Open Source Security - Revision history

Tom: /* Cyber Resilience Act */

2025-03-20T17:09:53Z

‎Cyber Resilience Act

Tom: /* Executive Order */

2025-03-20T17:09:04Z

‎Executive Order

Tom: /* Problems */

2025-02-14T01:51:53Z

‎Problems

Tom: /* US Federal Projects */

2024-08-17T00:00:04Z

‎US Federal Projects

Tom: /* US Military Projects */

2024-08-16T22:11:56Z

‎US Military Projects

Tom: /* Binary Analysis */

2024-01-15T05:29:18Z

‎Binary Analysis

Tom: /* Binary Analysis */

2024-01-15T03:11:36Z

‎Binary Analysis

Tom: /* Deployment Solutions */

2024-01-15T03:06:26Z

‎Deployment Solutions

Tom: /* Production Solutions */

2024-01-15T02:53:57Z

‎Production Solutions

Tom: /* Problems */

2024-01-15T02:34:34Z

‎Problems

@@ Line 10: / Line 10: @@
 ==Cyber Resilience Act==
-* [https://devops.com/securing-open-source-software-the-cyber-resilience-act-way/ Securing Open Source Software, the Cyber Resilience Act Way]
+* [https://devops.com/securing-open-source-software-the-cyber-resilience-act-way/ Securing Open Source Software, the Cyber Resilience Act Way] 2024-04-10
 ==Executive Order==
 The White House [[Executive Order on Cybersecurity]] (2021-05-12)has its own wiki page.

@@ Line 9: / Line 9: @@
 * The Linux Foundation is supporting [[Open Source Security]] but is seems to be a case of wishful thinking. The problems are well address in a open discussion hosted in the CACM.<ref>May Kaczorowski+2, ''OSS Supply-Chain Security: What will it Take?''  '''CACM 66''' No 4 (2023-04) pp 48ff.</ref> Most open source is built by self-selected developers who are anxious to get something to market and then drift away lead a legacy code base with no one to maintain it. Not that the same problem does not exist in closed source systems where maintenance is often sent to off-shore programmers or less motivated workers. Even Microsoft and other major suppliers has a similar environment.
 ==Executive Order==
 The White House [[Executive Order on Cybersecurity]] (2021-05-12)has its own wiki page.

@@ Line 21: / Line 21: @@
 ==Problems==
 * A common problem with code that was developed in closed, even secretive, environments was often buggy and of unknown quality.
 * In fact code like OpenSSL had bugs that [https://www.cisa.gov/uscert/ncas/current-activity/2022/11/01/openssl-releases-security-update still cropping up in 2022.persisted for years before they were discovered and patched] and bugs [https://securitylabs.datadoghq.com/articles/openssl-november-1-vulnerabilities/ continue to be discovered] in 2022.
 * [https://www.csoonline.com/article/3688911/at-least-one-open-source-vulnerability-found-in-84-of-code-bases-report.html#:~:text=At%20least%20one%20open%20source%20vulnerability%20found%20in,2023%2011%3A36%20am%20PST%20NDAB%20Creativity%20%2F%20Shutterstock At Least One Open Source Vulnerability Found in 84% of Code Bases] in 2023-02 from data reported in 2022. 63% of the open source code has a CVSS severity score of 7 or higher.

@@ Line 102: / Line 102: @@
 “People are realizing now: wait a minute, literally everything we do is underpinned by Linux,” says Dave Aitel, a cybersecurity researcher and former NSA computer security scientist. “This is a core technology to our society. Not understanding kernel security means we can’t secure critical infrastructure.” <ref>Patrick Howell O'Neil. ''The US military wants to understand the most important software on Earth'' Technology Review https://www.technologyreview.com/2022/07/14/1055894/us-military-sofware-linux-kernel-open-source/</ref> Open-source code runs on every computer on the planet—and keeps America’s critical infrastructure going. DARPA is worried about how well it can be trusted.
 ===CISA===
-The accelerated development of new artificial intelligence (AI) capabilities, including with large language models (LLMs), has spurred international debates around the potential impact of “open source AI” models. Does open sourcing a model benefit society because it enables developers to rapidly innovate by studying, using, sharing, and collaboratively iterating on these state-of-the-art models? Or do such capabilities pose security threats, allowing adversaries to leverage these models for greater harm? <ref>Jack Cable, Senior Technical Advisor, and Aeva Black, Section Chief, Open Source Security, ''With Open Source Artificial Intelligence, Don’t Forget the Lessons of Open Source Software'' (20224-07-29) https://www.cisa.gov/news-events/news/open-source-artificial-intelligence-dont-forget-lessons-open-source-software</ref>
+The accelerated development of new artificial intelligence (AI) capabilities, including with large language models (LLMs), has spurred international debates around the potential impact of “open source AI” models. Does open sourcing a model benefit society because it enables developers to rapidly innovate by studying, using, sharing, and collaboratively iterating on these state-of-the-art models? Or do such capabilities pose security threats, allowing adversaries to leverage these models for greater harm? <ref>Jack Cable, Senior Technical Advisor, and Aeva Black, Section Chief, Open Source Security, ''With Open Source Artificial Intelligence, Don’t Forget the Lessons of Open Source Software'' CISA (2024-07-29) https://www.cisa.gov/news-events/news/open-source-artificial-intelligence-dont-forget-lessons-open-source-software</ref>
 ===DARPA Open Source===
 Many branches of the US military are interested in open source.

@@ Line 99: / Line 99: @@
 MIT evaluated trust in OSS and found that the original problem of determining the source remains today. Although this decades-old approach is trled-and-true in a sense, it is far from perfect. One problem, Merrill notes, “is that people are bad at managing cryptographic keys, which consist of very long numbers, in a way that is secure and prevents them from getting lost.” People lose their passwords all the time, Merrill says. “And if a software developer were to lose the private key and then contact a user saying, ‘Hey, I have a new key,’ how would you know who that really is?”<ref>Steve Nadis, ''Boosting faith in the authenticity of open source software'' MIT CSAIL (2023-11-30) https://www.csail.mit.edu/news/boosting-faith-authenticity-open-source-software</ref><blockquote>Open source software—software that is freely distributed, along with its source code, so that copies, additions, or modifications can be readily made —is “everywhere,” to quote the 2023 Open Source Security and Risk Analysis Report. Ninety-six percent of the computer programs used by major industries include open source software, and seventy-six percent of those programs consists of open source software. But the percentage of software packages “containing security vulnerabilities remains troublingly high,” the report warned. </blockquote>
-==US Military Projects==
+==US Federal Projects==
 “People are realizing now: wait a minute, literally everything we do is underpinned by Linux,” says Dave Aitel, a cybersecurity researcher and former NSA computer security scientist. “This is a core technology to our society. Not understanding kernel security means we can’t secure critical infrastructure.” <ref>Patrick Howell O'Neil. ''The US military wants to understand the most important software on Earth'' Technology Review https://www.technologyreview.com/2022/07/14/1055894/us-military-sofware-linux-kernel-open-source/</ref> Open-source code runs on every computer on the planet—and keeps America’s critical infrastructure going. DARPA is worried about how well it can be trusted.
 ===DARPA Open Source===
 Many branches of the US military are interested in open source.

@@ Line 63: / Line 63: @@
 ===Binary Analysis===
 Binary Analysis can be performed on the product before or after installation on a computer system.
-* [https://unmitigatedrisk.com/?p=756 Rethinking How We Assess Risk in the Software We Rely On]
+* [https://unmitigatedrisk.com/?p=756 Rethinking How We Assess Risk in the Software We Rely On]<blockquote>If all we have is a binary, the only way to understand the risks it represents is to analyze it in the same way an attacker would. However, doing this at scale and making the analysis actionable is challenging. Recent advancements in machine learning and language development are key to addressing this challenge. Currently, tools that operate on binaries alone fall into two categories. The first are solutions akin to 1990s antivirus programs – matching binaries to known issues. The second category helps skilled professionals reverse engineer the binary’s contents more quickly.</blockquote>
 ==Production Solutions==

@@ Line 56: / Line 56: @@
 * Make your own software is fine. make is merely a dependency tracking and automation framework. It is typically used in conjunction with compilers, though, and those preferably should not be available on a production system, as they're completely un-necessary. The same holds true for all un-needed packages, whether those be shared libraries, interpreters, etc.
 * Open SSF is a Linux support Open Source Security Foundation that seeks to provide tools to help developers.<ref>Open Source Security Foundation https://openssf.org/</ref><blockquote>The Open Source Security Foundation (OpenSSF) is a cross-industry organization at the Linux Foundation that brings together the industry’s most important open source security initiatives and the individuals and companies that support them. The OpenSSF is committed to collaboration and working both upstream and with existing communities to advance open source security for all.</blockquote>
 ==Production Solutions==
@@ Line 65: / Line 71: @@
 * The following points are based on those posted on https://serverfault.com/questions/595366/is-it-safe-for-a-production-server-to-have-make-installed by kasperd.
-Some people will argue that the presence of development tools on a production machine will make life easier for an attacker. This however is such a tiny roadbump to an attacker, that any other argument you can find for or against installing the development tools will weigh more.
+Some people will argue that the presence of development tools on a production machine will make life easier for an attacker. This however is such a tiny road-bump to an attacker, that any other argument you can find for or against installing the development tools will weigh more.
 If an attacker was able to penetrate the system so far, that they could invoke whatever tools are present on the server, then you already have a serious security breach. Without development tools there are many other ways to write binary data to a file and then run a chmod on that file. An attacker wanting to use a custom build executable on the system at this point could just as well build that on their own machine and transfer it to the server.