Microsoft, Google and IBM Among First Members of Open Source Security Group

Microsoft has joined a high-powered group of tech giants in a new industry foundation aimed at improving the security of open source software.

The Open Source Security Foundation counts Microsoft as a founding member, along with "GitHub, Google, IBM, JPMC, NCC Group, OWASP Foundation and Red Hat," according to a Monday announcement. The JPMorgan Chase banking chain is also listed as a founding member, per the Open Source Security Foundation's FAQ.

The Open Source Security Foundation is "hosted at the Linux Foundation" and brings together various Linux Foundation-initiated efforts. Those efforts include the "Core Infrastructure Initiative (CII)" and the "GitHub-initiated Open Source Security Coalition (OSSC)," among others. The OSSC members are joining the Open Source Security Foundation and the efforts of CII likely will get dissolved into the new foundation, the FAQ explained.

The aim of the new foundation is to "improve the security of open source software by building a broader community, targeted initiatives and best practices," Microsoft indicated. A list of current technical initiative being overseen by the foundation can be found at this GitHub page.

The open source software community has tended to critique proprietary software companies, such as Microsoft, because its code can't be independently checked. However, Microsoft's announcement by Mark Russinovich, Microsoft's chief technology officer, offered an alternative view, namely:

  • Open source software is ubiquitous, and thereby potentially more subject to frequent attack.
  • Open source software has no central authority checking software quality.
  • Open source software can have attackers masquerading as project maintainers.

"Given the complexity and communal nature of open source software, building better security must also be a community-driven process," Russinovich argued in explaining Microsoft's support for the new foundation.

Microsoft had already been working with the OSSC to identify security threats in open source software. It's also worked to speed the software fixing process. Additionally, Microsoft has developed security tools for open source developers, and it currently offers best-practices advice, Russinovich noted.

About the Author

Kurt Mackie is senior news producer for 1105 Media's Converge360 group.


  • Image of a futuristic maze

    The 2024 Microsoft Product Roadmap

    Everything Microsoft partners and IT pros need to know about major Microsoft product milestones this year.

  • Microsoft To Wind Down Copilot Pro's 'GPT Builder' Feature

    Subscribers of Microsoft's Copilot Pro solution will lose access to a key perk starting next month.

  • Windows Server 2025 GPU Improvements Promise Major AI Support

    Currently in public preview, Windows Server 2025 is shaping up to be a major beneficiary of Microsoft's wide-ranging collaboration with chip giant Nvidia.

  • High Levels of Customer Unease Around VMware-Broadcom Deal: Report

    CloudBolt Software, a Microsoft technical partner and self-described "cloud ROI company," recently commissioned a survey of 300 current VMware customers gauging their outlook on VMware's acquisition by Broadcom.