Hannah Braswell and Jenn Power, security engineers from Red Hat and contributors to the OpenSSF, join host Sally Cooper to discuss the Gemara project. Gemara, an acronym for GRC Engineering Model for Automated Risk Assessment, is a seven-layer logical model that aims to solve the problem of incompatibility in the GRC (Governance, Risk, and Compliance) stack. By outlining a separation of concerns, the project seeks to enable engineers to build secure and compliant systems without needing to be compliance experts. The speakers explain how Gemara grew organically to seven layers and connects with other open source initiatives like the OpenSSF Security Baseline and Finos Common Cloud Controls. They also touch on the ecosystem of tools being built, including Queue schemas and a Go SDK, and how new people can get involved.Chapters:00:00 Welcome music + promo clip00:22 Introductions02:17 What is Gemara and what problem does it address?03:58 Why do we need a model for GRC engineering?05:50 The seven-layer structure of Gemara07:40 How Gemara connects to other open source projects10:14 Tools available to help with Gemara model adoption11:39 How to get involved in the Gemara projects13:59 Rapid Fire16:03 Closing thoughts and call to actionEpisode links:Jenn Power LinkedIn pageHannah Braswell LinkedIn pageGemara WebsiteBlog: Introducing the Gemara ModelPublication: Gemara: A Governance, Risk, and Compliance Engineering Model for Automated Risk AssessmentOpenSSF OSPS BaselineFinos Common Cloud ControlsPrivateerCyber Resilience Act (CRA) Brief Guide for OSS DevelopersLFEL1001: Understanding the EU Cyber Resilience Act (CRA) (Education/Training) Get involved with the OpenSSFSubscribe to the OpenSSF newsletterFollow the OpenSSF on LinkedIn

Ask this episode

“What did the council decide on item 42?” — answered with the speaker and the moment.

Transcript

Related