Enhancing OSS Ecosystem Security through Incentives

Behavioral & Economic Incentives to Secure the OSS Ecosystem 2022-08-24 14:30-16:00 ET

Software Development What incentive structures would encourage OSS developers to incorporate better software security practices? Paid Development/Assistance How can we leverage the limited amounts of government, industry, and professional assistance to maximize our overall security posture? Report Recap Informed choice How do we make security a priority in choosing OSS software? 2

Agenda Problem questions from Phoenix Audience Questions Panel Introductions 1 3 5 2 4 6 Status Quo and needed background foundational knowledge from panel s domain. Plan questions from Phoenix Wrap up 3

Feel free to put questions in chat as they occur to you. We will make sure to ask them during the discussion section. Chat is awesome! 4

Panel of Experts 5

Academic Expert Yasemin Acar George Washington University Prof. Acar is an expert in human factors within security and privacy, with a major focus on secure software development. She has performed extensive in-depth studies into security and trust practices within OSS. 6

Python Community Expert Dustin Ingram Python Software Foundation and Google Mr. Ingram is the director of the Python Software Foundation, maintainer of PyPI, which is the canonical software repository for the Python ecosystem with over 350,000 Python packages, and a software engineer on Google s Open Source Security Team. 7

Neuroscientist and Business Expert Uma Karmarkar UCSD Rady School of Management | School of Global Policy and Strategy Prof. Karmarkar combines consumer psychology, behavioral economics and neuroscience to develop theory-driven frameworks about how people use information make consequential decisions. She is an expert in Neuroeconomics, Marketplace Behavior, and Survey Methods. 8

Security of Complex Systems Expert Deborah Shands SRI International Dr. Shands is an expert in security architecture and design for large, mission-critical systems. She models relationships among organizations and system components to simplify authorization and trust management. She is a security technical advisor for U.S. government-funded research and development programs. 9

OSS Supply Chain Expert David Wheeler Linux Foundation Dr. Wheeler is the Director of Open Source Supply Chain Security at the Linux Foundation, and an expert on open source software (OSS) and on developing secure software. 10

The Status Quo 11

You were part of a large study at the Linux foundation on OSS Contributors What did you see as major findings? Who are the important players in the problem? 12

You have PhDs in neuroscience and marketing, with a speciality in consumer behavior. That s a pretty deep background. What do we know about incentives, behavior, and markets? And how does trust apply to something like software? 13

You had a very remarkable paper on how OSS developers learn and apply cybersecurity practices. Can you tell us a little about what you ve learned from those interviews on incentives and behaviors? 14

Actually writing code is actually only one part of the security equation. You ve studied team dynamics. Can you tell us about other types of attacks, and how team dynamics plays a role? 15

You manage one of the largest OSS package managers in the world. How do people choose which OSS packages to install in the Python world? 16

The Problem 17

Who are the we in solving the problem, and what is their interest? (Government? Developer? Industry?) 18

What incentive models do you see today? 19

How would you articulate the problem we should focus on? 20

Where does economics and behavior rank compared to other things we could work on? 21

What is the most important unknown to figure out, and why? 22

What is not the problem in current incentive models? 23

Are there specific examples of things current incentive models are doing wrong? Right? 24

What are the best, worst, and most probable cases for incentives to affect cybersecurity in OSS in the next 5 years? 25

The Plan 26

Using just what is known today, what do you think public policy can address and cannot address? 27

Can you characterize solutions in phases or breaking off pieces of the larger problem? 28

Ive heard grumbling that security investment has increased significantly, but it s unclear what has changed. What are measurements that can be performed to show things are better or worse? 29

What is the minimum we (or specific sectors in public/private) need to do to maximize cybersecurity incentives? Behavioral and/or economical? 30

Audience Questions 31

Parting Thoughts 32

Academic Expert Yasemin Acar George Washington University 33

Python Community Expert Dustin Ingram Python Software Foundation and Google 34

Neuroscientist and Business Expert Uma Karmarkar UCSD School of Business 35

Security of Complex Systems Expert Deborah Shands SRI International 36

OSS Supply Chain Expert David Wheeler Linux Foundation 37

Thanks! 38

Panel! Please use the following pages to put any other thoughts or questions that were not convenient to put in google comments. I will delete these slides before the panel! 39

Academic Expert Yasemin Acar George Washington University 40

Python Community Expert Dustin Ingram Python Software Foundation and Google 41

Neuroscientist and Business Expert Uma Karmarkar UCSD School of Business 42

Security of Complex Systems Expert Deborah Shands SRI International 43

OSS Supply Chain Expert David Wheeler Linux Foundation 44

Did you take my red vines? 45