The Biden administration has announced an $11 million initiative to enhance open source software security in critical infrastructure. Spearheaded by the White House and the Department of Homeland Security (DHS), the project aims to assess the use of open source software across sectors such as healthcare, transportation, and energy production. Funded under the 2021 Bipartisan Infrastructure Law, the initiative is called the Open-Source Software Prevalence Initiative (OSSPI) and seeks to strengthen national cybersecurity by fostering collaboration between the federal government and the private sector.
At the DEF CON cybersecurity conference, National Cyber Director Harry Coker emphasized the importance of securing the software supply chain and ensuring that open source software is better protected. He highlighted that the government is focused on giving back to the open source community, stressing the need for a public-private partnership. A working group will be formed later in the year to develop recommendations on how to further protect open source software, with ongoing collaboration between security researchers and federal entities.
A summary report was also released alongside the announcement, listing numerous recommendations from the cybersecurity community. These recommendations cover actions such as securing package repositories, deepening ties between the government and open-source communities, and enhancing the use of Software Bill of Materials. Additionally, the initiative plans to strengthen the software supply chain, replace legacy systems, and assign vulnerability severity metrics. These efforts are intended to bolster the digital infrastructure underpinning critical sectors.
The initiative also includes a proposal for a software liability regime, shifting responsibility to final-goods assemblers and technology producers. Coker noted that technology manufacturers must be held accountable when software flaws arise due to rushed development processes. This controversial measure, part of the National Cybersecurity Strategy, has raised concerns, but federal officials maintain that their goal is not to punish open source developers. Instead, they aim to establish standards of care and safe harbor provisions for vendors, further ensuring the security of the software ecosystem.
Reference:
