The Tidelift Subscription is leveraged by federal agencies to strengthen their cybersecurity supply chain risk management (C-SCRM) initiatives. Defense-in-depth is a cybersecurity principle that incorporates both a reactive and proactive approach towards open source supply chain security. With reactive strategies already in place, these agencies now want to enhance their defense-in-depth capabilities by evaluating open source packages and identifying early risk indicators to avoid packages that could be impacted by vulnerabilities in the future.
As customers of Tidelift, these agencies have built a data driven approach, that includes human-validated, first-party insights from Tidelift and our partnered open source maintainers to evaluate risk indicators such as:
jackson-databind
minimist
urllib3
SockJS
Jordan Harband
Pillow
Mongoose
Apache Commons
In light of recent events such as Log4Shell and xz utils, many of the agencies that work with Tidelift recognize that reacting to late-stage risk and vulnerabilities alone is no longer enough to secure software. Open source software supply chain threats are much broader than what CVEs tell us—and managing all of this at scale is overwhelming. The path out of such fire drills is using data to drive action, earlier.
To mitigate risks, agencies are looking to migrate away from outdated software versions, tackling technical debt that poses the greatest threat, and prioritizing the most relevant vulnerabilities impacting their software. All of these initiatives require a significant undertaking, and federal agencies often struggle to prioritize actions that would have the most substantial impact on risk reduction.
Working with Tidelift has allowed federal agencies to adopt a more efficient and data-driven approach for managing technical debt and addressing vulnerabilities. This approach focuses on maximizing impact by predicting possible compromises and assessing risk indicators such as:
It is important to remember that open source software, while free, must be used in line with the license that it is made available under. Open source licenses are crucial because they define the terms under which the software can be used, modified, and distributed. They ensure that the rights of both the original creators and the users are protected, setting clear boundaries for how the software can be utilized. Tidelift is working with a number of federal agencies who require full transparency and understanding of the licensing policies in place across all of the open source in use, in an effort to prevent legal and financial ramifications.
Tidelift’s data research team, in partnership with open source maintainers, maintains machine readable SPDX license data for millions of open source packages. We ingest license data from various sources, curate and normalize the data. Most importantly our team is able to identify missing or inaccurate license information and then does the manual research to correct the license information. This allows federal agencies to confidently evaluate licensing requirements on a per-release basis with the ability to answer questions such as:
Per Executive Order 14028, healthcare, automotive, and critical infrastructure require software vendors to provide an SBOM along with software attestation. However, simply generating SBOMs is not enough, and government agencies are looking for solutions to systematically analyze SBOMs and to operationalize the data. They are specifically asking “what do we do with all these SBOMs?”
Tidelift, along with other leaders in the space, is helping government agencies to automate supply chain compliance requirements by digesting SBOM data and triggering intelligent data based decisions regarding:
Maintainer Tatu Saloranta completely rearchitected jackson-databind and eliminated the risk of remote code execution (RCE) vulnerabilities.
Maintainer Seth Michael Larson was able to substantially improve urllib3 security practices thanks to income from Tidelift and its customers.
50 Milk St, 16th Floor, Boston, MA 02109
.svg){kind=icon}