Open source can be just as safe as proprietary software, though government agencies (and private enterprises) should take additional measures to secure it properly, according to a new guide published by the U.S. Cybersecurity and Infrastructure Security Agency (CISA).
The report, “Open Source Software: Security Principles and Practices,” provides with guidance to help agencies comply with two Presidential Executive Orders (14144 and 14306) which both urged them to do a more thorough job securing the software they use, a response to recent exploits like Log4Shell and XZ utils.
CISA acknowledges that open source can provide immeasurable benefits to government agencies, not merely because it is available without licensing fees, but also because agencies can extend the software to meet their own requirements. But at the same time, open source software must be managed differently than proprietary software.
Malicious hackers (and increasingly AI agents) use vulnerabilities to gain entry and exploit systems. In the case of the vendor software, it is the vendor’s responsibility to provide timely updates should a software vulnerability be found, which agencies should apply as soon as possible.
With open source software, however, agencies need to take a more proactive role in patching and understand the dependencies, or additional software components, that an open source package relies on. Those components also need to be secured, the guidance advises.
The guidance describes established principles for patching. It also provides a framework to evaluate trustworthiness and risk tolerance of software packages, as well as a set of best practices to procure, deploy and maintain open source software.
In practical terms, agencies wishing to use open source should establish a process that supports staff in choosing the software that meets the agency’s needs but minimizes risks to the agency.
For instance, an agency’s Office of the Chief Information Officer may set up a system to pre-approve certain software libraries for use in the agency. Automated tools could help verify safe software packages, and reviews would consider potential risk exposure. The CIO could still individually sign off on higher-risk components, such as operating systems.
To help agencies, CISA produced the C4 Framework, which can be used to assess the trustworthiness of a software package. It looks at four factors (the four Cs):
- Codebase: Take a look at the actual source code and dependencies that make up the software component of interest. How recently was the last update committed? How many vulnerabilities have been found? How many out-of-date dependencies does it rely on?
- Community: How robust is the community that maintains and contributes to the project? Is it part of a foundation, or managed by a private company?
- Conduct: How is the project managed? Is there a vulnerability disclosure process? Do the project leaders follow their own code of conduct?
- Configuration: Is the default configuration secure? Are there guides for use in highly-sensitive environments?
Open source AI systems should go through additional checks, CISA recommends. Agents should get sufficient transparency into the training data, in addition to the software itself. “Only with transparency and access can agencies understand and study the software, analyze it for vulnerabilities, and remediate any found vulnerabilities or risks,” the guide recommends.
CISA has targeted this report to U.S. federal agencies, though the advice here is rock-solid for use in the industrial sector as well. Many businesses in finance and health care, for instance, routinely follow government guidance. So if your organization uses open source in any capacity, this report may be worth checking out.