We think you have liked this presentation. If you wish to download it, please recommend it to your friends in any social system. Share buttons are a little bit lower. Thank you!
Presentation is loading. Please wait.
Published byLiam Leavins
Modified over 2 years ago
04 October 2006 © 2006 Rhye Internet Solutions Limited 1 Open Source Security Is Open Source software more or less secure than proprietary equivalents? Peter SJF Bance CEng MBCS CITP Technical Director, Rhye Internet Solutions Limited CESG and BCS Listed Security Adviser email@example.com
204 October 2006© 2006 Rhye Internet Solutions Limited The Arguments Secure coding practices Code audit / review Developer motivation / integrity Vendor liability / commitment Distribution mechanisms Vulnerability alerting / patching Ownership, updates and maintenance Security through secrecy (obfuscation)
304 October 2006© 2006 Rhye Internet Solutions Limited So who is right?
404 October 2006© 2006 Rhye Internet Solutions Limited Clearly, this is a grey area… The Open/Closed source decision will need to be made based on your situation, taking into account such factors as: Corporate policy Corporate policy Reliability requirements Reliability requirements Maintainability Maintainability Security requirements Security requirements In-house knowledge and skills In-house knowledge and skills
504 October 2006© 2006 Rhye Internet Solutions Limited The question: Is Open Source software more or less secure than proprietary equivalents? The answer? This will depend on your specific situation.
604 October 2006© 2006 Rhye Internet Solutions Limited We need a different approach…
704 October 2006© 2006 Rhye Internet Solutions Limited Risk Assessment 1.Information Assets (value/impact) – Confidentiality, Integrity & Availability 2.Business Domains (interconnectivity) 3.Attack groups 4.Capability / Motivation ≡ Threat 5.Compromise Paths 6.Opportunity / Deterrence ≡ Likelihood Is the resultant risk acceptable?
804 October 2006© 2006 Rhye Internet Solutions Limited Only by assessing the risks associated with each individual requirement can we decide whether the “right” solution involves Open or Closed Source products.
904 October 2006© 2006 Rhye Internet Solutions Limited Summary There is no simple answer to the question of whether Open or Closed Source is more secure, and it may be dangerous to generalise. It is therefore wise to approach this issue on a per-project basis, founded on a realistic and pragmatic assessment of the business, technical and security risks involved. business, technical and security risks involved.
1004 October 2006© 2006 Rhye Internet Solutions Limited Further Information On Google (www.google.com): www.google.com “open source” closed or proprietary research research quantify quantify empirical firstname.lastname@example.org
SEC835 Database and Web application security Information Security Architecture.
IT Security CS5493(74293). IT Security Q: Why do you need security? A: To protect assets.
Thomas Levy. Agenda 1.Aims: Reducing Cyber Risk 2.Information Risk Management 3.Secure Configuration 4.Network Security 5.Managing User Access 6.Education.
1 Process Engineering A Systems Approach to Process Improvement Jeffrey L. Dutton Jacobs Sverdrup Advanced Systems Group Engineering Performance Improvement.
Bank Audit. Internal Audit Internal audit is an independent, objective assurance activity and can give valuable insight in providing assurance that major.
Agenda COBIT 5 Product Family Information Security COBIT 5 content
Alaa Mubaied Risk Management Alaa Mubaied
Information Technology – Guidelines for the Management of IT Security
Energize Your Workflow! ©2006 Merge eMed. All Rights Reserved User Group Meeting “Energize Your Workflow” May 7-9, Security.
The decision of whether to establish and maintain an internal audit function or outsource the function should be made by the company’s.
Multi-faceted Cyber Security Research Group edited strategy.
International Security Management Standards. BS ISO/IEC 17799:2005 BS ISO/IEC 27001:2005 First edition – ISO/IEC 17799:2000 Second edition ISO/IEC 17799:2005.
1 Secure Your Business PATCH MANAGEMENT STRATEGY.
Session 3 – Information Security Policies
April 14, A Watershed Date in HIPAA Privacy Compliance: Where Should You Be in HIPAA Security Compliance and How to Get There… John Parmigiani National.
Smart Grid - Cyber Security Small Rural Electric George Gamble Black & Veatch
Information Security: Model, Process and Outputs Presentation to PRIA WG November 10, 2006.
Principles of Information Security, Fourth Edition Risk Management Ch4 Part I.
© 2017 SlidePlayer.com Inc. All rights reserved.