Standardizing Open Source Risk - LLW - 2023-04

1. Standardizing Open
Source Risk
Business Value Also Comes From Resources Saved

2. Standards Help You To Obtain Value

3. Things Are Getting
Complex

4. There Are More Rules And Guidelines
● NTIA Minimum Requirements of Software Bill of Materials (SBOM)
● White House Executive Order – SBOM again
● Cyber Resiliency Act (CRA) in the European Union – Reporting and
Compliance Requirements

5. 5.5tn
Global Cost of Cyber Crime
Source – CRA Explanatory Materials

6. Our Mental Model Of The Supply Chain

7. The Actual Supply Chain

8. 67.4%
of managers monitor their supply chain with Excel spreadsheets
https://www.zippia.com/advice/supply-chain-statistics/

9. 94%
of companies do not have full visibility of their supply chain
https://www.zippia.com/advice/supply-chain-statistics/

10. https://www.synopsys.com/blogs/software-security/open-source-trends-ossra-report/

11. Some Examples Of Standards To Manage Risk
From the OpenChain Project:
ISO/IEC 5230, the International Standard for open source license compliance
ISO/IEC DIS 18974, the industry standard for open source security assurance
From the SPDX Project:
ISO/IEC 5962, the International Standard for open source SBOM

12. People Are Using Standards Right Now
ISO/IEC 5230 OpenChain License Compliance Specification
ISO/IEC DIS 18974 OpenChain Security Assurance Specification

13. Get Some Lovely Standards
https://www.openchainproject.org/participate

14. BTW