Oversight

Lawmakers worry about a second Heartbleed

Shutterstock ID: 674184880 By Fotomay Abstract Technology Binary code Background.Digital binary data and Secure Data Concept 

Two Republicans on key House committees are looking for more information about the challenges surrounding the cybersecurity of open-source software.

Reps. Greg Walden (R-Ore.) and Gregg Harper (R-Miss.), respectively the chairs of the House Energy and Commerce Committee and its Subcommittee on Oversight and Investigations, want information from Linux Foundation Executive Director Jim Zemlin about the cybersecurity risks of open-source software.

In a letter to Zemlin, the lawmakers specifically cited the widespread "Heartbleed" programming vulnerability that allowed attackers to access web servers, eavesdrop on communications, steal data and impersonate services and users that led to companies and government agencies' scrambling to review their operations and patch the defect.

"While the extent of OSS adoption clearly demonstrates the value that the ecosystem provides, its pervasiveness also creates widespread, distributed and common points of potential risk across organizations when OSS vulnerabilities are found," they wrote.

The lawmakers also raised concerns over the ability of the "globally-located volunteers" who create and maintain OSS while balancing full-time employment and compensation challenges to quickly address vulnerabilities.

They asked whether Linux's Core Infrastructure Initiative has conducted a comprehensive study into which aspects of open-source software are most critical to the global information infrastructure and, if not, what CII would need in order to do so.

They also asked for statistics surrounding open-source software usage, as well as an appraisal of the stability and sustainability of the open-source software ecosystem, plus suggestions for bolstering it.

"OSS adoption will continue to grow, making the sustainability and stability of the OSS ecosystem even more vital," they wrote.

The lawmakers requested a response by April 16.

About the Author

Chase Gunter is a former FCW staff writer.

Featured

  • Comment
    Pilot Class. The author and Barbie Flowers are first row third and second from right, respectively.

    How VA is disrupting tech delivery

    A former Digital Service specialist at the Department of Veterans Affairs explains efforts to transition government from a legacy "project" approach to a more user-centered "product" method.

  • Cloud
    cloud migration

    DHS cloud push comes with complications

    A pressing data center closure schedule and an ensuing scramble to move applications means that some Homeland Security components might need more than one hop to get to the cloud.

  • Comment
    Blue Signage and logo of the U.S. Department of Veterans Affairs

    Doing digital differently at VA

    The Department of Veterans Affairs CIO explains why digital transformation is not optional.

Stay Connected

FCW INSIDER

Sign up for our newsletter.

I agree to this site's Privacy Policy.