BUILDING SECURITY IN OPEN SOURCE FOR FINANCIAL SERVICES: OPENSSF AT OPEN SOURCE FINANCE FORUM (OSFF) NYC

Summary from the TLDR InfoSec newsletter

OpenSSF sponsored the Open Source in Finance Forum to address critical security challenges in financial services, where 80-90% of modern software supply chains rely on open source software, including 71% of AI components, highlighting emerging risks such as malware hidden in AI model weights, poisoned training data, and identity-based intrusions that now account for 30% of financial sector attacks. The organization is implementing proactive defense measures, including Model Signing v1.0 for AI integrity verification, MLSecOps frameworks for full AI lifecycle security, transparency tools like OpenSSF Scorecard, OSV, and GUAC, plus policy engagement across the US and EU to secure open source from development to deployment. Financial services security professionals should adopt OpenSSF's security frameworks and tools, implement model signing for AI components, establish MLSecOps practices throughout the AI lifecycle, and actively participate in cross-industry collaboration to address supply chain vulnerabilities while connecting maintainers with the organizations that depend on their work.