OpenSSF OpenSSF Day @ OSS Japan 2022, 17 Dec 2022

Previous Meeting

Next Meeting

⏯

youtube image

►

From YouTube: Activities in Japan along with 10 Streams of OSS Security Mobilization Plan- Muuhh Ikeda, Cybertrust

Description

Activities in Japan along with 10 Streams of OSS Security Mobilization Plan - Muuhh Ikeda, Cybertrust

Compared to other industries such as automotive, cloud service providers in Japan, including Cybozu, who build their system without outsourcing are not so familiar with the terms such as Software Bill of Materials (SBOM) and Supply Chain because they usually do not need to share the list of software they use with other companies.
In this talk, the speaker will explain why the importance of SBOM Everywhere is still not so easy to understand in such a company. The talk will also include a brief discussion about the possibility of SBOMs being used in certification programs, such as ISMAP, and how to prepare for such a future.

A

Okay, um do you remember your first day to use the open source software yeah I can really remember that and I can clearly remember the first day to connect to the internet.

A

Well, at the time, I was and I am sure that everything is inside the Box in front of me, which is connected to the world and at a time no one told the security, but our world has been changed now the open source software, um the best treasure in the world I believe, is personal threat, so that the reason why I'm here and reason why you're here IB well I'm muikita from cybertross Japan?

A

um Do you know that cybertos Japan? Oh well? Okay, thank you! Thank you. um So let me quickly introduce the salvators Japan yep. Well, we have three pillars of business: the left side, which is the security uh actually the Cyber trucks. Japan, is the first commercial operator of CA in Japan, and we have over 20 years history and right hand, side OSS.

A

We are providing a Linux distribution called Miracle Linux, which has also the over 20 years history. So probably this is the only one distribution for server from Japan I believe um before we had multiple distribution, but probably this is only one as far as I know m in between the iot. This is a fusion area of security and OSS and I'm I'm belonging to this and iot section is also providing the next distribution for embedded in iot EM Linux.

A

So what I mean is our DNA is based on security and OSS. This is same as open ssf, so this is a second reason of I'm here.

A

Well, so let me introduce a general activities um regarding to the open source security and open SSS in Japan. First last August we had the OSS Security Summit Japan, and after that we have a we had a wrap-up meeting at our office, so thanks to Brian Who coming so we uh we had a lot of discussion here, and this is my personal, not personal, well, their activity. Why?

A

The promotional openness exactly in Japan um I had a few speeches and the first one, the Japan security Summit 2022, which was a virtual event, and uh my speech got the highest number of views in the event. So that means many person is interested in their security and open ssf. In Japan and breaking news, we decided to launch the Open Access Japan chapter um I got the endorsement from the Japan member on cyborgs and Renaissance Electronics.

A

Initially, we we have the closed meeting and to discuss about what is going on. What is the issue and what the challenge, and then we are opening the meeting to the public. That is a plan.

A

um Of course. The purpose of the meeting is to share and the challenge and the globulation, but the second purpose is also the promotion of the open ssf in Japan.

A

All right so um from now on, let me introduce the Cyber to Japan's activities regarding to the open source, security and open ssf, especially regarding to the 10 streams of security mobilization plan.

A

So, as you see, the three goals and the 10 streams are stated at the open source security Summit at the White House in last May yep and there are 10 streams and we are focusing on especially the five areas and now let me introduce the activity regarding to three um three. This signature.

A

Supply chain security.

A

So, first for stream 3, this is the signature.

A

um The mobilization plan, this 10 streams, um clearly stating that the Secret store is uh um the key technology, so we're jumping in the sixth store. But, uh to be honest, we are very newbie for this area. So, as usual, we are building trial and developing the feature for contribution.

A

So we're doing that and the middle term goal of us is to operate the CSO servers in Japan. This is based on the experience from our CA experience. That means the. If the same severe incident happens, some government or some agency inspect the server record, um but, as you see the jurisdiction, this is a very familiar one for me, but the jurisdiction spend the only domestic, so some critical user, for example the infrastructure company, like a transportation, energy Financial or something requires us to operate the server the service inside the country.

A

So this is a motivation of us to operate the six two inside Japan, so probably it Jessica store is a still the important infrastructure, but it will be more so at the time the critical user requires us. So we are preparing that so that we are setting the middle term of goal as a to operate a six two inside GPM.

A

um But again we are very newbie. So status of this item is tucks into the wrong way, not flying, but we are flying.

A

For stream, three number two said: oh sorry, this is the page for number two for stream, 9 s bomb everywhere. So we are there what we are doing and there are what we will do so the status is like taking out what the let me introduce that so, first the um well. We are providing our um products um adapting the s-bomb.

A

So we are in the unique position because we have the distribution, which is a generator of the s-bomb, and on the other hand we have the vulnerability management system, um Miracle Ball hammer, which is a user of the s-bomb. That means we are. We can collect the many many use cases, how many customers and users, so that's a nice position. So this is the first contribution point I believe so we are collecting the use cases and work together with the community.

A

um We are doing actually doing the asthma promotion in Japan in some private seminar or public seminar. So- and this is what is going on and uh as you see, the s-bomb format is very uh important.

A

um Now I see the spdx and the Cyclone DX is the measure, but we are focusing on the spdx, because the openness of the spdx, of course, I understand that the Cyclone DX is also the important. But the our focusing point is now on sbgs that our activity related to the s-bomb, so the status is taking off.

A

So number three for stream 10 a better supply chain security. uh We've been a lot of things here, because we have two distributions. The distribution is the key point of Separation security.

A

First, the cap civil infrastructure platform, which is a pro project under reacts foundation and which is providing a long support for Linux kernel on the next user run. So we are Distributing I, don't know sorry, we are contributing a lot for them because they, the EM index the um next distribution from us with a long support, is based on this project.

A

So this is our lifeline, any kind of CI, so, of course, distribution needs to test and test again and again so we'll just contributing for this a lot and actually our my colleague is a mentor of some project under conduct CI and who is also the TSC technical steering committee member and relax Canada. Of course, we are back porting many bug fixes to LTS Corners, mainly yakta project.

A

um The pmlx is based on the act, so we are bug fixing and feature development. We are contributing a lot for yacht and of my colleagues also the yacht Ambassador, who is the only one episode from APAC area and at last metadbm. The distributions user line is based on the Debian, so we are contributing a lot for that, so the status is in flight, so we are keeping on.

A

All right, we are I'm saying we are doing and we will do, but at last I will introduce why we can do that why we can contribute so first thing. So this is your signature, because we are root, C operated with over 20 years experience, so we have a lot of experience to operate the critical infrastructure for Internet Security.

A

So this has to be the contribution point for community, so we I believe we can contribute that to the community. From our experience.

A

And second s-bomb so, as I said, the we breathe on the unique position for users and created, so we can collect a lot of use cases and everything is related to the s-bomb, because s-bomb is a key factor, um because s-bomb is everywhere right.

A

And third of the better supply chain, so, as you see, we are providing a two distribution. So that's a keyboard. The distribution is a keyboard to to um the provide the open source security. So we can contribute a lot all right. So, um as I told um we are texting to the wrong way taking off in flight menu status, but the one thing is: we are crew and simultaneously a passenger of a community flight.

A

So we are flying with you all right. So, let's get fly higher together. We are doing that so um at the point, we're newbie and at the point that we're exposed. So let me let me know if we have some challenge in the issues. So, let's collaborate, let's get fly higher. Thank you. So much.