CISA, FBI, NSA, and Treasury Release Guidance on OSS in IT/ICS Environments

Today, CISA, the Federal Bureau of Investigation, the National Security Agency, and the U.S. Department of the Treasury released guidance on improving the security of open source software (OSS) in operational technology (OT) and industrial control systems (ICS). In alignment with CISA’s recently released Open Source Security Roadmap, the guidance provides recommendations to OT/ICS organizations on:

• Supporting OSS development and maintenance,
• Managing and patching vulnerabilities in OT/ICS environments, and
• Using the Cross-Sector Cybersecurity Performance Goals (CPGs) as a common framework for adopting key cybersecurity best practices in relation to OSS.

Alongside the guidance, CISA published the Securing OSS in OT web page, which details the Joint Cyber Defens

[…]
Content was cut in order to protect the source.