Posted on 08/18/2012 11:59:23 AM PDT by ShadowAce
One of the biggest lies told about open source is that it's insecure.
In letting just anyone use your code, that has to include the bad guys. They're bound to find a way to compromise it, the thinking goes.
But that's not the way it works in real life. Having every potential victim working on your neighborhood code watch turns out to deliver more security, not less.
Having everyone who might be the victim of an online break-in organized, finding bugs, writing and testing fixes, constantly improving security tools, works.
Don't believe me? Well, maybe you'll believe the National Security Agency or the Department of Homeland Security. The open source process works for them, too.
For a decade, one of the most popular intrusion prevention and detection systems has been Snort, created by Martin Roesch. But the company he built around that software, Sourcefire, only gives away the basic package. If you need extensions, if you want a more complete system, you have to pay. That code is controlled by Sourcefire.
There is nothing unusual in that. Many open-source businesses create free community and paid "enterprise" editions of their software. This is what Red Hat(RHT) is all about -- you can download Fedora Linux free or buy Red Hat Enterprise Linux. In both cases you get to see the code, but with the paid version you get the support needed to run it professionally.
But this model didn't work with Snort. The Department of Homeland Security, the military, and the NSA could not be "held hostage" to Sourcefire for improvements to the code, or for the specialized suite needed to protect the nation.
So the Department of Homeland Security got together with major contractors and formed their own open source project, the Open Information Security Foundation. OISF has its own intrusion system, called Suricata, whose syntax is based on Snort, so if you are accustomed to one you can use the other.
But Suricata will be a complete system, not just a "sniffer," as intrusion detection products are colloquially known. The whole Suricata suite will be open source. This process is now expanding, as I noted here at TheStreet.com on Monday.
In May, the National Security Agency co-hosted an Open Source Security Industry Day at a Johns Hopkins facility in Fort Meade, Md. As ZDNet's Steven J. Vaughan-Nichols reported, agency people described their needs for open source and urged suppliers to include open source in their offerings.
John Weathersby of the OSS-Institute, which is now affiliated with Georgia Tech in Atlanta, told me most of the day was devoted to small "breakout" sessions, where contractors answered hard, detailed questions put to them by key government customers. The affair wasn't just a series of sales pitches, he said. It was the first step in a negotiation.
Among the open source projects the NSA supports is Security Enhanced Linux (SE-Linux), for which it has developed an access control module called Flask, hosted at the University of Utah. Open source and security, in other words, do go together.
Open source can only provide tools. Procedures are also needed to assure that people maintain security. So the Cloud Security Alliance offers an integrated stack of such procedures, called the GRC Stack. GRC stands for Governance, Risk management and Compliance. This is maintained in an open process with the support of both contractors and software vendors.
Point is, open source and security do mix. They mix well. With more businesses moving toward cloud technology, much of it based on open source software, they are going to be doing a lot more mixing.
/johnny
I expect to see some pretty bloody reprisals after the first multi-million dollar loss of data in the 'cloud'.
/johnny
“Why the push to centralize to cloud locations rather than remaining distributed?”
I’ll claim ignorance here, but I thought “the cloud” was the definition of distributed computing and data management.
Various futurists have been arguing that the value of data is rapidly approaching zero during this age of accelerating change and ubiquitous information access. Put another way, the half life of a good idea is getting shorter and shorter. Business models based on husbanding data as if it has value (the crown jewels) are going to fade away and be replaced by business models built on the concept of exploiting new and publicly available data more rapidly than your peers.
I fear that if these predictions are true, the U.S. government and its love of classified data will fail to compete with faster governments not married to protecting mountains of information or data. Many of our larger businesses could follow suit.
We live in interesting times.
You are exactly correct...the value of data is plummeting. As we trend towards perfect information, it seems like markets will begin to correct instantly almost removing short term profit takers and liquidity from the markets.
As consumers increasingly use engines like amazon and google products, retailers will continue to die off and the profit model will continue to be destroyed.
I don’t know where it all ends. Combine this with the automation trend it seems we in a negative feedback loop that doesn’t have an obvious solution. I don’t know what happens when there are just no jobs and no ways for 80% of the population to make any money.
DykeNet?
I agree. Even in a full-on information age, there will be a need to protect some data. I'm thinking it's a tiny amount though.
Already posted
Knock it off!
Knock off commenting on the thread spam which you used to forbid?
Knock THAT off?
RedMDer’s posts are not spam. He’s helping tremendously with our FReepathon and I appreciate it very much.
Look, if we had to go to commercial advertising to pay for this site, you’d probably see several with every click. They only raise a tiny fraction of a cent per impression.
Thanks Boss.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.
