Bridging Security & Privacy Standards: Harnessing OpenCRE for Effective Mapping
summary
Claims that OpenCRE-generated mapping produces fast, automated mappings are backed by a direct comparison to a SAMM → SSDF official mapping where OpenCRE misses many official relationships and injects notable noise percentage, so transitive mappings compound errors. An experiment shows extending OpenCRE to extra standards is workable but imperfect. Proposed fixes are manual refinement, involving NIST/ISO for endorsed mappings, measuring mapping quality, and using OpenCRE as a validated foundation rather than a final compliance proof.
AI-written summary · about
chapters (11)
- 0:00Mapping security standards
- 1:02Speaker background
- 2:06What is mapping and why it matters
- 7:21Mapping challenges
- 10:50Introducing OpenCRE
- 13:23Improving OpenCRE
- 16:57Certifications and compliance
- 17:42Mappings for compliance
- 25:55Key takeaways
- 27:21Q&A
- 30:56Closing remarks
related talks
32mOpen Common Requirement Enumeration (OpenCRE)
32mSAMM: Interactive Introduction And Update
28mThe future is simple - introducing the CRE
28mProduction, Consumption, and the Data: The Open Source Security Sandwich
48mApplying Cybersecurity Regulations and Industry Standards to Open Source Projects
44mNavigating Open Source and Open Standards for Better Cybersecurity
18mSecuring InnerSource
29mTurn Down That Noise: Why the OpenSSF Security Baseline Is Good for Maintainers