Linux, OpenSSF Champion Plan to Improve Open Source Security

Marking the one-year anniversary of President Biden’s Executive Order on Improving the Nation’s Cybersecurity, the Linux Foundation and the Open Source Software Security Foundation joined with 90 private-sector executives and government leadership to create a 10-point plan to improve the security of open source software. 

The plan has three primary goals — secure open source software production, improve vulnerability discovery and remediation, and shorten ecosystem patching response time — according to the announcement. 

The Open Source Software Security Mobilization Plan proposes 10 specific streams of investment in open source security including: education, risk assessment, digital signatures, memory safety, incident response, better scanning, code audits, data sharing, SBOMs, and improved software supply chain. The plan outlines the need for about $150 million in additional funding over the next two years. Amazon, Google, Ericsson, Intel, Microsoft, and VMware have pledged an initial investment of $30 million between them.

“What we are doing here together is converging a set of ideas and principles of what is broken out there and what we can do to fix it,” Brian Behlendorf, executive director, Open Source Security Foundation (OpenSSF), said in a statement announcing the group’s new initiative. “The plan we have put together represents the 10 flags in the ground as the base for getting started. We are eager to get further input and commitments that move us from plan to action.”