Open Source Summit North America 2025

The federal government builds and maintains hundreds of thousands of software systems - and it would be difficult to find a system that doesn't rely on open source software. In fact, the government is likely the single largest consumer of OSS in the world and considering the criticality of the mission, the security of those systems is paramount. There has been limited guidance on how government programs should select, consume, contribute to, and publish open source software, but things are getting better! This session will discuss the current landscape of open source in the federal government and present methods for how we can secure our own systems with tools and processes to vet open source projects, ingest that software securely, and support those projects with substantive contributions.
Attendees from government entities, contractors, and members of the community should attend to learn how the government can tackle the supply chain risks inherent in open source while still capturing the benefits that it has to offer. They'll come away with an understanding of how this might impact their work, and how by working together we can build a better open source ecosystem for everyone.

Most modern software assumes the internet is always available—but what happens when it’s not? Air-gapped environments are more prevalent than you might think. While they are essential in government, they’re also common in finance, healthcare, and manufacturing. Yet, a surprising amount of today’s tooling—from CI/CD pipelines to package managers—relies on network access and fails when that assumption is broken.

Working in these environments means finding new ways to handle familiar problems. In this talk, we’ll look at the challenges teams face when managing dependencies, applying updates, and automating deliveries without internet access. We’ll share practical solutions, real-world examples, and ways to make modern development practices work in restricted environments.

In this session we will perform a case study of load testing for a US State’s Unemployment Insurance Modernization initiative. We will talk about the unique requirements and constraints of the project, such as the looming specter of the COVID-19 Unemployment boom. We’ll also review how the testing was done and why we ultimately decided on using browser-based tools such as Artillery with Playwright to build a testing system that could deliver and measure massive amounts of realistic traffic in a way that is quick (30 minutes) and easy to run. Attendees will walk away with an understanding of how one might approach load testing for a system like this, and why using browser based testing might or might not be a good idea.

As government regulations, such as Executive Order 14028 - Improving the Nation's Cybersecurity, drive organizations to adopt Software Bill of Materials (SBOM) reporting, modern software systems face unique challenges in achieving compliance. Decoupled cloud-native architectures—comprised of microservices, containers, APIs, and distributed dependencies—make it exponentially more difficult to produce accurate, real-time SBOMs. This talk explores the complexities of implementing SBOM practices in distributed environments, the risks of non-compliance, and strategies to streamline compliance efforts.

Most developers generating SBOMs use a tool like Syft or Trivy and yell “SHIP IT!” While this might generate an NTIA Minimum Field adherent SBOM, it often lacks information that truly makes it actionable for downstream users.

This talk covers the work of a CISA SBOM Community Tiger Team who created SBOM Generation Reference Implementations for multiple languages and scenarios. We will discuss the distinct phases of SBOM generation and highlighting how each step contributes to a more robust and actionable SBOM. By expanding the SBOM authoring process, organizations can better integrate multiple data sources, enhance metadata accuracy, and customize their workflows to align with evolving security frameworks. This approach enables tool interchangeability while maintaining data integrity and transparency.

Additionally, we will explore implementations, including the integration of SBOM generation into CI/CD pipelines using GitHub and GitLab, supporting multiple programming languages, and ensuring interoperability with both CycloneDX and SPDX formats. We will also discuss ecosystem challenges such as supplier identification, license consistency, and benchmarking completeness.