Open source software code is freely available for anyone to use, modify, or inspect. This open-access facilitates collaborative innovation and the development of new technologies to solve shared problems. Many aspects of critical infrastructure and national security systems rely on open source code, but there is no official resource allocation for maintaining the security of that code.

While open source code can provide significant benefits, it also poses risks if it is not properly maintained and secured. Most of the work to preserve and improve the security of open source software, including correcting known vulnerabilities, is done on an ad hoc, volunteer basis. Critical infrastructure and national security systems are vulnerable to attack without adequate resources devoted to open source security.

For too long, the software community has taken solace in believing that open source software is naturally secure due to its transparency and the belief that "many eyes" were watching to detect and resolve problems. But, while some projects do have many eyes on them, others have few or none at all. The result is that open source software is no more likely to be secure than any other kind of software. In fact, it may even be less secure because open source projects are often used by attackers to find and exploit vulnerabilities.

The best way to ensure the security of open source software is to audit it regularly and report any issues that are found. But even with regular audits, open source software can never be assumed to be completely secure.

Although much has been done to try and mitigate any problems, more work is needed across the ecosystem to develop updated standards for strengthening and securing open source software. Below are a few actions worth considering:

Pinpointing critical projects

Open source software (OSS) plays a critical role in our society, powering everything from mobile apps to the servers that run major websites. However, OSS is often developed by volunteer communities with little or no security expertise, which can leave it open to attack. In order to protect against these risks, there needs to be a public-private partnership to identify the most critical open source projects and allocate resources for security assessments and improvements.

This is not a short-term fix; we need to develop new ways of identifying software that might pose a systemic risk so that we can anticipate the level of security required. Only by working together can we hope to keep our open source software safe and secure.

Establishing security, maintenance & testing foundations

In recent years, there has been a growing reliance on open source software. This is primarily due to the fact that open source software is more cost-effective and often more reliable than proprietary software. However, this reliance has also led to some concerns about the security and stability of open source projects. In order to address these concerns, it is essential that industry and government come together to establish baseline standards for open source software. These measures should be produced through a collaborative approach, emphasising routine updates, ongoing testing, and verified integrity. By doing so, we can ensure that open source projects meet the highest standards of quality and safety.

Growing public and private support

Open source software plays a critical role in the infrastructure of many leading companies and organisations. However, there is often a lack of investment in keeping that ecosystem healthy and secure. One option that could help address this issue is setting up an organisation to serve as a marketplace for open source maintenance. This would provide a way for volunteers from companies to support the critical projects that need it the most. Such an organisation could help ensure that open source software remains a vital part of our infrastructure.

Open source software has become the connective tissue for much of the online world. It is the foundation for many of the applications and websites we use on a daily basis, and it plays a crucial role in how we communicate and interact with each other. Despite its importance, open source software is often overlooked and underfunded. This needs to change.

We need to start thinking of open source software in the same way we do our physical infrastructure. Just as we invest in our roads and bridges, we need to invest in open source software. We need to provide funding for open source projects, and we need to encourage more people to contribute to these projects. Only by working together can we build a strong and resilient digital infrastructure that can withstand the challenges of the 21st century.