< Retour au sommaire

Securing Open-Source Components with the SecOPERA Framework

Virgile Prevosto le

Lieu: Salle 1073

Suivre en visio

Abstract

SecOPERA (Secure OPen source softwarE and hardwaRe Adaptable framework) is a European project aimed at developing a one-stop hub for complex open-source software and hardware solutions delivering the means to analyse, assess, secure/harden and share open-source solutions as those are integrated into an overall complex product developed for a networked connected environment.

More precisely, the SecOPERA framework supports the open-source DevSecOps lifecycle by providing:

• A decomposition and security audit/testing engine that analyses OSS/OSH solutions
• An adaptation engine that debloats OSS/OSH code to remove unrelated code and reduce the attack surface; and a security enhancement process to harden the OSS/OSH solution
• An updating/patching mechanism so that the SecOPERA open-source flows remain secure even if their code starting points are vulnerable.

On top of that, the SecOPERA hub provides

• An repository for secure modules that is used in the security enhancement mechanism of open-source solutions; and
• An repository of security-hardened OSS/OSH solutions and their security guarantees.

In this talk, we will present the various com onents of the platform and focus notably on the Frama-C-based code analysis tools that it offers.

Download slides