New CISA guidance targets software supply chain risks on secure use of open source software across federal agencies

In brief

The US Cybersecurity and Infrastructure Security Agency has issued guidance to help federal agencies manage the security risks associated with open-source software throughout its lifecycle. Agencies are advised to assess projects before adoption, select actively maintained components, understand applicable licences and maintain accurate inventories of open-source dependencies. The guidance introduces the C4 Framework, which evaluates a project’s codebase, community, conduct and configuration, and recommends using software bills of materials to identify affected components when new vulnerabilities emerge.

CISA also recommends continuous vulnerability monitoring, prompt patching and replacing unsupported software when security problems remain unresolved. Federal agencies are encouraged to contribute fixes and documentation to the projects they use, while ensuring that published code does not expose credentials, encryption keys or internal system information. Internally developed open-source projects should follow secure development practices and include documentation, contribution rules, vulnerability-disclosure procedures and an SBOM. The guidance urges particular caution with open-source AI systems, as unavailable training data or development details can prevent users from establishing provenance and fully evaluating supply-chain risks.

Source: Industrial Cyber

‍

‍