Senators Introduce a Bill To Protect Open-Source Software

An anonymous reader writes: When researchers discovered a vulnerability in the ubiquitous open-source log4j system last year that could’ve affected hundreds of millions of devices, the executive branch snapped into action and major tech companies huddled with the White House. Now, leaders of the Senate Homeland Security and Governmental Affairs Committee are introducing legislation to help secure open-source software, first reported by The Cybersecurity 202. Chairman Gary Peters (D-Mich.) and top ranking Republican Rob Portman (Ohio) plan to hold a vote next week on the bill they’re co-sponsoring.

The Peters/Portman legislation would direct the Cybersecurity and Infrastructure Security Agency to develop a way to evaluate and reduce risk in systems that rely on open-source software. Later, CISA would study how that framework could apply to critical infrastructure. The log4j “incident presented a serious threat to federal systems and critical infrastructure companies — including banks, hospitals, and utilities — that Americans rely on each and every day for essential services,” Peters said in a written statement. “This common-sense, bipartisan legislation will help secure open source software and further fortify our cybersecurity defenses against cybercriminals and foreign adversaries who launch incessant attacks on networks across the nation.”