Duration: 0:00

53 views

2

Better software supply chain integrity and security for organizations of all sizes is increasingly important for cybersecurity, especially with the ever-expanding edge computing environment and upcoming regulatory requirements. Small and medium enterprises (SMEs) must improve their security posture, but they do not have the budget to install and operate complex, expensive software systems for vulnerability management, report and ultimately regulatory compliance. SMEs also do not have the bandwidth or access to a dedicated security team, CISO, or CERT to assist their software supply chain management efforts. Instead, SMEs (and open source projects) need the help of accessible, free, and open source software solutions (FOSS) to inventory the components used in their products, create and share SBOMs, continuously monitor and triage potential vulnerabilities, and communicate with their stakeholders about vulnerability exploitability (VEX) and remediation actions. SMEs need all this, with minimal friction and costs, to improve their security posture and ensure CRA compliance.  In this talk, Mikaël Barbero from the Eclipse Foundation and Philippe Ombredanne from AboutCode will share how free and open source software (including projects funded by the EU) can reduce the possibility of serious cybersecurity incidents and emergencies from distributed software and devices. With free and open source tools, any organization - and especially SMEs - can more efficiently comply with the emerging CRA regulatory requirements, improve their software supply chain integrity, and strengthen their software supply chain security.