In brief

CISA has issued new guidance to help US federal agencies manage open-source software throughout its lifecycle, from selection and deployment to contribution and publication. Agencies should maintain inventories of open-source components and dependencies, select actively maintained projects, understand licensing conditions, monitor newly disclosed vulnerabilities and apply patches promptly. Software bills of materials and automated dependency-management, testing and update tools can improve visibility and response. CISA’s C4 framework evaluates a project’s trustworthiness through its codebase, community, conduct and configuration, including maintenance activity, governance, vulnerability-disclosure processes and secure default settings.

The guidance also encourages agencies to contribute security fixes, documentation and other improvements to projects they depend on, while carefully reviewing submissions to prevent the disclosure of credentials, encryption keys or internal system details. Software developed with public funding should be considered for open-source release where legally and operationally appropriate, accompanied by secure-development practices, documentation, an SBOM and a vulnerability-disclosure policy. Open-source AI requires additional scrutiny because openly licensed models may not disclose their training data or development process; when provenance cannot be established, agencies should treat such systems as proprietary software with incomplete transparency and apply stricter risk controls.

Source: Industrial Cyber

‍

‍