| Similarities and differences between close and open sources in a security perspective | ||
| | Open Source | Close Source |
| Independent Assessment | User can assess the system freely. The defender by using open source can assess, inspect, modify, and redistribute the system that will be used to defend. In my opinion, that is one of the main points of the article. | User is not allow to assess the system prior to using in order to find out system's vulnerabilities and risks. |
| Patches Availability | Because of the fact that open source is access by thousands of users, including qualify developers, patches for vulnerabilities would be produce quiet fast. Open source enables users to find bugs, and to patch any bugs themselves, making open source more secure than close source instantly. | When a vulnerability is found, independent sources usually take a considerable amount of time before producing a patch to fix it. Allowing attacks to happen |
| Access to source | Both hackers and user have access to the source. Hackers benefit from this since they can access tons of information, making it easy to find system's vulnerabilities. It gives an unfair advantage to attackers from security defenders. | Access to code is not allow, thus minimizing information that may aid a hacker to launch an attack to the system. This is not always the case since hackers could indeed with time find system's vulnerabilities with the use of debuggers and disassembles. |
| Secure involvement of developers | Open sources allow a widely range of developers to work on the source. This is a good thing since thousands of users could rapidly pinpoint a vulnerability. However, this could easily lead to a system backdoor, a source by hackers posing a trustworthy contribution. In contrast with close source, this approach is more secure. | Only private developers are involved in close source systems. This has advantages and disadvantages. The advantage is that the source will not be widespread, making attacker's jobs more difficult. The disadvantage is that when developers realize vulnerabilities, the process of producing a patch is slow. |
| Quality Control | Since this source is viewed by everyone, high standards are enforce to developers. It is human nature to do things well when expose to everyone. | Poor project management and quality control |
| Comunication between users | Since this is an open source system, basically, you are your own customer and are responsible on maintaining the system. For this reason, there is a large amount of help between users as forums for instance. | Customer service and communication between users is limited in close source systems |
Friday, October 2, 2009
Increase Security Through Open Source
Subscribe to:
Post Comments (Atom)
No comments:
Post a Comment