The community of open source software (OSS) enthusiasts convened at the Open Source Security Foundation's (OpenSSF) Secure Open Source Software Summit in Washington, DC, to foster collaboration across various sectors including business, government, and essential infrastructure.
Open source software, freely accessible for utilization and modification, is a driving force behind innovation for many tech professionals. At JPMorgan Chase, our extensive team of over 57,000 technologists integrates numerous open source components into our tools, providing a competitive advantage for our company, clients, and customers.
Why is the security of Open Source Software crucial?
The collaborative and open nature of OSS allows tech experts to tackle common issues together, leading to software that supports vital operations in both public and private sectors, including national security systems and essential infrastructure. While OSS's open accessibility spurs innovation, it can also be exploited by malicious actors to identify and target vulnerabilities in widely-used code, impacting organizations on a broad scale. The recent surge in high-profile OSS attacks highlights the necessity for robust public-private partnerships to create tools and solutions that support the many volunteers maintaining OSS. We all have a part to play in enhancing OSS security, and we invite others who utilize open source to join us in this vital endeavor.
What achievements has the Open Source Community made in the past year?
In May 2022, OpenSSF introduced the Open Source Software Security Mobilization Plan, instrumental in guiding industry and government initiatives to safeguard the open source software supply chain. The plan has prompted improvements in OSS security education and the creation of tools like Sigstore, for secure software validation, and Alpha-Omega, for identifying and resolving vulnerabilities in popular packages.
JPMorgan Chase, in collaboration with other financial entities, established the Financial Services Information Sharing and Analysis Center (FS-ISAC) Supply Chain working group. This group aims to share emerging supply chain threats with the financial sector and develop guidance to counter such threats, exemplified by the Software Supply Chain Primer White Paper published in 2025.
What transpired at the Summit?
Summit attendees explored security challenges in OSS consumption across critical infrastructure sectors, the potential for leveraging AI advancements to bolster OSS security, and the shared responsibility to enhance OSS resilience in critical infrastructure. The significant U.S. Government presence at the Summit underscores the public sector's commitment and backing for initiatives aimed at improving OSS security and fostering strong public-private partnerships for more secure outcomes.
The summit concluded with discussions on strategies for achieving tangible results aligned with three objectives for the coming year: (1) providing security education for OSS developers and stakeholders, (2) bolstering the security of OSS repositories, and (3) facilitating cross-collaboration for incident response.
What are our next steps?
There is further work to be done in enhancing tools to counter software supply chain attacks. We recognize the importance of supporting OSS evaluation tools like Security Scorecard, an automated security tool that helps users assess the risks associated with their software dependencies, and Software Bill of Material (SBOM) capabilities, which provide an inventory of application components. At JPMorgan Chase, our security teams are致力于 developing such solutions and are collaborating with organizations like OpenSSF to create more integrated tooling and capabilities that will foster safer practices and prevent significant future software supply chain security breaches.
Fulfilling Our Role
JPMorgan Chase is steadfast in our commitment to partnerships aimed at improving open source security. As a founding member of OpenSSF and through our leadership in the Financial Services Sector Coordinating Council (FSSCC) and the Financial Services Information Sharing and Analysis Center (FS-ISAC), we will continue to play an active role in supporting and shaping the efforts of both industry and government to secure the open source software ecosystem.