Friday, October 2, 2009

Increase Security Through Open Source

Similarities and differences between close and open sources in a security perspective

Open Source
Close Source
Independent Assessment
User can assess the system freely. The defender by using open source can assess, inspect, modify, and redistribute the system that will be used to defend. In my opinion, that is one of the main points of the article.
User is not allow to assess the system prior to using in order to find out system's vulnerabilities and risks.
Patches Availability
Because of the fact that open source is access by thousands of users, including qualify developers, patches for vulnerabilities would be produce quiet fast. Open source enables users to find bugs, and to patch any bugs themselves, making open source more secure than close source instantly.
When a vulnerability is found, independent sources usually take a considerable amount of time before producing a patch to fix it. Allowing attacks to happen
Access to source
Both hackers and user have access to the source. Hackers benefit from this since they can access tons of information, making it easy to find system's vulnerabilities. It gives an unfair advantage to attackers from security defenders.
Access to code is not allow, thus minimizing information that may aid a hacker to launch an attack to the system. This is not always the case since hackers could indeed with time find system's vulnerabilities with the use of debuggers and disassembles.
Secure involvement of developers
Open sources allow a widely range of developers to work on the source. This is a good thing since thousands of users could rapidly pinpoint a vulnerability. However, this could easily lead to a system backdoor, a source by hackers posing a trustworthy contribution. In contrast with close source, this approach is more secure.
Only private developers are involved in close source systems. This has advantages and disadvantages. The advantage is that the source will not be widespread, making attacker's jobs more difficult. The disadvantage is that when developers realize vulnerabilities, the process of producing a patch is slow.
Quality Control
Since this source is viewed by everyone, high standards are enforce to developers. It is human nature to do things well when expose to everyone.
Poor project management and quality control
Comunication between users
Since this is an open source system, basically, you are your own customer and are responsible on maintaining the system. For this reason, there is a large amount of help between users as forums for instance.
Customer service and communication between users is limited in close source systems

No comments:

Post a Comment