Trending

Stories

Google Calls for Govt Help to Secure Critical Open-Source Software

Must Read

Google has called for a public-private partnership to identify a list of critical open source projects and find new ways of identifying software that might pose a systemic risk as the world grapples with the recent log4j open-source software vulnerability that has put millions of devices at hacking risk.

Following a summit on open-source security hosted at the White House on Thursday, Google said the collaboration between government and the private sector was needed for open-source funding and management.

Also Read

“We need a public-private partnership to identify a list of critical open source projects — with criticality determined based on the influence and importance of a project — to help prioritise and allocate resources for the most essential security assessments and improvements,” said Kent Walker, president for global affairs and chief legal officer at Google and Alphabet.

Open-source software code is available to the public, free for anyone to use, modify, or inspect.

Since it is freely available, open-source facilitates collaborative innovation and the development of new technologies to help solve shared problems.

“That’s why many aspects of critical infrastructure and national security systems incorporate it. But there’s no official resource allocation and few formal requirements or standards for maintaining the security of that critical code,” said Google.

In fact, most of the work to maintain and enhance open source security, including fixing known vulnerabilities, is done on an ad hoc, volunteer basis.

“Longer term, we need new ways of identifying software that might pose a systemic risk — based on how it will be integrated into critical projects — so that we can anticipate the level of security required and provide appropriate resourcing,” Google noted.

The ‘Log4j’ vulnerabilities represent a complex and high-risk situation for companies across the globe.

This open-source component is widely used across many suppliers’ software and services.

“Sophisticated adversaries (like nation-state actors) and commodity attackers alike have been observed taking advantage of these vulnerabilities. There is high potential for the expanded use of the vulnerabilities,” according to Microsoft.

Cybercriminals are making thousands of attempts to exploit a second vulnerability involving a Java logging system called ‘Apache log4j2’.

Google recently said that more than 35,000 Java packages, amounting to over 8 percent of the Maven Central repository (the most significant Java package repository), have been impacted by the recently disclosed vulnerabilities with widespread fallout across the software industry.

The Apache Software Foundation has released several updates in the wake of the widespread ‘Log4Shell’ vulnerability in Log4j version 2 branch.

Stay updated

Subscribe to our newsletter and never miss an update on the latest tech, gaming, startup, how to guide, deals and more.

Latest

Stories

- Advertisement -
- Advertisement -

Latest

Grow Your Business

Place your brand in front of tech-savvy audience. Partner with us to build brand awareness, increase website traffic, generate qualified leads, and grow your business.

- Advertisement -

Related

- Advertisement -
- Advertisement -
Meta Unveils Quest 3 VR Headset, Reduces Price for Quest 2 Foxconn to Manufacture iPhones in Karnataka, India: Creating 50,000 Jobs Amazon Echo Pop: Stylish Semi-Sphere Smart Speaker in India Redmi Display A27: Affordable 27 Inches Monitor with 100Hz Refresh Apple Music Classical App Now Available on Android WhatsApp’s Companion Mode: Same Account, Multiple Devices Nvidia & MediaTek Collaborate on Connected Car Tech Sony Unveils Project Q: A Next-Gen Handheld Game Console Snapchat Hits 200M+ Users in India, Introduces AI Chatbot Super Mario Bros. Movie: 6.4 Million Tickets Sold in Japan
Meta Unveils Quest 3 VR Headset, Reduces Price for Quest 2 Foxconn to Manufacture iPhones in Karnataka, India: Creating 50,000 Jobs Amazon Echo Pop: Stylish Semi-Sphere Smart Speaker in India Redmi Display A27: Affordable 27 Inches Monitor with 100Hz Refresh Apple Music Classical App Now Available on Android WhatsApp’s Companion Mode: Same Account, Multiple Devices Nvidia & MediaTek Collaborate on Connected Car Tech Sony Unveils Project Q: A Next-Gen Handheld Game Console