Details of the inquiry
We have downloaded the “Guide to the Use and Management of Open Source Software in the Financial Sector” from the Financial Supervisory Service and are preparing for it. It does not appear to be something that can be resolved simply by introducing a product or a solution. There seem to be broad requirements covering the development stage, the operation stage, organizational structure, role definition, SBOM preparation, and more. Do we necessarily have to prepare for this, and how should we prepare?
Must we prepare?
Regarding the use of open source software, Article 21 (Contracts Related to the Construction of Information Processing Systems and Electronic Financial Transactions) of the Regulation on Supervision of Electronic Financial Transactions explicitly states, “5. The attribution of ownership, copyright, intellectual property rights, and similar rights in purchased or developed products shall be clarified so that disputes do not arise afterward.”This provision was not added recently. It has existed since 2013 and was specified in contracts and equivalent documents such as RFPs, but there were no specific requirements or guides.
Following the Log4J security vulnerability issue and overseas policy trends (the United States and Europe) toward making SBOMs mandatory, the FSS has produced and distributed a guide and is providing guidance on OSS license compliance and security-system management. Looking at the requirements of this guide, OSS management is a matter that requires both compliance and security, and it is judged to be advantageous for an inspected institution to understand it as advance notice of a supervisory regulation. In addition, not only large financial companies but also major large-scale businesses in electronics and electrical equipment, manufacturing, automobiles, and similar sectors have, out of necessity, already formed organizations long ago, introduced the necessary solutions, and are operating them.
How should we prepare?
The FSS guide organizes and summarizes well the key matters required for systematic OSS compliance and security management. In addition, “Appendix 1 Checklist for Inspection by Open Source Software Management Procedure” is very helpful for understanding the overall state of an organization’s OSS management and for establishing future plans. Referring to the domestic and overseas reference materials attached to the guide, and to the guides of the Linux Foundation’s OpenSSF (Open Source Security Foundation), will be a great help in designing the management system.
However, when human resources or time are insufficient, commissioning a consulting firm such as ours is also an effective strategy in terms of resolving conflicts of interest among internal and external stakeholders and managing accountability. A general procedure for “How should we prepare?” is summarized below.
<General preparation procedure>
- First, understand the contents of the FSS guide (you have to know it to do the job)
- Inventory all software and determine the status of open source software (cooperation from internal and external stakeholders and the use of automation tools are essential)
- Design the organization’s OSS management policy and management system, and establish a phased implementation plan (cases from other companies or related reference models are a great help)
- Carry out the established phased plan, and continuously monitor and improve the management system.
(*) Next time, we will prepare material on the types of OSS dependencies that corporate staff find difficult, and on creating and verifying SBOMs,
The templates, checklists, automation tools, and similar materials our company has will be a great help. (Contact point: oss@wikisecurity.net)