The Securing Open Source Software Act, introduced by U.S. Congressman Gary Peters, a Liberal from Michigan, and Rob Portman, a Republican from Ohio, is one latest government endeavor concerning open source safety. Senators Peters and Portman are, respectfully, the leader and majority leader of the Senate Homeland Security and Governmental Affairs Committees. They attended the Log4j Senate hearings and then presented this bill to strengthen open source privacy and best practices in the administration by creating the head of the Cybersecurity and Infrastructure Security Agency’s (CISA) duties.
What does the bill say?
The Cybersecurity and Infrastructure Security Agency (CISA) is proposed to “guarantee that open-source technology is being used effectively and safely by the national govt, vital infrastructure, and many others” because the Log4j security blow-up in 2021, and its ongoing reverberations, demonstrated just how susceptible we are to open-source code breaches. After all, “the vast majority of computers around the world rely on open-source code,” according to the official announcement announcing the law on Sept. 22. This is by no means the first time that the national government has recognised the importance of open-source software to all. The US Federal Trade Commission cautioned in January that it would penalize corporations who failed to address Log4j security issues.
The Securing Open Source Software Act’s Essential Features
Several additional criteria are included in the controversial legislation for CISA, the United States government’s Cybersecurity and Infrastructure Security Agency. It expands the agency’s present obligations to include assisting the safe use and installation of computer, particularly open source software, at government agencies across the software development process.
Duties Include:
- Establishing a framework for examining the danger of open source components; the framework should contain best practises from government entities, private enterprise, and open source groups.
- Collaboration with government agencies to strengthen open source software security integrity
- Serving as a visible point of reference for governmental, local, and commercial bodies addressing open source software safety.
- Helping with open source software security reporting coordination
- Hiring people with open source knowledge and experience
Is this a Good thing for Private Entity?
Although the suggested regulation would only affect government agencies, it would be important to the corporate companies as well. For a number of the same causes that the mid-September 2022 self-attestation memorandum and the 2021 cybersecurity executive directive affected private firms, this is the case. For example, when selling to the national govt, several of these recent and planned requirements require firms to present a software bill of supplies (and/or related software inventory). In other terms, both the public and commercial sectors continue to place a premium on software supply chain safety. This emphasizes characteristics such as SBOM creation, recognizing direct and transitive connections in your program, and having strong security control processes.
Conclusion of US Government’s Open Source Software Security Act of 2022
The Securing Open Source Software Act, introduced by U.S. Congressman Gary Peters, a Liberal from Michigan, and Rob Portman, a Republican from Ohio. Peters and Portman are the leader and majority leader of the Senate Homeland Security and Governmental Affairs Committees. The bill would create the head of the Cybersecurity and Infrastructure Security Agency’s (CISA) duties.
Your Ultimate Guide to the US Government’s Open Source Software Security Act of 2022: Frequently Asked Questions (FAQs)
Ans. The Cybersecurity and Infrastructure Security Agency (CISA) is proposed to “guarantee that open-source technology is being used effectively and safely by the national govt, vital infrastructure, and many others
Ans. The US Federal Trade Commission cautioned in January that it would penalize corporations who failed to address Log4j security issues.
Ans. Collaboration with government agencies to strengthen open source software security integrity
Ans. USOSS was introduced by U.S. Congressman Gary Peters, a Liberal from Michigan, and Rob Portman, a Republican from Ohio.
Ans. The Log4j security blow-up in 2021.
