Open Source Code Just as Secure as Proprietary Software—If You Manage It Right, Says CISA

Sicherheitsmeldung mit Schweregrad noch nicht bewertet. Technische Details im Tab „Originaltext“; empfohlene Schritte in der Checkliste.

Originaltext der Quelle (nicht übersetzt) – die deutsche Zusammenfassung findest du im Tab „Kurzfassung".

Open source can be just as safe as proprietary software, though government agencies (and private enterprises) should take additional measures to secure it properly, according to a new guide published by the U.S. Cybersecurity and Infrastructure Security Agency (CISA). The report, “Open Source Software: Security Principles and Practices,” provides with guidance to help agencies comply with two Presidential Executive Orders (14144 and 14306) which both urged them to do a more thorough job securing the software they use, a response to recent exploits like Log4Shell and XZ utils. CISA acknowledges that open source can provide immeasurable benefits to government agencies, not merely because it is available without licensing fees, but also because agencies can extend the software to meet their own requirements. But at the same time, open source software must be managed differently than proprietary software. Malicious hackers (and increasingly AI agents) use vulnerabilities to gain entry and exploit systems. In the case of the vendor software, it is the vendor’s responsibility to provide timely updates should a software vulnerability be found, which agencies should apply as soon as possible. With open source software, however, agencies need to take a more proactive role in patching and understand the dependencies, or additional software components, that an open source package relies on. Those components also need to be secured, the guidance advises. The guidance describes established principles for patching. It also provides a framework to evaluate trustworthiness and risk …

Vollständiger Originalartikel ↗

• Betroffenheit im eigenen Stack prüfen: Versionen/Komponenten abgleichen.
• Originalquelle / Hersteller-Advisory lesen: https://devops.com/open-source-code-just-as-secure-as-proprietary-software-if-you-manage-it-right-says-cisa/
• Verfügbaren Patch oder Workaround einspielen und dokumentieren.