Central Alameda News

Washington, D.C. -- On May 17, the House Homeland Security Committee unanimously voted to pass the Securing Open Source Software Act, a bipartisan bill introduced by Rep. Mark Green, R-TN, Chairman of the House Homeland Security Committee, and Rep. Eric Swalwell, D-CA, Ranking Member of the House Homeland Cyber Subcommittee. A companion bill, sponsored by Senate Homeland Security and Government Affairs Committee Chairman Gary Peters, passed out of the Senate committee in March.

Open source software, which is distributed with its original source code, is easily manipulatable. Unfortunately, this subjects it to vulnerabilities that bad actors commonly seek to exploit. This most recently occurred when a Log4j vulnerability was disclosed, posing a severe risk to millions of consumer products including enterprise software and web applications. The Securing Open Source Software Act aims to better protect open source software from future attacks by engaging the Cybersecurity and Infrastructure Security Agency (CISA) to curb existing and future risks.

“Although I commend CISA, through the Joint Cyber Defense Collaborative, for quickly responding to the Log4j vulnerability with recommendations for swift remediation, Congress must do more to assess the cybersecurity hazards posed by open source software,” said Swalwell. “I am proud to see my legislation advance out of the Homeland Security Committee, putting us one step closer to ensuring that the use of open source software across the federal government never poses such a dangerous threat to our homeland security ever again.”

The Securing Open Source Software Act requires CISA to develop a framework to evaluate the security of open source software by engaging stakeholders and the federal government. In light of the federal government’s heavy reliance on open source software, the bill directs CISA to perform an assessment of open source software components deployed on high value assets on federal networks. Finally, the bill authorizes CISA to launch a pilot program to assess, on a voluntary basis, the open source software used by certain critical infrastructure owners and operators.

Original source can be found here