Tidelift: Removing the Risk from Bad Open Source Packages

"The Log4j project and its vulnerability, called Log4Shell, reminded everyone of the dangers of neglecting open-source software. The sheer breadth of organizations affected by a vulnerability in a single piece of software drove home just how much everyone relies on open source.”Bill Foster, D-Ill Investigations and Oversight Subcommittee Chairman As noted in the January 24, 2022 DoD CIO Memo for Senior Pentagon Leadership the department must follow an “Adapt, Buy, Create” approach to software. This Memo further expands on Executive Order 14028 that directed improvements on the nation's cyber security. During previous generations of DAF tech software solutions were a bespoke product of long developmental chains. In the modern age of GPC speed of development and production are key in meeting the rising challenges. This leaves the most attractive solution to adapt existing software to the need. Currently more than 97% of applications, and 90% of companies utilize open source software. While this technology has enabled dynamic shifts in the world around us, vulnerabilities are left open or created by harnessing this powerful tool. This has been demonstrated through numerous remote code executions including the Heartbleed vulnerability (2014), Shellshock (2014), Equifax Breach (2017), and most recently Log4Shell. Software tools alone can’t comprehensively address open source software supply chain challenges as demonstrated during the fall out of these significant breaches.  Human oversight and analysis must play a key role in ensuring that our nation's technological elements are secure now and in the future. Without a tools and human solution integrated into DevSecOps platforms, development teams in the private sector and DoD face drastic productivity drains, exposure to adversary attacks through unpatched security vulnerabilities, and intellectual property risks.Tidelift provides the only solution capable of ensuring that community-led open source libraries and packages upstream meet production-ready standards. By partnering upstream with independent community led project maintainers through Tidelift, the Air Force (DAF) and DoD will gain access to a safe, easy, consistent and cost-effective approach to managing open source components proactively. Tidelift is the only organization that is actively working directly with the open source community to improve data quality and ensure that Software Bill of Materials (“SBOMs”) have accurate, up to date and rich data. In addition, the Tidelift managed open source solution delivers customizable catalogs of software supply chain components that are actively maintained, secure, and accurately licensed, enabling developers to build and deploy faster and with confidence.