topic Re: Open Source Software and Banks in Industry News

Open Source Software and Banks

Caute_cautim — Mon, 09 Oct 2023 10:28:50 GMT

Hi All

Have you ever wondered why Banks and financial institutions use so much Open Source Software internally?

Open source is everywhere. Over 90% of organisations in the UK use open source components in their software, including the financial sector. FINOS’ 2022 State of Open Source in Financial Services report made it clear in particular just how rapidly open source software is proliferating in the sector. However, recent cyberattacks demonstrate the risk these companies run of losing billions of pounds if they don’t manage their software supply chains.

https://www.finextra.com/blogposting/23919/open-source-security-is-critical-for-financial-institutions?

Regards

Caute_Cautim

Re: Open Source Software and Banks

Robert956 — Wed, 22 Mar 2023 08:07:39 GMT

Open Source Software (OSS) is becoming increasingly popular in the banking industry because it offers numerous advantages such as cost savings, flexibility, security, and innovation. Banks can use OSS to build and customize their own solutions, integrate with other systems, and collaborate with other developers and institutions. Additionally, OSS provides greater transparency, accountability, and community support, which can help banks to better serve their customers and meet regulatory requirements. However, implementing and managing OSS requires careful planning, evaluation, and monitoring to ensure compatibility, reliability, and compliance with legal and ethical standards.

Re: Open Source Software and Banks

denbesten — Wed, 22 Mar 2023 17:56:46 GMT

Putting on my security beanie, I do not view OSS and commercial software any differently. The goals are the same....

Prefer popular software (to increase the odds that others find the bugs).
Try to standardize across the entire company (to minimize attack surface).
Stay current on patches.
Purchase support when Management cares about MTTR.
Judge the supplier's based on their patch cadence and vulnerability response, both current and historical.

Re: Open Source Software and Banks

Caute_cautim — Wed, 22 Mar 2023 20:16:38 GMT

@denbesten @Robert956 You both missed one important aspect "licensing" and maintaining those conditions, which can get you into a whole heap of issues. In my organisation, we have complete courses, and mandatory education in order to allow developers to use them, produce Open Source software etc.

It is a major aspect, as well as security & privacy by design controls, before anything is released etc.

The other aspect is DevSecOps and supply chain issues too.

Regards

Caute_Cautim