“Open Sesame: A Dualistic Approach to Assessing the Security of Open Source Software”

Open Source Repositories Struggle with Security Challenges

Open source repositories such as PyPI, Maven Java repository, and npm are having a hard time managing and securing their infrastructure due to the increasing volume of malicious users and projects uploaded daily. However, with increased government and industry investment and recognition of open-source software as critical infrastructure, more efforts are being made to secure repositories. The White House guidance and meetings have been aimed at increasing support for securing open-source repositories, while the recent National Cybersecurity Strategy by the Biden-Harris administration seeks to hold companies liable for their software products.

Technical Efforts to Enhance Security

Several technical efforts are underway to reduce the work on maintainers and repositories’ infrastructure staff, such as the OpenSSF Scorecard, which runs automated checks against developers’ code and open-source projects to help gauge the risk of malicious maintainers and packages. Additionally, sigstore allows developers and maintainers to sign their code to enable end-users to verify the provenance of the code. Python has a package that helps developers generate and verify code signatures using sigstore, while GitHub is developing a plan for developers who use npm to adopt sigstore.

More Funding and Security Professionals

The bottom line is that software repositories need more funding and more security professionals. While automated tools in the pipeline are a good idea, it’s not enough. False positives often need to be manually reviewed, leading to a huge operational overhead that requires more industry investment in the open-source ecosystem. Human review cycles and the need for more expert professionals could help limit the scope of damage for some of these threats.

A Dualistic Approach: A Need for Both Man and Machine

While there is no doubt that technology can help reduce the burden of security experts, it’s not the entire solution. A philosophy of defense is necessary to combat malicious elements. One must be deliberate about what is being linked to their supply chain, and organizational policies must be created to look at specific signals in the OpenSSF Scorecard when adding dependencies.

Editorial: Why We Need to Invest in Open Source Security

Open source software has become critical infrastructure, yet it still struggles to receive the same level of attention and investment as other critical infrastructure systems. A recent survey showed that open source attacks have increased by 430% since 2010. It has become clear that investment in open-source security is a requirement. The recent initiative by the White House is a welcome development, but more effort is necessary.

Advice: Guidelines to Improve Open Source Security

Firstly, always make room for human intervention in the review process. Using automated tools alone does not guarantee effective security. Secondly, be deliberate about what is being linked to your supply chain, and create organizational policies to look at specific signals in the OpenSSF Scorecard when adding dependencies. Finally, industries and governments must invest more in cybersecurity infrastructure for open source repositories. Proper funding will help hire more security professionals, improve automation tools, and provide an increased capacity to manage open source threats.