OSGeo Security Initiative - Revision history

Jive at 17:30, 21 November 2023

2023-11-21T17:30:34Z

Jive: /* Initial Proposal */

2023-11-21T17:28:01Z

Initial Proposal

Jive at 17:22, 21 November 2023

2023-11-21T17:22:00Z

Jive: Include initial proposal

2023-04-06T17:35:24Z

Include initial proposal

Jive at 16:41, 6 April 2023

2023-04-06T16:41:58Z

Jive: Created page with "OSGeo Security initiative is proposed but not yet active. If you are interested in this activity please volunteer by adding your name to this wiki page. Volunteers: * Jody..."

2023-04-06T16:41:20Z

Created page with "OSGeo Security initiative is *proposed* but not yet active. If you are interested in this activity please volunteer by adding your name to this wiki page. Volunteers: * Jody..."

New page

OSGeo Security initiative is *proposed* but not yet active. If you are interested in this activity please volunteer by adding your name to this wiki page.

Volunteers:

* Jody Garnett (GeoCat)

This is a challenging but important topic:

* Supply chain attacks taking advantage of Open Source communities causes real harm. Automated tools for reviewing software components are providing much greater transparency into supply chain attacks, but also putting a lot of pressure on open source projects.

* The relationship established between industry and security researchers has resulted in an accent CVE system to track and disclose vulnerabilities in a responsible fashion. Communication and response times established do not reflect the availability of resources to Open Source projects.

Once critical mass is reached we will ask the board to be created in order to pursue the above goals.

* Option: Update the financial guidance document with clear examples for security issue funding (in the same fashion as code sprints have clear guidance). As an example requesting projects should have a clear CVE established and have assessed their project as vulnerable before seeking support. A similar cost-sharing arrangement to codesprints is anticpated.

* Option: Establish an ongoing committee that can review incoming funding requests in a secure fashion on behalf of the board. This has privacy issues similar to the code of conduct committee and would need to be carefully considered.

While this initiative is not yet active, if your project faced with unexpected crisis please should reach out to OSGeo for assistance using the financial guidance document below.

References:

* [https://github.com/OSGeo/osgeo/blob/master/board/documents/osgeo_financial_guidence.pdf OSGeo Financial Guidance] provides application process

← Older revision		Revision as of 17:30, 21 November 2023
Line 6:		Line 6:

	This is a challenging but important topic:		This is a challenging but important topic:
		+
		+	* Regulation, such as Cyber Resilience Act, place increased demands OSGeo Service providers.

	* Supply chain attacks taking advantage of Open Source communities causes real harm. Automated tools for reviewing software components are providing much greater transparency into supply chain attacks, but also putting a lot of pressure on open source projects.		* Supply chain attacks taking advantage of Open Source communities causes real harm. Automated tools for reviewing software components are providing much greater transparency into supply chain attacks, but also putting a lot of pressure on open source projects.

@@ Line 25: / Line 25: @@
 * [https://github.com/OSGeo/osgeo/blob/master/board/documents/osgeo_financial_guidence.pdf OSGeo Financial Guidance] provides application process
-==== Initial Proposal ====
+==== Revised 2024 Proposal ====
 This is the initial proposal to the board:

← Older revision		Revision as of 16:41, 6 April 2023
Line 23:		Line 23:

	* [https://github.com/OSGeo/osgeo/blob/master/board/documents/osgeo_financial_guidence.pdf OSGeo Financial Guidance] provides application process		* [https://github.com/OSGeo/osgeo/blob/master/board/documents/osgeo_financial_guidence.pdf OSGeo Financial Guidance] provides application process
		+
		+	[[Category:Initiative]]

@@ Line 9: / Line 9: @@
 * Supply chain attacks taking advantage of Open Source communities causes real harm. Automated tools for reviewing software components are providing much greater transparency into supply chain attacks, but also putting a lot of pressure on open source projects.
-* The relationship established between industry and security researchers has resulted in an accent CVE system to track and disclose vulnerabilities in a responsible fashion. Communication and response times established do not reflect the availability of resources to Open Source projects.
+* The relationship established between industry and security researchers has resulted in an "Common Vulnerabilities and Exposures (CVE)" system to track and disclose vulnerabilities. Communication and response times established do not reflect the availability of resources to Open Source projects.
 Once critical mass is reached we will ask the board to be created in order to pursue the above goals.

@@ Line 4: / Line 4: @@
 * Jody Garnett (GeoCat)
 This is a challenging but important topic:
@@ Line 14: / Line 13: @@
 Once critical mass is reached we will ask the board to be created in order to pursue the above goals.
-* Option: Update the financial guidance document with clear examples for security issue funding (in the same fashion as code sprints have clear guidance). As an example requesting projects should have a clear CVE established and have assessed their project as vulnerable before seeking support. A similar cost-sharing arrangement to codesprints is anticpated.
+* While a specific mandate is not yet available while the committee forms, see initiative proposal by Jody Garnett for some ideas
-* Option: Establish an ongoing committee that can review incoming funding requests in a secure fashion on behalf of the board. This has privacy issues similar to the code of conduct committee and would need to be carefully considered.
+* Option: Update the financial guidance document with clear examples for security issue funding (in the same fashion as code sprints have clear guidance). As an example requesting projects should have a clear CVE established and have assessed their project as vulnerable before seeking support. A similar cost-sharing arrangement to codesprints is anticpated. There is already a secure line of communication available to community members to contact the board.
 While this initiative is not yet active, if your project faced with unexpected crisis please should reach out to OSGeo for assistance using the financial guidance document below.
@@ Line 23: / Line 24: @@
 * [https://github.com/OSGeo/osgeo/blob/master/board/documents/osgeo_financial_guidence.pdf OSGeo Financial Guidance] provides application process
 [[Category:Initiative]]