Panel Discussion: A Balancing Act: OSPOs in Action Within BFSI (Banking, Financial Services, and Insurance)
summary
Banks describe how a Log4j crisis forces asset discovery and rapid mitigation, so OSPOs inventory components with SBOMs mandated by RBI SEBI CERT-IN, run daily or quarterly patch cadences, and scan CVEs from the national vulnerability database. Teams use OpenShift and DNF for fixes, practice inner-sourcing and contributor training, and choose build for core domains but buy niche COTS. Pain points include manual license checks, dual‑license traps (WTFPL) and lack of paid support for critical libraries; regulators and S-bOM tooling drive measurable change.
AI-written summary · about
chapters (11)
- 0:00OSPO panel introduction
- 6:44Defining OSPOs and roles
- 9:13Open source consumption challenges
- 12:03Regulatory compliance in open source
- 14:10Engineer views on security
- 16:16Security risks and SBOM in banking
- 20:07Build vs buy vs open source
- 22:12Global OSPO challenges
- 23:15Open source and Linus Torvalds
- 23:55Balancing speed with compliance
- 25:17Desired software changes
related talks
34mSupply Chain Security, SBOMs and How OSPOs Can Play An Important Role Going Forward - An Ecosystem and Compliance Update
30mOSPOs in Finance: Ways to Overcome Industry Barriers to Accelerate OS Adap...
34mThe Role of OSPO Manager for the Organization’s Success
31mLessons Learned After 1 Year Running an OSPO in Bancolombia (LATAM)
26mLooking at Open Source Security from the Community Angle
46mPanel Discussion: What Our OSPOs Have...
46mOSS Management & OSPO Ask Anything
26mNavigating Open Source: Establishing an OSPO for Organizational Success