Managing Audits for Critical Open Source Projects
summary
OSTIF manages end-to-end independent security audits with a repeatable process: connect & scope with an RFP, pre-audit orientation, threat modeling, deep source code review, tooling/CI integration, coordinated fixes and a published report. Outcomes: about 50+ Critical/High CVSS≥7 vulnerabilities patched, 300+ notable bugs, ~10,000 audit hours. Case study: cryo audit finds a high-severity DoS (also affecting containerd), implements 14 fuzzers and OSS-Fuzz integration, and a fuzzer later discovers another high-severity bug months after the audit.
AI-written summary · about
chapters (6)
- 0:00Start
- 2:09Threats, Risks, and Mitigations in the Open Source Ecosystem
- 4:11A Refined Process and Systematic Approach
- 10:58Lessons Learned from Managing Open Source Audits
- 15:04Case Study: CRI-O Lessons Learned
- 22:14Conclusion
related talks
41mManaging Audits for Critical Open Source Projects
30mSuccess Stories in Open Source: Security Audits with OSTIF
29mSecurity Audits in Action: Helping Improve Multiple LF Energy Projects
44mSecuring Open Source Software - End-to-End, at Massive Scale, Together
49mImproving FOSS Security
37mOpenSSF Best Practices for Everyone!
35mOpen source security: Opportunity or oxymoron?
52mCollaborating to Improve Open Source Security: How the Ecosystem Is Stepping Up