Security Advisory Programs: Creating Transparency Along the Software Supply Chain - Tyler Townes
Channel: The Linux Foundation
Date: 2023-05-25

Security Advisory Programs: Creating Transparency Along the Software Supply Chain - Tyler Townes, BlackBerry

Open Source Software makes up a large portion of modern software products. Additionally, due to the open and transparent nature of open source the trajectory of vulnerabilities being found can be high. With the scale of CVEs discovered, and the large quantity of open source used inside a typical product it can be difficult to maintain a transparent and up to date security communications program. Customer demand has also significantly increased for accountability with regards to patching of open source used inside of products and disclosure of patched vulnerabilities. Customer demand can also be unique to various verticals, not all customers have the same needs or expectations. We will delve into a matrix of options to think critically about how to support your customers in their need for transparency. No one size fits all but we will give you the strategies required to think through the problems and how they apply to your business. In this talk we will give an overview of various ideas that you may employ to satisfy your requirements. We will review strategies for gathering support to build your own security communications programs, review processes, templates, and policies to help govern the program, and provide insight to align this program with your business goals.