CISA, Government, and Industry Partners Publish Fact Sheet for Organizations Using Open Source Software

Summary:

The Cybersecurity and Infrastructure Security Agency (CISA), Federal Bureau of Investigation (FBI), National Security Agency (NSA), and U.S. Department of the Treasury have published a fact sheet providing guidance on improving security and risk management of Open Source Software (OSS) used in Operational Technology (OT) and Industrial Control Systems (ICS). The guidance is intended to assist OT/ICS vendors and critical infrastructure entities in better managing risk from OSS use, including software supply chain and increasing resilience. The recommendations cover areas such as vendor support, vulnerability management, patch management, authentication and authorization policies, and establishing a common framework. This guidance aims to promote an improved understanding of and best practices for secure OSS use in OT/ICS environments, particularly in critical infrastructure organizations where the potential impact of incidents is significant.