Open source mission: impossible?

To achieve these objectives, the Mission has set out the following goals:

1. To build a strong open source mission statement and supporting strategy.
2. Supporting open source migration processes for strategic services, platforms and applications.
3. Provide a strong communication channel between the software development teams, Lloyds Banking Group management, product owners and internal business units, in order to convey the activities and results of the Open Source Mission quickly and effectively.
4. Prepare a flexible and adaptable risk landscape towards control effectiveness to provide the right level of assurance to the bank, as well as the conformance that the regulator requires.
5. Enable an ongoing monitoring of open source software critical services, applications, and addressing cyber resilience whilst accelerating digital innovation and transformation.
6. Provide a multi-tiered training program for software development teams and other stakeholders in order to help enhance team and collaborator open source skills.
7. Implement process automation and tool support to empower developers.
   
   

Open source software: benefits and pitfalls

Today, enterprises are becoming one of the most influential forces in the open source ecosystem - and their impact is only going to increase. They are consuming it as fast as possible, but also contributing not just patches and fixes but complete sets of functionality, and are even open sourcing entire applications. But, at times, in their objective to harvest all the benefits that new developments bring, their passion can have unintended consequences; usually as a result of inadequate quality management.

The benefits of open source include:

• Supporting organisational security, flexibility and resilience by creating common and flexible responses through open source communities and collective work.
• Advancing innovation across all areas of business and society by increasing engagement and collaboration.
• Attracting and retaining talent, because the best developers want to work with the latest open source technologies, and in a collaborative manner that is also open source and are most likely already contributors to projects being developed in the organisation.
• Increasing productivity, because developers with open source software programming skills can be productive on the day they are hired to work on these same technologies inside the Group.
• Allowing easier customisation and better adequacy as alternatives are freely available.
• Cutting the development cycle, which can reduce the cost of software development in an open source ecosystem.

The Mission recognises the fact that the Group, like all financial institutions, is undergoing one of the biggest transformations in its long history, and that reaping the above benefits of using adequate and effective open source software is part of bringing about this seismic change. We also understand that these changes require full organisational buy-in and adoption in order to truly make a difference.

Pitfalls of open source - and how to address them

The use of open source software could introduce various risks and security challenges for organisations, such as:

• Compliance risk, intellectual property and license management issues
• Security and vulnerability management concerns
• Operational risk such as software versioning, duplication and prioritisation
• Reputational risk in case of any system, services and customer data compromise and exposure.

However, with an adequate strategy, competent and mature open source management, these concerns can be addressed, allowing the use of the right software to innovate and deliver applications and services to the market rapidly.

Ten ways to avoid pitfalls of open source:

1. Define a risk profile for open source software
2. Establish an open source software policy with the right scope
3. Add security as part of a native software development process
4. Create and validate an open source software inventory
5. Define measured outputs and specific metrics for software security initiatives
6. Develop a security focused organisation culture
7. Verify authenticity and block corrupted downloads
8. Check for vulnerabilities and blocking severe risks
9. Check licenses and block for licenses prohibited for specified use cases
10. Provide a warning strategy for obsolete software

For any organisation following these industry best practices, the use of open source software would bring massive innovation to services and applications by establishing an agile response to the ever-evolving digital needs of customers in a rapid, consistent way.

Our ambitions for open source software

We believe that a robust open source strategy can support our purpose of Helping Britain Prosper, and that by proactively engaging with developer communities we can encourage inclusivity. “Be open and use open source” is the motto of the UK’s government digital services internal guidance on open source software. It is good practice to publish your code, and to use open source to improve transparency, flexibility and accountability.

We are establishing a constructive relationship between all of our business units that are interested in open source by leveraging it strategically and engaging with internal stakeholders, as well as with the senior management team. We are creating an effective open source strategy which is driven by the bank’s objectives, and which ties together our goals of consuming, contributing and community together.

In addition, we are promoting the practice of publishing some of our internal code as open source. The Mission is actively raising awareness about open source and driving cultural transformation across the Group, by highlighting the benefits that can be achieved through strategically planned open source activities. This is being achieved through numerous measures, from recording video sessions, publishing articles and hosting group activities across the business areas.

We believe that with a collaborative software development process in the bank, by leveraging the software and actively publishing them, we can help the Group to reduce its costs considerably and reduce development time. Furthermore, we‘ll be able to improve the overall quality, including security, by increasing transparency and active peer review.

We are conscious of challenges and risks in this process. But we have the right policy and processes to respond to such concerns, supporting broad participation, discovery and active development of open source software across the organisation.

As we launch the next steps of the Open Source Mission, we’re confident in the delivery of the Mission’s goals and objectives. We’re looking forward to an engaging experience with the Group’s developers to help them achieve their objectives, and ultimately, the Group’s objectives too.