The Value of OSS Management for Risk Mitigation
summary
Organizations rely on open source for ~80–88% of code and routinely face SBOMs with tens of thousands of components (35k–80k); the presenters show a bank use case scanning ~400 Kubernetes Go packages and flagging 131 high‑risk components using metrics like time‑to‑close, contributor growth and bus‑factor (examples cited: 256, 264, 224). The workflow combines SBOM discovery, OpenSSF Scorecard and CHAOSS-style health signals to detect community smell, then prioritizes mitigation by funding or partnering with upstream projects.
AI-written summary · about
chapters (13)
- 0:00Introduction and speakers
- 2:11Open source in the tech stack
- 4:00Software supply chain risks
- 7:12Risk management fundamentals
- 9:42Open source partnerships
- 13:16Identifying open source risks
- 14:39Evaluating open source risk
- 18:21Prioritizing and mitigating risk
- 20:29Case study with ING
- 24:21Discovering unknown risks
- 25:03Final remarks and takeaways
- 25:45Q&A: Externalizing risk
- 28:12Q&A: Relicensing risks
related talks
42mThe Role of Open Source Management Talent in Ensuring Software...
41mManaging the risk and growth of using Open Source Software
45mPanel Discussion: Managing Open Source...
25mDefining the Limits of Risk
38mBetter, Faster, Stronger: How the Global Acceleration of OS Development Is Changing
34mSupply Chain Security, SBOMs and How OSPOs Can Play An Important Role Going Forward - An Ecosystem and Compliance Update
28mGoverning Open Source in the Enterprise: OSPO Strategies for Innovation and Compliance
31mAssessing Open Source Software Projects in the Software Supply Chain