A little over a year ago, Google introduced Assured Open Source Software (Assured OSS). It helped developers protect against supply chain security attacks by scanning and examining some of the most widely used software libraries for vulnerabilities. Today, Google is making Assured OSS readily available with support for over a thousand Java and Python – best of all, it’s free!
Following the revelation of several major security vulnerabilities in the software development industry, organizations have become increasingly aware of and committed to software supply chain security. It is now common practice to hear talks about Software Bills of Materials (SBOMs), artifact registries , and similar topics at open source conferences. With this in mind, Google – known for pioneering open source products – has taken further steps by introducing Assured OSS.
See also: Google and Amazon encourage voluntary employee departure
Google guarantees that its libraries will stay up to date, along with continuous scanning for known and unknown vulnerabilities . When they launched the service containing 250 Java libraries , 48% of new CVEs were discovered by them, which they immediately fixed and contributed back to their upstream!
“As organizations use more and more the Assured Open Source Software for faster development cycles, they need reliable sources of secure open-source code packages”, said the Melinda Marks, senior analyst of the ESG. “Without proper examination and verification or metadata that help monitor access and usage of the Assured OSS, organizations risk being exposed to potential security gaps and other risks in their software supply chain. By working with a trusted supplier, organizations can mitigate these risks and ensure the integrity of the software procurement chain for better protection of their business applications”.
By leveraging Google ’s extensive selection of Assured OSS packages , organizations can reap the benefits of a more secure open source software supply chain. This is achieved by providing an Assured Software Bill of Materials that accurately describes the components used in industry-standard formats. In addition, organizations will also experience reduced risk due to proactive scanning and remediation of any vulnerabilities found in these components – all done by Google !
See also: Fitbit: Will allow connection to your Google Account
If you are a developer or organization looking to leverage the power of Assured OSS, then sign up and quickly integrate it into your existing development process.
Source: techcrunch.com
