Skip to main content

FOSS Contribution Threats Catalog

Threats linked to FOSS contribution capabilities and vectors, aligned to FINOS Open Source Readiness risks (source).

ThreatCatalogv0.1.0draft
Threat catalog describing opportunities for negative impact arising from employee contribution to Free and Open Source Software projects.

Imports

finos-osr-risks
  • data-leakage-riskhttps://osr.finos.org/docs/bok/Risks/Data-Leakage-Risk
  • legal-riskhttps://osr.finos.org/docs/bok/Risks/Legal-Risk
  • operational-riskhttps://osr.finos.org/docs/bok/Risks/Operational-Risk
  • reputational-riskhttps://osr.finos.org/docs/bok/Risks/Reputational-Risk
  • staff-riskhttps://osr.finos.org/docs/bok/Risks/Staff-Risk
  • strategic-riskhttps://osr.finos.org/docs/bok/Risks/Strategic-Risk

Showing 10 of 10

Information Disclosure

Threats involving unauthorized or inadvertent disclosure of non-public information through FOSS contribution activity.

sensitive-data-disclosureDisclosure of Sensitive or Non-Public Information
Description

A contributor may publish confidential, proprietary, client, security, credential, architectural, or other non-public information in source code, documentation, comments, or community communications.

Vectors foss-contribution-vectors
  • accidental-sensitive-commit
  • unreviewed-public-release
Capabilities foss-contribution-capabilities
  • public-source-publication
  • company-infrastructure-contribution
  • community-engagement
Capabilities finos-osr-risks
  • data-leakage-riskAligns with FINOS OSR Data Leakage Risk for contribution context.

Financial Impact

Threats involving financial loss or asset write-down from FOSS contribution activity.

asset-financial-write-downFinancial Write-Down of Contributed Software Assets
Description

A contributor may grant perpetual, royalty-free rights to software that has material financial value, resulting in an unplanned write-down of a company software asset.

Vectors foss-contribution-vectors
  • perpetual-license-grant-without-approval
Capabilities foss-contribution-capabilities
  • perpetual-license-grant
  • public-source-publication
Capabilities finos-osr-risks
  • strategic-riskFinancial write-down of contributed assets aligns with FINOS OSR Strategic Risk.

Intellectual Property

Threats involving loss, weakening, or misuse of intellectual property through FOSS contribution activity.

intellectual-property-disclosureUnauthorized Publication of Intellectual Property
Description

A contributor may publish patentable material, trade secrets, trademarks, proprietary methods, or other protected works without appropriate intellectual property review or rights retention.

Vectors foss-contribution-vectors
  • perpetual-license-grant-without-approval
Capabilities foss-contribution-capabilities
  • public-source-publication
  • perpetual-license-grant
  • contributor-agreement-acceptance
Capabilities finos-osr-risks
  • legal-riskUnauthorized IP publication aligns with FINOS OSR Legal Risk.

Reputation and Conduct

Threats that could damage organizational reputation or arise from inappropriate public conduct in FOSS communities.

reputational-harm-from-contributionReputational Harm from Public Contribution Activity
Description

A contributor or project engagement may reflect poorly on the company through poor code quality, inappropriate public statements, association with controversial projects, or abandonment of company-moderated projects.

Vectors foss-contribution-vectors
  • reputational-public-conduct
Capabilities foss-contribution-capabilities
  • public-source-publication
  • company-attributed-identity
  • community-engagement
Capabilities finos-osr-risks
  • reputational-riskPublic contribution conduct aligns with FINOS OSR Reputational Risk.
employee-conflict-of-interestConflict of Interest in FOSS Participation
Description

An employee may participate in FOSS activity where personal interests, external employment, commercial relationships, or competing obligations interfere with or appear to interfere with company interests.

Vectors foss-contribution-vectors
  • conflict-of-interest-participation
Capabilities foss-contribution-capabilities
  • personal-infrastructure-contribution
  • community-engagement
  • project-inventory-registration
Capabilities finos-osr-risks
  • staff-riskEmployee conflict of interest aligns with FINOS OSR Staff Risk.
identity-misattributionImproper Public Identity Attribution
Description

A contributor may use a company-associated identity for personal contributions, continue using a company email after employment ends, or fail to use the required company external identity for company contributions.

Vectors foss-contribution-vectors
  • company-identity-misuse
Capabilities foss-contribution-capabilities
  • company-attributed-identity
  • personal-infrastructure-contribution
  • public-source-publication
Capabilities finos-osr-risks
  • staff-riskEmployee identity misuse aligns with FINOS OSR Staff Risk.
  • reputational-riskMisattributed public identity aligns with FINOS OSR Reputational Risk.