Skip to main content

📣 Submit your proposal: OpenSSF Community Day Korea | Open Source SecurityCon

search
Category

Blog

Oct 24
Love0

Case Study: Kusari’s Implementation of OpenSSF Tools and Services

By Blog, Case Studies

Challenge

For many years, the software supply chain has suffered from a lack of transparency and inefficient, unsustainable security management methods such as spreadsheets, emails, and word of mouth. The severity of these challenges was highlighted during incidents like Log4Shell, where the limitations of these approaches became evident — organizations struggled to identify where Log4J was used, and many applications continue to use vulnerable versions of this library years later. Meanwhile, the costs and regulatory requirements of attacks and vulnerabilities continue to increase. The founders of Kusari, driven by their passion and personal experiences with these problems, sought to create scalable and robust security solutions for their customers and users.

Solution

To address these challenges, Kusari created and co-developed the tool GUAC (Graph for Understanding Artifact Composition). GUAC integrates data from various OpenSSF tools and specifications to secure Kusari’s platform software and infrastructure. Kusari uses AllStar to enforce best practices for source code repositories and Scorecard to assess repositories for best practice adherence and highlight areas of concern. By adopting SLSA (Supply Chain Levels for Software Artifacts), Kusari follows Level 3 practices for building projects and generating provenance. OpenVEX is used to communicate the vulnerability status of software, while S2C2F (Supply-Chain Levels for Secure Commercial Facilities) ensures rules are followed for safely ingesting open source software. GUAC aggregates data from multiple sources like Scorecard, SLSA, OpenVEX, SBOM, OSV, and deps.dev to analyze supply chain risks and ensure compliance with S2C2F rules.

According to Parth Patel, Co-founder & Chief Product Officer at Kusari, “Working with OpenSSF projects is an invaluable part of building Kusari – both as a company and an enterprise platform. Participating in open source communities allows us to shape the future of software supply chain technology. The work we invest in OpenSSF communities pays off in having reliable software tools to build and integrate with the security ecosystem.”

Results

The implementation of these tools has significantly enhanced Kusari’s ability to manage and mitigate software supply chain risks. The adoption of open specifications like SLSA, S2C2F, and OpenVEX allows Kusari to generate and consume supply chain data that is broadly supported in the community. Tools like AllStar, Scorecard, and Sigstore help enforce best practices in code, build, and delivery processes. GUAC enables Kusari to ingest and analyze standardized metadata from multiple OpenSSF tools, providing a clear understanding of supply chain risks and facilitating quick responses to security incidents.

Engagement with OpenSSF Community

Kusari engages with the OpenSSF community in various capacities, including as maintainers and users of AllStar, GUAC, and SLSA, and as TAC sponsors for GitTUF, SBOMit, and S2C2F. This engagement is a way for us to innovate and give back within the open source community. Kusari is committed to helping shape and develop the future of software supply chain security. You can regularly find us in meetings with the Supply Chain Integrity Working Group; come join in. 

Benefits and Challenges

Open specifications and tools provide flexibility for integration and modification, ensuring better interoperability. Security has a long history of being closed and vendor-centric, but that’s changing. Collaboration is required to protect effectively against current and future threats. That’s why Kusari is passionate about being a creator, maintainer, contributor and user of open source security tools. 

Striking a balance between vendor support and community-driven efforts is crucial for sustainable success in open source projects. Arun Gupta, vice president and general manager of Open Ecosystem Initiatives at Intel and OpenSSF governing board chair emphasizes, “It’s vital that we foster collaboration between vendors and the open source community in a collaborative manner that respects the community. This balance is key to achieving a secure software ecosystem.”

Future Plans

Kusari plans to adopt additional OpenSSF tools such as GitTUF as they mature and looks forward to developments from SBOMit.

Conclusion

Kusari’s integration of OpenSSF tools and specifications has significantly bolstered its software supply chain security, providing scalable and efficient solutions for managing vulnerabilities. Through active participation in the OpenSSF community, Kusari continues to contribute to and benefit from the evolving landscape of open source security.

 

Oct 22
Love0
SOSS-Fusion-2024-OpenSSF-SOSS-Fusion-Conference-Kicks-off-with-Talks-from-Google-and-Cisco-Executives-

OpenSSF SOSS Fusion Conference Kicks off with Talks from Google and Cisco Executives

By Blog, Press Release

Event aims to create a more secure open source future by covering high-priority topics and offering workshops and industry expert insights

WASHINGTON — October 22, 2024 — The Open Source Security Foundation (OpenSSF) announced the opening of the Secure Open Source Software (SOSS) Fusion Conference in North America in Atlanta, GA, today. This event unites a diverse community of professionals, including public sector leaders, software developers, security engineers, students, cybersecurity experts, CISOs, CIOs, founders, and tech pioneers. With a robust agenda covering AI security, critical open source security projects, public policy, and today’s most pressing security topics, SOSS Fusion offers a comprehensive look at OpenSSF’s initiatives that’s aimed at simplifying security for developers, and will help them prepare to shape a safer digital world in 2025 and beyond. 

The OpenSSF supports a vibrant, active community developing tools and best practices to aid developers on their security journey. With 7,500-plus projects in the OpenSSF Best Practices Badge program, the foundation remains committed to educating and influencing the broader community through thought leadership in open source security. This year, OpenSSF staff and community members have presented at over 30 meaningful events, such as VulnCon, OSPOs for Good, OECD Global Forum on Digital Security for Prosperity, and Grace Hopper Celebration, among others.

This event aims to strengthen the community by bringing together industry leaders, developers, project maintainers, students, and security researchers. Together, they will exchange actionable insights and introduce state-of-the-art tools to improve the security of open source software for everyone. Participants will stay informed about the latest advancements in open source security.

“When I look at the lineup of topics at SOSS Fusion and speakers I am reminded of our amazing community. I see an excellent mixture of our seasoned members and projects alongside new and exciting voices joining us for the first time,” said CRob, chief security architect at OpenSSF. “The sessions cover important key topics ranging from AI and machine learning security, to some of our newest projects, like Zarf. This event will be valuable to attendees and will showcase the most innovative ideas and initiatives the open source community has to offer.”

Along with notable keynote sessions and workshops, the agenda will highlight key themes from Cisco, Google, Kusari, and Linux Foundation executives including:

Recorded sessions will be available on demand approximately two weeks after the event. Sign up for the OpenSSF newsletter to receive notifications about the recorded sessions, and visit the website to learn more about becoming an OpenSSF member.

About the OpenSSF

The Open Source Security Foundation (OpenSSF) is a cross-industry initiative by the Linux Foundation that brings together the industry’s most important open source security initiatives and the individuals and companies that support them. The OpenSSF is committed to collaborating and working upstream and with existing communities to advance open source security. For more information, please visit us at openssf.org.

Media Contact:

Jennifer Tanner
Look Left Marketing
openssf@lookleftmarketing.com

Sep 26
Love0

OpenSSF Announces Key Themes of AI Security, Diversity and Open Source Public Policy at SOSS Fusion Conference

By Blog, Press Release

Engaging Sessions Led by Industry Experts Will Empower Attendees With the Knowledge, Tools, and Connections to Drive Innovation and Enhance Security in the Open Source Ecosystem

WASHINGTON — September 26, 2024 — The Open Source Security Foundation (OpenSSF) is pleased to announce the agenda for its inaugural Secure Open Source Software (SOSS) Fusion Conference, which will take place October 22-23, 2024, in Atlanta, Ga. Featuring presentations covering a variety of high-priority topics, including AI security, diversity, OSS consumption and public policy, the conference will bring together a diverse group of professionals from both the public and private sectors — software developers, security engineers, cybersecurity experts and leaders, founders, tech pioneers and policymakers — to collaborate on creating a more secure open source future. 

In the wake of recent high-profile incidents including XZ Utils, there has been an industry-wide pivot to focus on creating and implementing programs and best practices to bolster open source security. SOSS Fusion will unite key stakeholders for discussions, training and community-building opportunities to advance a more secure digital future. The program will feature keynotes from industry leaders, including:

  • Decoding the AI Revolution; Implications for Security and Society: AI Security Matters: Bruce Schneier, renowned security technologist and best-selling author
  • Window Snyder, founder and CEO at Thistle Technologies (session details forthcoming)
  • Enshittification Was a Choice: Cory Doctorow, science fiction author, activist and journalist
  • Government’s Continuing Path Contributing Towards a Secure Open Source Ecosystem: Timothy Pepper, senior technical advisor, open source software security, U.S. Cybersecurity and Infrastructure Security Agency (CISA)
  • Setting the Standard — Safely Operationalizing OSS Contributions: Brenton Stevens, open source compliance manager, Fannie Mae
  • There Is Just One Way to Do Open Source Security: Together: Marten Mickos, CEO, HackerOne

“Security in the open source world is not just about technology; it’s about building a culture of collaboration and trust,” said Arun Gupta, vice president and general manager of Open Ecosystem Initiatives at Intel and OpenSSF governing board chair. “At SOSS Fusion, we’re bringing together the best minds in the industry to address the pressing challenges of our time, from AI security to diversity and public policy. This conference is an essential step towards creating a safer, more inclusive digital future.”

It will also showcase workshops on the latest security technologies, panel discussions on emerging cyber threats, and networking opportunities with peers and industry leaders. Agenda highlights include:

  • Building Developer Confidence in Software Security With the DevRel Community [Panel]: Katherine Druckman, Intel Corporation; Tabatha DiDomenico, G-Research; Lori Lorusso, Percona
  • Assessing Open Source Software Projects in the Software Supply Chain: Scott Hissam, Carnegie Mellon Software Engineering Institute, and Joshua “CoCo” Crisp, Unified Platform (USCYBERCOM)
  • Trojan Model Hubs: Hacking the ML Supply Chain and Defending Yourself from Threats: Sam Washko and William Armiros, Protect AI
  • Navigating the Quantum Readiness Journey: Hands-on Guidance for Starting Your Migration: Eric Mizell, Keyfactor
  • Is Diversity the Top Ingredient in Your SBOM?: Rao Lakkakula and Tunji Taiwo, JPMorgan Chase

Registration for SOSS Fusion 2024 is now open. To learn more about the event, including sponsorship opportunities, please visit the event website.

About the OpenSSF

The Open Source Security Foundation (OpenSSF) is a cross-industry initiative by the Linux Foundation that brings together the industry’s most important open source security initiatives and the individuals and companies that support them. The OpenSSF is committed to collaborating and working upstream and with existing communities to advance open source security. For more information, please visit us at openssf.org.

Media Contact:

Jennifer Tanner
Look Left Marketing
openssf@lookleftmarketing.com

We envision a future where OSS is universally trusted, secure, and reliable. Join us in making open source more secure.

Get Involved
Close Menu