Open Source Software Transparency for Acquisition - Making Security Trade-off Decisions

Learn about the complexities of open source software security and acquisition in this 35-minute talk from Carnegie Mellon Software Engineering Institute's Scott Hissam. Explore how modern systems rely heavily on reused open-source components and the associated cybersecurity challenges this creates. Discover approaches for organizations to balance cost, schedule, and security considerations when acquiring OSS components. Examine why traditional security assumptions about "many eyes" reviewing code are insufficient without understanding the depth and quality of analysis performed. Gain insights into the importance of measuring both software development processes and product security metrics to make informed decisions about open source software implementation.