Open Source Accelerates Secure Software
The US DoD’s Software Fast-Track Initiative looks to improve software procurement and security. Open source software must be a key part of this.
Ben Cotton
May 12, 2025
Katherine Arrington, acting CIO for the U.S. Department of Defense, recently issued a memo titled “Accelerating Secure Software.” Included in this memo is the assertion that “widespread use of open source software…presents a significant and ongoing challenge.” Of course, open source software does present challenges — all software does. Sometimes the challenges of open source software are different from the challenges of vendor-purchased software. However, it is incorrect to say that the lack of "visibility into the origins and security of software code hampers software security assurance.”
How open source helps
The transparency of the code increases security assurance. With open source software, you can look at each line of code and see what it does. The identity of the person who wrote it no longer matters, because you can verify the code itself. Plus, anyone can submit a fix for vulnerable or buggy code. Academic research has consistently shown that open source software is, as a category, more secure than proprietary software.
Additionally, many tools and frameworks — open source themselves — exist to increase trust in the open source software supply chain. The OSPS Baseline gives open source projects practical guidance for securing their development, build, and release processes. SLSA provides levels of assurance for software build systems. in-toto gives transparency by cryptographically indicating who did what, when they did it, and how it was done. OpenSSF Scorecard provides software consumers a way of evaluating the security and community practices of upstream open source software. And GUAC ties all that information together into a queryable supply chain knowledge graph. The net effect of all of this tooling — and the fact that open source development happens in the public eye — gives software consumers an unprecedented level of transparency.
Lastly, open source software is simply inescapable. Research from Blackduck found that 96% of code bases include open source software. Microsoft’s CEO said as much as 30% of the company’s code is now written by generative AI, which is largely trained on the large corpus of open source software. Finding a software package that isn’t built with, from, or on open source is like trying to find a glass of water without dihydrogen monoxide.
Protecting the software supply chain
The software supply chain is at risk, there’s no question about that. Every week, another supply chain attack appears, and vulnerabilities are a constant battle. But open source software is the solution, not the problem. Open source software enables secure continuous delivery. We’re confident the new Software Fast-Track (SWFT) Initiative will come to this conclusion.
The Kusari Platform helps teams deliver faster, more secure software by giving developers, platform engineers, and security teams insights into their entire software supply chain. Sign up for a demo to see how Kusari can help secure your software supply chain.
Like what you read? Share it with others.
.webp)
.webp)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.png)
.jpg)
Previous
No older posts
Next
No newer posts
Want to learn more about Kusari?