Collection of Use Case Examples Expanded Regarding Management Methods for Utilizing Open Source Software and Ensuring Its Security

1. Background and purpose

On September 5, 2019, METI inaugurated a Task Force for Evaluating Software Management Methods, etc. toward Ensuring Cyber/Physical Security (Software Task Force), placing it under the Cross-Sectional Sub-Working Group of the Study Group for Industrial Cybersecurity's Working Group 1(WG1). The Software Task Force has been examining appropriate software management methods, responses to vulnerability and license issues, and other matters ever since.

The Software Task Force has understood that sharing knowledge and experience among stakeholders will be beneficial in the current situation in which many companies are having problems addressing things like vulnerability and appropriate management of software that contains OSS. Hence, the Task Force compiled the results of interviews and other studies with companies that are conducting instructive initiatives for OSS management methods and other matters, and published a "Collection of Use Case Examples Regarding Management Methods for Utilizing OSS and Ensuring Its Security" on April 21, 2021. The collection summarizes the points to note when utilizing OSS, and for each point, provides use case examples.

The Task Force went on to conduct interviews and other studies regarding utilization of OSS and compile information including the results in FY2021, and has expanded the "Collection of Use Case Examples Regarding Management Methods for Utilizing OSS and Ensuring Its Security." METI hopes that it will promote appropriate use of OSS that takes into account the necessary points to note, enabling industry to benefit from OSS properly and leading to improved competitiveness.

2. Related materials

• Collection of Use Case Examples Regarding Management Methods for Utilizing OSS and Ensuring Its Security(PDF:7,161KB)
• Outline of the expanded use case examples(PDF:23KB)

3. Reference links

• The Cyber/Physical Security Framework (CPSF) and Its Deployment (in Japanese)
• Study Group for Industrial Cybersecurity Working Group (WG) 1 (Systems, Technologies and Standardization) (in Japanese)
• Cross-Sectional Sub-Working Group (in Japanese)
• Task Force for Evaluating Software Management Methods, etc. toward Ensuring Cyber/Physical Security (in Japanese)

Division in Charge

Cybersecurity Division, Commerce and Information Policy Bureau