Oversight

Lawmakers worry about a second Heartbleed

Shutterstock ID: 674184880 By Fotomay Abstract Technology Binary code Background.Digital binary data and Secure Data Concept 

Two Republicans on key House committees are looking for more information about the challenges surrounding the cybersecurity of open-source software.

Reps. Greg Walden (R-Ore.) and Gregg Harper (R-Miss.), respectively the chairs of the House Energy and Commerce Committee and its Subcommittee on Oversight and Investigations, want information from Linux Foundation Executive Director Jim Zemlin about the cybersecurity risks of open-source software.

In a letter to Zemlin, the lawmakers specifically cited the widespread "Heartbleed" programming vulnerability that allowed attackers to access web servers, eavesdrop on communications, steal data and impersonate services and users that led to companies and government agencies' scrambling to review their operations and patch the defect.

"While the extent of OSS adoption clearly demonstrates the value that the ecosystem provides, its pervasiveness also creates widespread, distributed and common points of potential risk across organizations when OSS vulnerabilities are found," they wrote.

The lawmakers also raised concerns over the ability of the "globally-located volunteers" who create and maintain OSS while balancing full-time employment and compensation challenges to quickly address vulnerabilities.

They asked whether Linux's Core Infrastructure Initiative has conducted a comprehensive study into which aspects of open-source software are most critical to the global information infrastructure and, if not, what CII would need in order to do so.

They also asked for statistics surrounding open-source software usage, as well as an appraisal of the stability and sustainability of the open-source software ecosystem, plus suggestions for bolstering it.

"OSS adoption will continue to grow, making the sustainability and stability of the OSS ecosystem even more vital," they wrote.

The lawmakers requested a response by April 16.

About the Author

Chase Gunter is a staff writer covering civilian agencies, workforce issues, health IT, open data and innovation.

Prior to joining FCW, Gunter reported for the C-Ville Weekly in Charlottesville, Va., and served as a college sports beat writer for the South Boston (Va.) News and Record. He started at FCW as an editorial fellow before joining the team full-time as a reporter.

Gunter is a graduate of the University of Virginia, where his emphases were English, history and media studies.

Click here for previous articles by Gunter, or connect with him on Twitter: @WChaseGunter

Featured

  • FCW PERSPECTIVES
    sensor network (agsandrew/Shutterstock.com)

    Are agencies really ready for EIS?

    The telecom contract has the potential to reinvent IT infrastructure, but finding the bandwidth to take full advantage could prove difficult.

  • People
    Dave Powner, GAO

    Dave Powner audits the state of federal IT

    The GAO director of information technology issues is leaving government after 16 years. On his way out the door, Dave Powner details how far govtech has come in the past two decades and flags the most critical issues he sees facing federal IT leaders.

  • FCW Illustration.  Original Images: Shutterstock, Airbnb

    Should federal contracting be more like Airbnb?

    Steve Kelman believes a lighter touch and a bit more trust could transform today's compliance culture.

Stay Connected

FCW Update

Sign up for our newsletter.

I agree to this site's Privacy Policy.