[2024-03-28] TODO General Member & OSPOlogy Touchpoint - Open Office Hours

[anajsana]

Agenda (2024-03-28)

This meeting follows Chatham House Rules. Regular calls are not being recorded and discussions noted during the meeting do not share people's names nor organization affiliation.

Featured Topics

• Intros (use Zoom chat)
• Housekeeping
  • Chatham Rules - https://www.chathamhouse.org/about-us/chatham-house-rule
• Updates on EU Policies by LF Europe (Presented by Mirko) - 5 minutes
• OSPO News (Presented by Ana) - 3 minutes
• Q&A Session: Deep Dive on Security management with OpenSSF (Presented by Dana Wang)
• What is OpenSSF doing in Europe? (Presented by Georg Kunz)
• Aligning OSPO Functions with Emerging Needs in AI and Security (Presented by Lumi) - 5 minutes presentation

Open Work Hours:

Last 15 minutes

This is a free space governed under Chatham House Rules. Please add any questions/pain points you’d like to raise below!

• How can OSPOs collaborate better with Security Teams? Can we identify common pain points?
• Aligning OSPO Functions with Emerging Needs. What can be done in AI and security?

Essential Information

• 👩‍🏫 Find the meeting call on our website
• 🕛 Thursday 28th, 2:00 - 3:00 pm CET
• 📝 g.doc agenda

Meeting	Frequency	Duration	First 30’	Next 30’	Zoom link
Thursday Touchpoints	Monthly	1 hour	Agenda	Open Office Hours	Here

[anajsana]

Updates on EU Policies by LF Europe (Presented by Mirko)

Slide deck: https://docs.google.com/presentation/d/15zytUw24dQ_EqHkaNMvvqxu-0y60VDNNgEVSLd_TE3c/edit?usp=sharing

Activities

• Visit to Mobile World Congress Barcelona
• OSPOlogy Live Apeldoorn
• Foundation for Public Code will wind down EU activities.
• Presentation on CRA at FOSS Backstage
• 8th ENISA-ESOs Cybersecurity standardisation conference
  • Hard to get relevant stakeholders involved and be heard there.
• KubeCon EU Paris: LF Europe booth
  • Presentation together with OpenSSF
  • MSP-ICT and ICT Standardization Rolling Plan
  • Multi-Stakeholder Platform (MSP)
  • First meeting of MSP-ICT

Updates on policies and standards

• Surprise CRA vote in EU Parliament 12 March
  • Approved with strong majority
  • Legal linguistic review and translations still have to be done
• Standards development request
  • 44 standards to be requested from CEN-CENELEC
  • High-level, base-class and ‘topical standards’
  • Many LF foundations and projects will be stakeholders in the topical standards.
• Horizon Europe strategic plan 2025-2027
  • Published 20 March
  • Relevant if your company is involved in Horizon Europe
• Multi-stakeholder platform for ICT standardisation
  • 65 participants
  • Many experts
  • LF first group that is participating
  • Example discussion: how can open source projects get involved in standards development.
  • Key topics: AI Act, CRA, Interoperable Europe Act.

Q&A

• Open standards involvement?
  • LFEurope involved via MSP-ICT.
  • Standards is one level down: we need a matching process of projects/foundations with
  • Not the awareness that open standards are needed.

[anajsana]

Q&A Session: Deep Dive on Security management with OpenSSF (Presented by Dana Wang )

• Quick round: familiarity with OpenSSF projects? Some are familiar.

• OpenSSF Scorecard

  • Some OSPO’s were working on automating scorecards.
  • Running as a side project, with limited time to get it working and with some difficulties now and then.
  • April 15th Scorecard workshop. Will be recorded.

• OpenSSF Allstar might be a bit more difficult. If there are specific challenges, it might be an option to set up a dedicated call.

• Baseline minimal baseline requirements. Derived from US Government requirements.

  • Tied to project maturity level (graduate level). To be able to check off.
    • Example requirements: memory safe language, SBOM.
  • SBOM currently challenges of tooling to get quality SBOM. GUAC project being worked on. https://openssf.org/projects/guac/

• Workshops at SOSS Community Day NA https://openssf.org/event/hosting-soss-community-day-na-2024/

  • Scorecard workshop
  • SLSA workshop
    • SLSA is a bit more difficult to adopt it. Lockheed Martin.

• Table top exercise at SOSS Community Day NA.

  • Mirrors back to cyber incidents of open source projects. Starts with incident at security team, then root cause analysis, then coordinated disclosure, etc. So focussed on the projects. During the project also about the supplychain. Also coordination of CVE project.
  • Might be able to join for OSPO’s if relevant.
  • Playbook will be published after the event. Might the OSPO be able to share within the organization.

Q&A

• OpenSSF Baseline:

  • LF Energy wants to adopt it. Now uses OpenSSF Best Practices badge.
  • Outcome of Open Source Summit. Security baseline needed for every project.
  • Started for OpenSSF, can be used by other foundation when established.
  • Will be more stringent requirements on projects compared to best-practices badge, like SBOM’s and scorecard onboarding.
  • Idea: combine existing solutions and adopt security from the beginning of a project.
  • Currently in development, is a slide deck.
  • If willing to contribute, please get in touch.

• OpenSSF EU

  • Kicking off OpenSSF members and other European companies to working on strengthening involvement of OpenSSF with both public and private companies.
  • Already had a kick-off call, more to take place in the future.
  • Initially a slightly policy-heavy approach.

[anajsana]

Other Topics

• Aligning OSPO Functions with Emerging Needs: Security and AI (Presented by Lumi)
  • Moved to the next call due to technical issues.
• Open source conference Shenzhen
  • Similar challenges. Will report back with summary of summit highlights
  • Creation of OSPOlogy live China chapter