We think you have liked this presentation. If you wish to download it, please recommend it to your friends in any social system. Share buttons are a little bit lower. Thank you!
Presentation is loading. Please wait.
Published byLiam Leavins
Modified over 4 years ago
04 October 2006 © 2006 Rhye Internet Solutions Limited 1 Open Source Security Is Open Source software more or less secure than proprietary equivalents? Peter SJF Bance CEng MBCS CITP Technical Director, Rhye Internet Solutions Limited CESG and BCS Listed Security Adviser firstname.lastname@example.org
204 October 2006© 2006 Rhye Internet Solutions Limited The Arguments Secure coding practices Code audit / review Developer motivation / integrity Vendor liability / commitment Distribution mechanisms Vulnerability alerting / patching Ownership, updates and maintenance Security through secrecy (obfuscation)
304 October 2006© 2006 Rhye Internet Solutions Limited So who is right?
404 October 2006© 2006 Rhye Internet Solutions Limited Clearly, this is a grey area… The Open/Closed source decision will need to be made based on your situation, taking into account such factors as: Corporate policy Corporate policy Reliability requirements Reliability requirements Maintainability Maintainability Security requirements Security requirements In-house knowledge and skills In-house knowledge and skills
504 October 2006© 2006 Rhye Internet Solutions Limited The question: Is Open Source software more or less secure than proprietary equivalents? The answer? This will depend on your specific situation.
604 October 2006© 2006 Rhye Internet Solutions Limited We need a different approach…
704 October 2006© 2006 Rhye Internet Solutions Limited Risk Assessment 1.Information Assets (value/impact) – Confidentiality, Integrity & Availability 2.Business Domains (interconnectivity) 3.Attack groups 4.Capability / Motivation ≡ Threat 5.Compromise Paths 6.Opportunity / Deterrence ≡ Likelihood Is the resultant risk acceptable?
804 October 2006© 2006 Rhye Internet Solutions Limited Only by assessing the risks associated with each individual requirement can we decide whether the “right” solution involves Open or Closed Source products.
904 October 2006© 2006 Rhye Internet Solutions Limited Summary There is no simple answer to the question of whether Open or Closed Source is more secure, and it may be dangerous to generalise. It is therefore wise to approach this issue on a per-project basis, founded on a realistic and pragmatic assessment of the business, technical and security risks involved. business, technical and security risks involved.
1004 October 2006© 2006 Rhye Internet Solutions Limited Further Information On Google (www.google.com): www.google.com “open source” closed or proprietary research research quantify quantify empirical email@example.com
Ashutosh Pednekar, FCA, CISA, ISA (ICA), LLB (Gen), B.Com. Partner, M P Chitale & Co. November 6, 2007 IRDA – ICAI Round Table Meeting on Insurance Industry.
Copyright © XiSEC, All rights reserved, 2002 Secure Computing Best Lifetime Achievement Award 2002 Ted Humphreys Information Security Management Goes Global.
Community engagement Implementing NICE guidance 2008 NICE public health guidance 9.
Dr Lami Kaya ISO Information Security Management System (ISMS) Certification Overview Dr Lami Kaya
Alignment of COBIT to Botswana IT Audit Methodology
Information Technology – Guidelines for the Management of IT Security
Ethics, Privacy and Information Security
Information Risk Management Key Component for HIPAA Security Compliance Ann Geyer Tunitas Group
SAFE Blueprint and the Security Ecosystem. 2 Chapter Topics SAFE Blueprint Overview Achieving the Balance Defining Customer Expectations Design.
Open Source Software Wrap-Up By Lance Faxon. Open Source General History Definitions Patents Cathedral and Bazaar Business Microsoft Models Open v. Proprietary.
ICS 417: The ethics of ICT 4.2 The Ethics of Information and Communication Technologies (ICT) in Business by Simon Rogerson IMIS Journal May 1998.
Agenda COBIT 5 Product Family Information Security COBIT 5 content
Smart Grid - Cyber Security Small Rural Electric George Gamble Black & Veatch
The State of Security Management By Jim Reavis January 2003.
Introducing Computer and Network Security
Sanjay Goel, School of Business/Center for Information Forensics and Assurance University at Albany Proprietary Information 1 Creation of Policies, Part.
Computer Security: Principles and Practice
1 Secure Your Business PATCH MANAGEMENT STRATEGY.
Session 3 – Information Security Policies
© 2018 SlidePlayer.com Inc. All rights reserved.