difficulties in protecting open-source software, with experts citing years of underinvestment and a lack of systematic vulnerability disclosure processes. While some efforts have been made to address these challenges, more work is needed to ensure the security of open-source software.
Source: CyberScoop