Open-Source Software Libraries Security & Threat Intel Sharing

The PCSI partners involved in the project will share knowledge of the testing techniques’ results, providing additional security attestation when using open source software libraries. Also, the PCSI partners in the project will analyze the identified risks and share Threat Intelligence (TI) amongst all other PCSI partners for further policy development. Finally, PCSI core partners may decide to make results of analyses conducted within the project available upstream, thus sharing those back with the maintainers of these open source software libraries, where security risks will have been identified. Open-source communities may choose to use those results to fix and improve future updated versions.  

Innovative aspects   

• The introduction of an array of software testing techniques which includes fuzzing in the software development lifecycle pipelines.   

• Collaboration in lowering the threshold for PCSI partners when it comes to acquiring new skills and knowledge.  

• Identifying vulnerabilities in commonly used open source software libraries collaboratively, whilst not hindering healthy competition in the market.  

Solutions 

The project aims to deliver a solution which will provide a reliable way to increase software quality and increase security. This solution would make it actionable information on how to test configurations yielding efficient results when testing open source software libraries. The feedback loop towards the open-source software community would eventually lead to faster patching, resulting in better long-term maintenance and security of open source libraries.  

Intended end result 

At the end of the project, each PCSI partner will have a good understanding of the risks of using open source libraries and improved knowledge and skills about an array of software testing techniques including fuzzing. As a result, the exposure to security risks is reduced and the quality of all the PCSI partners' software products in which open source libraries is used has significantly improved. While it is possible that no zero-day vulnerabilities will be found in these libraries, while the project is running, the TI sharing platform that will be set up will be put into production at the PCSI partners. Using this platform, Threat Intelligence will be shared on which OSSLS are safe to use. 

Picture source: www.vecteezy.com