1. 04 October 2006 © 2006 Rhye Internet Solutions Limited 1 Open Source Security Is Open Source software more or less secure than proprietary equivalents? Peter SJF Bance CEng MBCS CITP Technical Director, Rhye Internet Solutions Limited CESG and BCS Listed Security Adviser peter.bance@rhyeinternet.com

2. 204 October 2006© 2006 Rhye Internet Solutions Limited The Arguments  Secure coding practices  Code audit / review  Developer motivation / integrity  Vendor liability / commitment  Distribution mechanisms  Vulnerability alerting / patching  Ownership, updates and maintenance  Security through secrecy (obfuscation)

3. 304 October 2006© 2006 Rhye Internet Solutions Limited So who is right?

4. 404 October 2006© 2006 Rhye Internet Solutions Limited Clearly, this is a grey area… The Open/Closed source decision will need to be made based on your situation, taking into account such factors as: Corporate policy Corporate policy Reliability requirements Reliability requirements Maintainability Maintainability Security requirements Security requirements In-house knowledge and skills In-house knowledge and skills

5. 504 October 2006© 2006 Rhye Internet Solutions Limited The question: Is Open Source software more or less secure than proprietary equivalents? The answer? This will depend on your specific situation.

6. 604 October 2006© 2006 Rhye Internet Solutions Limited We need a different approach…

7. 704 October 2006© 2006 Rhye Internet Solutions Limited Risk Assessment 1.Information Assets (value/impact) – Confidentiality, Integrity & Availability 2.Business Domains (interconnectivity) 3.Attack groups 4.Capability / Motivation ≡ Threat 5.Compromise Paths 6.Opportunity / Deterrence ≡ Likelihood  Is the resultant risk acceptable?

8. 804 October 2006© 2006 Rhye Internet Solutions Limited Only by assessing the risks associated with each individual requirement can we decide whether the “right” solution involves Open or Closed Source products.

9. 904 October 2006© 2006 Rhye Internet Solutions Limited Summary There is no simple answer to the question of whether Open or Closed Source is more secure, and it may be dangerous to generalise. It is therefore wise to approach this issue on a per-project basis, founded on a realistic and pragmatic assessment of the business, technical and security risks involved. business, technical and security risks involved.

10. 1004 October 2006© 2006 Rhye Internet Solutions Limited Further Information On Google (www.google.com): www.google.com  “open source” closed or proprietary research research quantify quantify empirical empiricalpeter.bance@rhyeinternet.com