Source: https://csrc.nist.gov/csrc/media/projects/supply-chain-risk-management/documents/ssca/2016-fall/tue_am_1_what_oss_is_and_is_not_andy_murren.pdf