Open Source Summit NA 2025 | Crob Robinson, OpenSSF

Clips
News
More from Open Source Summit NA 2025

CRob Robinson

CTO

OpenSSF

Code, community and the future: 13 takeaways from Open Source Summit NA

Beyond uniting developers under shared ideologies, goals and pain points, Open Source Summit North America ignited conversations at the intersection of code, community and change.TheCUBE goes live with insights at Open Source Summit NA

How open-source developers can meet global cybersecurity laws — before it’s too late

Standards, guidelines and laws govern the world. However, few places embody that reality better than the digital realm. With new and hybridized attack pathways proliferating rapidly, countries are updating their cybersecurity laws to keep pace.TheCUBE goes live with cybersecurity insights at Open Source Summit NA.Where do these shifting grounds leave open-source developers? And how can they stay ahead, adhering to these laws without compromising the pace of innovation?“We’re focused on improving open source and supply chain security for everybody, and everybody is a subset,” said Crob Robinson (pictured), chief security architect of OpenSSF

play_circle_outline Enhancing Global Open Source Security: The Impact of OpenSSF and the Cyber Resilience Act on the Tech Ecosystem

play_circle_outline Familiarity with existing compliance requirements can alleviate fears among upstream open source developers.

play_circle_outline The importance of maintaining legacy software to meet new compliance standards.

Info
Transcript

Crob Robinson, OpenSSF

CRob Robinson

CTO OpenSSF

In this exclusive interview from Open Source Summit North America 2025, Crob Robinson, a leader at the Open Source Security Foundation (OpenSSF), joins theCUBE Research’s Paul Nashawaty to unpack the growing global impact of open source compliance. The conversation centers around the EU’s Cyber Resilience Act (CRA), a new regulation with far-reaching consequences for software supply chains across the globe. Robinson brings a practical lens to the discussion, explaining how upstream open source projects, maintainers and vendors can meet CRA requirements by ado... Read more

explore Keep Exploring

What is the role of the OpenSSF in relation to open source security, and what impact does the Cyber Resilience Act have on the tech ecosystem? add

What is the speaker's perspective on the CRA in the context of cyber security? add

What are the implications of failing to update and support legacy software in the context of global data regulations? add

bolt Powered by CUBE AI

Crob Robinson, OpenSSF

search

Paul Nashawaty

>> Welcome back to Open Source Summit North America 2025. My name is Paul Nashawaty and I'm covering the app dev space in all things open source. I'm joined today, how you doing?

CRob Robinson

>> I'm doing great. Nice to be here.

Paul Nashawaty

>> Yeah, great to have you here. So let's talk about a lot of different things. We're talking about free classes, we're talking about the CRA, we're talking about educational frameworks, how it helps employers. What is your take on this?

CRob Robinson

>> Yeah, so I work with the OpenSSF, the Open Source Security Foundation, and we're a collection of groups, large companies, academic researchers, governments. We're focused on improving open source security and supply chain security for everybody, and everybody is a subset. Europe is part of that subset and they just recently released a new law called the Cyber Resilience Act that is going to have some pretty far-reaching consequences across the whole globe, honestly, and the tech ecosystem especially.

Paul Nashawaty

>> Yeah, I absolutely know that it's a big part of some of the challenges that organizations have run into. We see that reporting coming out in, what is it, September 2026, and then everything has to comply by December 2027.

CRob Robinson

>> Exactly.

Paul Nashawaty

>> It's coming up faster than people think. So let's jump right into this because when we think about these new compliances, these regulations, a lot of times organizations will think about it in the context of this only impacts me here in my little world, my microcosm of the world and the reality that's not true, especially when we talk about software. Right? Talk about we're a global environment, we interact with global data, we interact with global requirements.

CRob Robinson

>> Yes, we do.

Paul Nashawaty

>> So let's start there and figure out where we go.

CRob Robinson

>> CRA is getting a lot of headlines right now, but from my perspective, I've been doing cyber security for or so years and there's nothing new in the CRA. This is all things that back when I was at a bank, I was at an insurance company. These are rules we had to follow already. There's some newer concepts like software bill of materials, but really this is something that cyber security people are very familiar with. Now, upstream open source developers, this is not necessarily anything they've ever had any exposure to. So that's where there's a lot of fear, uncertainty and doubt from that community. But part of our mission of our foundation and other foundations is we're trying to provide education and awareness. This is what facts of the law are, this is what actions you're going to need to take, but really the burden of the compliance falls on manufacturers. And looking at the global economy, Europe is the third-largest market on the planet. Every major manufacturer wants to be there, wants to sell their products, and if you are not CRA compliant, if you don't get that CE mark when they start issuing those in 2027, you're not going to be able to sell. So you've closed yourself off to a potential large base of customers. So you need to be aware even though you might not live there.

Paul Nashawaty

>> No, that's absolutely a good point. I mean, when we think about how organizations are, really starting to expand, as I mentioned, I cover application development and I talk to many, many organizations about what their challenges are and the challenge... The number one challenge that CIOs tell me is we need to modernize our applications and they have their past heritage environment, they need to bridge the gap between the old and new. And bringing these things together, whether they're working with a net new application or if they're using their heritage applications, these compliance and these rules still apply.

CRob Robinson

>> Absolutely.

Paul Nashawaty

>> Right.

CRob Robinson

>> And the CRA makes that extremely clear. If you are selling a product as of this date, they don't care that you based this off of a RACAF mainframe app that's 30 years old. You need to patch it and keep it up to date and support your customers.

Paul Nashawaty

>> Absolutely. And that opens up vulnerabilities if you don't. But this is not just about the European law, right? The impact is the global impact of data. Because whether you're talking about the CRA for the EU or you're talking about executive orders that may have come in place in North America or India doing their own thing. Let's kind of talk a little bit about that because as an education that I think that the market needs to understand that this is not a monolithic like site-specific thing. This is a big, big issue.

CRob Robinson

>> And that's where my background help make me very uniquely positioned to help out with this particular problem. I worked at a super-regional bank during the housing crisis and we had a lot of different regulators and compliance regimes we had to adhere to and my team was responsible for all of it and we didn't know that a server had to be DCI-compliant or had to be SOX-compliant or GLBA. So what our methodology was is we went for the strictest compliance regime and we implemented that across the board. It doesn't matter if it was managing the cafeteria menu or if it managed the online banking system, we all held the same standard and that's what we came into with the CRA looking at the requirements, I'm like, oh, these are things I had to do this 20 years ago back at the bank. They wanted this type of stuff.

Paul Nashawaty

>> Sure.

CRob Robinson

>> It had a different name. It wasn't secure by design, but it was the same kind of principles. It was all software development life cycle. And so what we did is we have a project called the Open Source Security Project Baseline where we went down and we mapped out 41 controls and these are things we have 41 controls broken up over three levels of maturity, and the first level of maturity we think is very reasonable that a single maintainer project should be able to achieve this with a minimal amount of additional effort because it's predominantly documentation tasks. Do you have a policy on contributions? Do you have a security policy? So there's a lot of really quick and easy wins that we can provide templates and guides to help coach people through that. But then we took the baselines, we have all these requirements, and then I went horizontally looking at different compliance regimes. So I started with the CRA. If a project follows the baseline, there are roughly 21 core cyber requirements for the CRA. If you follow the baseline your project does, you covered 19 of them. I can't help you out with protection of customer data and there's a concept from GDPR about allowing an EU citizen to be able to be forgotten by a system. So I don't have anything around that, but everything else, all the hard cyber requirements, the baseline accounts for. Then I went through NIST's cybersecurity framework, the software development... The SSDF, the secure software development life cycle. I actually was a contributor to that. And then we went through PCI and we went through all these different compliance regimes to show you if one of the controls is for maintainers, you should use multi-factor authentication because there's a lot of attacks directed towards maintainers because if the attackers know if I get that commit bit, I own the software, I can start to introduce backdoors or malware or just kind of corrupt things. So you introduce multi-factor that makes that harder to achieve and we tick it off. Well, great, you get CRA XYZ requirements, you get PCI, ABC, you get CSF 1, 2, 3, and just to show you how the utility of doing something once, it applies multiple times across multiple frameworks.

Paul Nashawaty

>> Yeah, that makes a lot of sense. I will say though, that was a lot to unpack.

CRob Robinson

>> I understand.

Paul Nashawaty

>> What you just said. And when the audience here that may be watching our conversation and talking about this, they may be coming at this from various stages. They could be very early in their development and understanding this to very, very, very mature and understand it. When you think about this, I think what you're talking about with your experience and the frameworks you put into place, it really helps benefit those employers and helps them understand what it is that they're trying to achieve, right?

CRob Robinson

>> Absolutely.

Paul Nashawaty

>> It also helps education of the market. So I think maybe if we tell the audience here, what does that mean for educating the audience and how can you help them become knowledgeable if they're early in the stage of saying they're already behind the eight-ball or should they start now or are they going to be... What's the revenue impact if they don't do these things? What's going to happen?

CRob Robinson

>> And I have around education, I have a couple different angles here. First and foremost, for the CRA in particular, we wrote a 90-minute course. So if you want to understand what the CRA is, what those obligations are, we have a free class you can take. I talk to developers as a developer, these are the impacts of this law for you, which fun fact, developers don't have any obligations in the law, so yay. Unless you take money for your project. And then there's a really weird nuanced space, but we cover that in the training. Then if you're a vendor selling things, we tell a manufacturer, here are your obligations. Here's how to learn more. Then kind of thinking about all these different compliance regimes. Again, we massage the baseline. Again, we wanted to make this simple. The value proposition for an upstream open source project using the baseline is ideally I'm reducing the noise from downstream. You're not going to have big banks or hyperscalers harassing you for an S-bomb, harassing you for what's your policy? I need a fix. Ideally, if you follow the baseline, you have a path towards a less noisy future, but also you're improving the security qualities of your product. So you're increasing your eminence and renown, you're going to get more stars and likes. People are going to like and use your software more because they recognize you're doing the security things that I need. Then flip that over to a enterprise, a manufacturer perspective, the baseline's a checklist. This is a list of things that you should be doing in your own development practices, but also as you're selecting third-party components, I would like my third-party component to give me an S-bomb. I'd like them to have security controls in their CI system and I'm able to give them evidence to show that these projects have done that.

Paul Nashawaty

>> Yeah, you already have the RFP kind of built out. Right?

CRob Robinson

>> Exactly.

Paul Nashawaty

>> So that's really important to understand, especially when you're new to it. Right? It is important to understand. I also look at in the context of the market landscape, I mean, this is a piece of the puzzle. It's not the puzzle.

CRob Robinson

>> Correct.

Paul Nashawaty

>> Right. So when we think about the market landscape, I know we kind of touched on it already a little bit, but I think it's important to make sure we reiterate that there's a global impact. It's not just an EU issue. However, this is driven by the EU. What does that mean to you as a global impact and what does the market landscape look like?

CRob Robinson

>> From my perspective, and you'll see this in the US where US generally, because it's very challenging to get laws passed, they'll work through procurement rules and that's how we used to have... You needed to have a NIST SSDF attestation, so you had to prove your software development practices to the government. You used to be able to have to show them S-bombs. So we did requirements. So if you wanted to sell to the government, you had to do these things. And the CRA is going to be very similar. If you want to get into Europe, which again, it's a very lucrative market, there's a lot of potential profitability there. If you don't do these things, you're not in... You're closed out of that, and other nations around the world are thinking about similar things. We're aware that China and India both have versions of the CRA in flight. I believe the same things in Australia and Britain. So this is going to happen everywhere. So even though it's not where you live today, it might be where you want to sell. Again, we're a super connected world. Open Source has helped break down so many barriers that a developer in Africa, their product can be used at a huge multinational bank. It's amazing to kind see this. So everything can come from everywhere and you need to understand that if you're doing core security right, you have unlocked those markets.

Paul Nashawaty

>> Well, and I think you kind of hit on a couple of other things too. Core security right, unlocking markets, but also addressing skill gap issues because if you're providing a blueprint, it doesn't leave any room for what you should be doing, and the devils are in the details. If you're trying to get something done and you forget a checkbox, it's not like, oh, well I forgot a checkbox. It's like, you're not going to be able to be compliant.

CRob Robinson

>> Well, and there's also severe consequences.

Paul Nashawaty

>> Absolutely.

CRob Robinson

>> So for example, if your product is involved in a breach and you're found negligent or a citizen has been harmed by your product, like basically their data's stolen or whatever. The consequences are up to two and a half times last year's total revenue of your company. So for each infraction, so the consequences are huge, but again, the profitability is there's potentially you have a market. If you showing that you make a robust, secure product that is done the right way, the potential for profits is amazing, and that connection.

Paul Nashawaty

>> And it can make or break a company.

CRob Robinson

>> Absolutely.

Paul Nashawaty

>> It can make or break a company.

CRob Robinson

>> Absolutely.

Paul Nashawaty

>> All right, so I know we talked a lot on this. Last word. What would you like the audience to know, whether it's to get started or where they can learn more, what do you want the audience to know?

CRob Robinson

>> I would point the audience to that free CRA class if you care about this particular law. If you care about core application security, good practices and understanding what a good project looks like, look at our security baseline. And then we also do a lot of education. We have a cyber security skills matrix. So if you want to get into either cyber security, application development, we have this matrix that breaks down 14 job families and we say, in order to do these roles, these are the core cyber security skills you need to have and experiences you want to have. So again, if you're getting new into a career or you want to change careers, this is a nice blueprint to kind of show you where to go. On the flip side, for companies, it's also a blueprint for your HR team. These are the skills, these are the certifications and experiences we want. So again, we have a ton of resources. Almost everything is free and publicly available and it's also all if you have comments or feedback, you want changes, patches are always welcome.

Paul Nashawaty

>> Well, if the audience heard it here first, they know where to go to get the information. I want to thank you for your time.

CRob Robinson

>> Thank you.

Paul Nashawaty

>> Your insights have really been great. It's been awesome to have you on. I also want to thank the audience. My name is Paul Nashawaty and I'm coming to you live from the show floor at the Open Source Summit at North America 2025. Thank you for watching theCUBE, the leading source of tech news.