Navigating Open Source and Open Standards for Better Cybersecurity
summary
Argues that security gaps stem from tooling, incentives and fragmentation, citing surveys: 66% of security teams do not share data and 84% say integration matters, and pushes concrete mitigations: adopt SBOMs (CycloneDX and SPDX) with validators and a SBOM diff tool, run OpenSSF scorecards, use licensed scanners contributed to OWASP, and explore IBM research on binary fingerprinting for provenance. Notes policy drivers (US 2021 executive orders, EU CRA) and recommends building internal SBOM skills or sourcing open‑source from vendors that maintain projects.
AI-written summary · about
chapters (28)
- 0:00Open source cybersecurity intro
- 0:46Cybersecurity challenges 2023
- 2:55Need for cybersecurity cooperation
- 4:43Four pillars of open security
- 5:48Open Cybersecurity Alliance
- 6:54Shift to open source standards
- 8:17Government response to risks
- 10:03Executive orders on transparency
- 11:30Software bills of materials
- 13:19CycloneDX and SPDX evolution
- 14:02OpenSSF role in security
- 15:24Open source as solution
- 16:05EU cybersecurity regulations
- 17:51EU standards development
- 19:37Cyber Resilience Act process
- 21:06IBM supply chain security
- 21:50Building SBOM skills
- 23:17IBM OpenSSF governance
- 24:45IBM open security tools
- 27:15Binary analysis for software
- 28:21Future of open standards
- 29:49Recommendations for organizations and individuals
- 31:57Q&A: Contributing to open source
- 36:13Q&A: Log4j incident
- 37:17Q&A: Standards vs best practices
- 40:07Q&A: Simplifying compliance
- 41:30Q&A: SBOM tools automation
- 42:53Q&A: Accessing security tools
related talks
28mKeeping Networks Secure: The Open Way
25mYour Software Supply Chain is Only as Secure as its Weakest Link
29mNavigating the Open Source Policy Labyrinth: Unraveling Global Policy Efforts for a Secure Future
01h 16mCybersecurity with CDF & OpenSSF Focus Group
18mThe Current State of Open Source Security Compliance Tooling Is … Well, Sad.
40mSecurity: Why It _has_to Be Open Source
11mSupply Chain Cybersecurity
17mA New Era for Open Source Security