Enthusiasts of open source software (OSS) gathered at the Open Source Security Foundation's (OpenSSF) Secure Open Source Software Summit in Washington, DC, to promote collaboration across diverse sectors such as business, government, and critical infrastructure.
Open source software, which is freely available for use and modification, is a key catalyst for innovation among many technology professionals. At JPMorgan Chase, our extensive team of over 57,000 technologists incorporates numerous open source components into our tools, offering a competitive edge for our company, clients, and customers.
Why is OSS security so important?
The collaborative and transparent nature of OSS enables technology experts to address common challenges collectively, resulting in software that supports critical operations in both the public and private sectors, including national security systems and essential infrastructure. While the open accessibility of OSS fosters innovation, it can also be exploited by malicious actors to identify and target vulnerabilities in widely-used code, affecting organizations broadly. The recent increase in high-profile OSS attacks highlights the need for robust public-private partnerships to develop tools and solutions that support the many volunteers maintaining OSS. We all have a role in enhancing OSS security, and we invite others who use open source to join us in this crucial effort.
What progress has the Open Source Community made in the past year?
In May 2022, OpenSSF introduced the Open Source Software Security Mobilization Plan, which has been pivotal in guiding industry and government initiatives to protect the open source software supply chain. The plan has led to improvements in OSS security education and the development of tools such as Sigstore, for secure software validation, and Alpha-Omega, for identifying and resolving vulnerabilities in popular packages.
JPMorgan Chase, in partnership with other financial institutions, established the Financial Services Information Sharing and Analysis Center (FS-ISAC) Supply Chain working group. This group aims to share emerging supply chain threats with the financial sector and develop guidance to counter such threats, as demonstrated by the Software Supply Chain Primer White Paper published in 2025.
What happened at the Summit?
Summit attendees discussed security challenges in OSS consumption across critical infrastructure sectors, the potential for leveraging AI advancements to enhance OSS security, and the shared responsibility to increase OSS resilience in critical infrastructure. The significant U.S. Government presence at the Summit underscores the public sector's commitment and support for initiatives aimed at improving OSS security and fostering strong public-private partnerships for more secure outcomes.
The summit concluded with discussions on strategies for achieving tangible results aligned with three objectives for the coming year: (1) providing security education for OSS developers and stakeholders, (2) strengthening the security of OSS repositories, and (3) facilitating cross-collaboration for incident response.
What are our next steps?
There is further work to be done in enhancing tools to counter software supply chain attacks. We recognize the importance of supporting OSS evaluation tools like Security Scorecard, an automated security tool that helps users assess the risks associated with their software dependencies, and Software Bill of Material (SBOM) capabilities, which provide an inventory of application components. At JPMorgan Chase, our security teams are committed to developing such solutions and are collaborating with organizations like OpenSSF to create more integrated tooling and capabilities that will foster safer practices and prevent significant future software supply chain security breaches.
Fulfilling Our Role
JPMorgan Chase is steadfast in our commitment to partnerships aimed at improving open source security. As a founding member of OpenSSF and through our leadership in the Financial Services Sector Coordinating Council (FSSCC) and the Financial Services Information Sharing and Analysis Center (FS-ISAC), we will continue to play an active role in supporting and shaping the efforts of both industry and government to secure the open source software ecosystem.