Why the USAF's IT chief is 'bullish' on open source
Air Force CIO Lauren Knausenberger on a visit to Spangdahlem Air Base, Germany, July 21, 2021. U.S. Air Force photo by Senior Airman Ali Stewart
While there's no such thing as completely secure software, open source can make it stronger through the "power of the crowd," said Lauren Knausenberger, the Air Force's chief information officer.
The future of warfare could depend on the Defense Department's ability to update weapons or communications systems with a software patch, and embracing open source software could help make that a reality.
That was a key point Lauren Knausenberger, the Air Force's chief information officer, stressed Wednesday when testifying about the benefits of open source software.
"It is entirely possible that a future conflict to preserve our way of life is decided by features, fixes, and updates to software intensive systems that must take place in minutes or hours. And this means that we must learn quickly as a department and leverage the knowledge and best practices of the entire development community," Knausenberger told the House Committee on Science, Space, and Technology Subcommittees on Investigations and Oversight And Subcommittee on Research and Technology on May 11.
While there's no such thing as completely secure software, open source makes it stronger through the "power of the crowd," Knausenberger said.
"The same concerns are there whether it's commercial software or open source. But if it's open source software, you have the power of the crowd looking at it and then you can also run your own tests internally because it is open code…you can redo the work yourself if you so choose," she said.
Knausenberger prefaced her testimony on May 11, saying she was "bullish" on open source technology and noted that fewer eyes on commercial software's source code could mean significant cybersecurity breaches go undetected for longer periods of time.
"With commercial software, you can't see the source code. You do have situations where like with SolarWinds, you could have a sophisticated adversary come in, inject malware, and have it be months before anyone knows that there's a problem," the tech chief said.
"Whereas in the open source community we've seen with a number of examples that we just catch it faster, we can push it faster, we have more people trying to fix it faster and spread the word. Whereas the commercial side, you have some really smart companies working on it, but we might not know about it as soon."
Brian Behlendorf, the general manager for the Open Source Security Foundation, a Linux Foundation project, testified that the open source community previously had a "buyer beware" reputation when it came to software security. And while things have changed culturally, resources will be needed to ensure proper oversight.
"Culturally speaking, there's a greater emphasis on security in the open source software community. There used to be very much a perspective of caveat emptor: I'm just throwing this out there anyone who wants it is welcome to it, but buyer beware and let us know if you find any bugs," Behlendorf said.
Now, he said, open source foundations formalize structured security or incident response teams for projects, sometimes using paid part-time or full-time security researchers dedicated to improving the underlying code, or utilize third-party audits before a product release.
"So it gives me a lot of hope. But there also is a very long tail that is getting longer and longer of very, very small components that … aggregated together create interesting things, but [are] where there's perhaps less oversight."
Behlendorf said there often aren't enough "eyeballs" on open source projects, even the ones that are highly relied on, "so one thing we're really trying to do is just make sure that we find the pieces that are critical, find the ones that are under-resourced then where we can direct resources of whatever form are required to increase the level of trust that we might have in that component."
While it's been discussed (if not urged) for many years, the Defense Department has been more vocal recently about embracing open source software. In January, DOD chief information officer John Sherman issued guidance on how to use open source software and the department's security concerns, including the potential to create "a path for adversaries to introduce malicious code into DoD systems" alongside the "imprudent sharing of code developed for DOD systems."
During her testimony, Knasuenberger said vulnerabilities are a fact of life in software design.
"If there are no bugs found in a particular piece of software, it's because no one's looking," she said. "It's not because it's perfect."