Articles about Compliance and Security

Compliance and Security, Linux, Open Source, Blog, 2024

Do You Really Know What’s in Your Software Stack?

You wouldn’t purchase packaged food without an ingredient list, or accept a shipment without an inventory, but until recently, there has been little governance or standardization for documenting software components. This lack of...  Read More

The Linux Foundation | Sep 4, 2024

Compliance and Security

Meet LF Security: Your gateway to security-related efforts and projects across the Linux Foundation

One of our top priorities at the Linux Foundation is to enhance the security of the open source software ecosystem. At the LF, we have a variety of projects and programs that help to advance this goal of increased cybersecurity for all. To...  Read More

Hilary Carter | May 21, 2024

Compliance and Security, Open Source, license compliance

How to Navigate the Complexity of Open Source License Compliance

In the ever-evolving landscape of software development, the integration of open source software (OSS) has become ubiquitous, fostering innovation, efficiency, and collaboration. However, this adoption comes with its own challenges,...  Read More

Anna Hermansen | Jan 24, 2024

Featured Post, Compliance and Security, Decentralized Technology

The OpenChain Security Assurance Specification 1.1 Is Now Available

After a review cycle with ISO/IEC WG/SC27 the OpenChain Security Assurance Specification 1.1 is now available.  Read More

The Linux Foundation | Oct 6, 2022

Compliance and Security

Addressing Cybersecurity Challenges in Open Source Software: What you need to know

by Ashwin Ramaswami  Read More

The Linux Foundation | Sep 1, 2022

Compliance and Security

Secure Coding Practice – A Developer’s Learning Experience of Developing Secure Software Course

The original article appeared on the OpenSSF blog. The author, Harimohan Rajamohanan, is a Solution Architect and Full Stack Developer with Wipro Limited. Learn more about the Linux Foundation’s Developing Secure Software (LFD121) course....  Read More

The Linux Foundation | Aug 18, 2022

Compliance and Security

Adopting Sigstore Incrementally

This post is authored by Hayden Blauzvern and originally appeared on Sigstore’s blog. Sigstore is a new standard for signing, verifying, and protecting software. It is a project of the Linux Foundation. Developers, package maintainers, and...  Read More

The Linux Foundation | Aug 10, 2022

Compliance and Security

CRob on Software Security Education and SIRTs

In the Open Source Software Security Mobilization Plan released this past May, the very first stream – of the 10 recommended – is to “Deliver baseline secure software development education and certification to all.” As the plan states, it...  Read More

Dan Whiting | Jul 27, 2022

Compliance and Security

OSS Security Highlights from the 2022 Open Source Summit North America

By Ashwin Ramaswami  Read More

The Linux Foundation | Jul 26, 2022

Compliance and Security

Takeaways from the White House Cyber Workforce and Education Summit

Today the White House convened the White House Cyber Workforce and Education Summit to gather government and private-sector leaders to discuss how to address the labor shortage and other challenges for U.S. cybersecurity. The meeting...  Read More

Dan Whiting | Jul 19, 2022

Compliance and Security

Jamie Thomas: What is the OpenSSF

Jamie Thomas is the General Manager, Systems Strategy and Development at IBM and is also the OpenSSF Board chair. She sat down with Alan Shimel of TechStrong TV during OpenSSF Day in Austin to share about OpenSSF and how the open source...  Read More

Dan Whiting | Jul 13, 2022

Compliance and Security, Diversity & Inclusion

LEGO and Angel Island

Like many of the folks in open source, the LF’s Kenny Paul is a huge fan of building things out of LEGO. For Kenny however, it goes a bit beyond just opening a box and following the instruction book. In fact, he rarely ever builds anything...  Read More

Dan Whiting | Jul 11, 2022

Compliance and Security

SBOM - SB Doesn’t Stand for Silver Bullet

Software Bill of Materials (SBOMs) are like ingredient labels on food. They are critical to keep consumers safe and healthy, they are somewhat standardized, but it is a lot more exciting to grow or make the food rather than the label. What...  Read More

Dan Whiting | Jun 15, 2022

Compliance and Security

Open Source Software Security: Turning Sand into Concrete

Last week I had the privilege of participating in the Open Source Software Security Summit II in Washington, DC. The Linux Foundation and OpenSSF gathered around 100 participants from enterprise, the U.S. government, and the open source...  Read More

Dan Whiting | May 19, 2022

Compliance and Security

Brian Behlendorf Testifies on Open Source Software Security to the US House Committee on Science and Technology

This post originally appeared on OpenSSF’s blog. On Wednesday, May 11, 2022, Brian Behlendorf, OpenSSF General Manager, testified to the United States House of Representatives Committee on Science, Space, and Technology. Brian’s testimony...  Read More

The Linux Foundation | May 11, 2022

Compliance and Security

More Time on Innovating, Less Time on Compliance

I am old enough to remember when organizations developed software in-house – all of it. I also clearly remember my information systems college professor teaching it is almost always less expensive and better to use code/programs already...  Read More

Dan Whiting | Apr 15, 2022

Compliance and Security

Open Source Foundations Must Work Together to Prevent the Next Log4Shell Scramble

Brian Behlendorf  Read More

The Linux Foundation | Dec 16, 2021

Compliance and Security

What is an SBOM?

The National Telecommunications and Information Administration (NTIA) recently asked for wide-ranging feedback to define a minimum Software Bill of Materials (SBOM). It was framed with a single, simple question (“What is an SBOM?”), and...  Read More

The Linux Foundation | Jun 15, 2021

Compliance and Security

SPDX: It’s Already in Use for Global Software Bill of Materials (SBOM) and Supply Chain Security

Author: Kate Stewart, VP of Dependable Systems, The Linux Foundation  Read More

Kate Stewart | May 25, 2021

Compliance and Security

How LF communities enable security measures required by the US Executive Order on Cybersecurity

Our communities take security seriously and have been instrumental in creating the tools and standards that every organization needs to comply with the recent US Executive Order  Read More

The Linux Foundation | May 14, 2021

Compliance and Security

Generating a Software Bill of Materials (SBOM) with Open Source Standards and Tooling

Every month there seems to be a new software vulnerability showing up on social media, which causes open source program offices and security teams to start querying their inventories to see how FOSS components they use may impact their...  Read More

The Linux Foundation | Mar 16, 2021

Compliance and Security

Interview with Shuah Khan, Kernel Maintainer & Linux Fellow

Jason Perlow, Director of Project Insights and Editorial Content at the Linux Foundation, had an opportunity to speak with Shuah Khan about her experiences as a woman in the technology industry. She discusses how mentorship can improve the...  Read More

The Linux Foundation | Jan 28, 2021

Compliance and Security

How to report security vulnerabilities to the Linux Foundation

We at The Linux Foundation (LF) work to develop secure software in our foundations and projects, and we also work to secure the infrastructure we use. But we’re all human, and mistakes can happen.  Read More

The Linux Foundation | Nov 12, 2020

Compliance and Security

Healthcare industry proof of concept successfully uses SPDX as a software bill of materials format for medical devices

Overview Software Package Data Exchange (SPDX) is an open standard for communicating software bill of materials (SBOM) information that supports accurate identification of software components, explicit mapping of relationships between...  Read More

The Linux Foundation | Aug 5, 2020

Compliance and Security

SPDX 2.2 Specification Released

The SPDX technical community is delighted to announce that the 2.2 version of the specification has been released! We started working on the first version of the SPDX specification 10 years ago, and it has continued to improve and evolve...  Read More

Kate Stewart | May 7, 2020