The US government has held a meeting with major technology companies to discuss improving cybersecurity. The White House said the meeting focused on open-source software and how to make the widely used software more secure by design and to more quickly detect and remedy any faults.
The meeting follows the detection of a serious vulnerability in the Apache Log4J software in December. The security hole known as Log4Shell affected thousands of applications around the world, opening up a relatively simple path for unauthorised access by hackers.
The Apache Software Foundation was among the participants at the meeting, along with Apple, Cloudflare, Facebook/Meta, GitHub, Google, IBM, the Linux Foundation, the Open Source Security Foundation, Microsoft, Oracle, RedHat and VMWare. Representatives of several federal bodies also joined, including the national cyber director, the departments of defense, commerce, energy and homeland security, the Cybersecurity and Infrastructure Security Agency, the National Institute of Standards and Technology, and the National Science Foundation.
The discussion focused on three topics: preventing security defects and vulnerabilities in code and open source packages, improving the process for finding defects and fixing them, and shortening the response time for distributing and implementing fixes. In the first category, participants discussed ideas to make it easier for developers to write secure code by integrating security features into development tools and securing the infrastructure used to build, warehouse and distribute code, like using techniques such as code signing and stronger digital identities. In the second category, participants discussed how to prioritize the most important open source projects and put in place sustainable mechanisms to maintain them. In the final category, participants discussed ways to accelerate and improve the use of Software Bills of Material, as required in an executive order from the US president, to make it easier to know what is in the software purchased and used.
The White House said the discussions between the private sector and government will continue in the coming weeks in support of the initiatives, and the talks are open to all interested public and private stakeholders.
