Managing Audits for Critical Open Source Projects
Talkat Global Security Vulnerability Summit @ Open Source Summit North America 2022 · on Thursday, 2022-06-23· at 16:05· Room 205 (Level 2), JW Marriott Austin, 110 E 2nd Street Austin, TX 78701·
summary
An independent nonprofit runs end-to-end security audits for OSS, coordinating scoping, RFPs and fixes and logging 40+ high/CVSS≥7 findings and about 250 medium/low issues across seven years with >10,000 audit hours. A recent six‑month engagement on a CNCF project uncovers a high‑severity DoS that also affects containerd, ships fixes, integrates the project into OSS‑Fuzz and adds 14 new fuzzers, and delivers a Salsa supply‑chain assessment. Current throughput is ~25–50 audits/year; funding would multiply that.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 2:51Deep audits uncover vulnerabilities
- 5:01OSTIF’s role in securing OSS
- 7:09Independent champion needed
- 8:13Seven years of audit lessons
- 10:43Proactive security via audits
- 11:06Cryo project case study
- 13:53Fixing vulnerabilities and tooling
- 16:46Funding and coordination hurdles
- 18:52Audit project management challenges
- 20:36Who funds OSS audits
- 22:41Industry views on audits
- 25:54Value of security audits
- 27:43Q&A: Audit frequency
- 33:23Q&A: Audit process steps
- 37:39Q&A: Tooling and fixes
- 39:05Q&A: Audit trust and status
related talks
39mManaging Audits for Critical Open Source Projects
30mSuccess Stories in Open Source: Security Audits with OSTIF
29mSecurity Audits in Action: Helping Improve Multiple LF Energy Projects
41mInside the CNCF Project Security Reviews
41mManaging the risk and growth of using Open Source Software
29mNavigating Open Source Risk: A Strategic Approach
49mImproving FOSS Security
42mAssessing the Risk of Open-source Components Using OpenSSF's Scorecard