Keynote: OpenSSF Security Baseline

### Overview In this keynote, a speaker representing the Open Source Security Foundation (OpenSSF), a foundation under the Linux Foundation, presents the OpenSSF Security Baseline initiative. The mission of OpenSSF is to make open-source software more secure by establishing a minimal, practical security baseline across projects. The initiative stems from discussions at the prior year's Linux Foundation Member Summit, as well as broader regulatory and government actions such as the EU Cyber Resilience Act (CRA)—which introduced the concept of the open source software steward—and the United States Cybersecurity and Infrastructure Security Agency (CISA) designating open source as critical infrastructure.

### Key Topics - **Security Baseline Concept**: Creating a minimal viable secure product standard that balances security with software reliability, availability, and performance, ensuring that adoption is practical and not overly burdensome. - **Risk-Based Supply Chain Approach**: Framing supply chain vulnerabilities using the SLSA framework threat model, addressing risks across upstream maintainers, source code repositories, build systems, package registries, and downstream consumers. - **Internal Adoption First**: A commitment by OpenSSF to "eat our own cookies first" by establishing and testing the baseline on OpenSSF projects before broader rollout across the Linux Foundation. - **Education and Community Engagement**: Advancing training efforts (such as workshops on SLSA and Sigstore), running a security survey, and participating in policy summits and security events.

### Technical Details The baseline is structured to define what the requirement is, why it is required, how maintainers can implement it, and how it can be verified to detect and correct security drift. The talk highlights specific baselines evaluated for sandbox projects: - **Secure Coding and Memory Safety**: For projects built from scratch, OpenSSF recommends adopting a memory-safe language to eliminate an entire class of vulnerabilities (referencing guidance adapted from Prossimo). For existing C or C++ projects, the recommendation is to decouple new features or components into modular units written in memory-safe languages. - **Authentication**: Implementing multi-factor authentication (MFA) to prevent credential compromise early in the development lifecycle, with MFA enabled as a default feature across OpenSSF projects. - **Dependency Management and Automation**: Acknowledged as one of the hardest challenges across software supply chains, addressed by prioritizing automation, tooling capabilities, and assembling existing OpenSSF technical outputs.

### Takeaways The OpenSSF Security Baseline aims to ease the burden on developers and maintainers while lifting foundational security practices across open-source ecosystems. Maintainers and organizations are encouraged to engage via OpenSSF working groups, participate in upcoming events (such as the EU Policy Summit in Brussels, OpenSSF in Vienna, and the Fusion conference in Atlanta), subscribe to bi-weekly updates, and contribute to the ongoing security survey.