Welcome!

Open Source Authors: Zhiyong Li, Maureen O'Gara, Yakov Fain, Hovhannes Avoyan, Rob Rusher

Related Topics: Open Source

Open Source: Article

Successful Open Source Security Is Knowing What to Secure

You can't secure what you don't know you have

Imagine the CIO of a consumer bank who thinks he is running 50 Oracle databases, but now finds out that in fact he has 100 databases installed behind his firewall. He doesn't have any idea where the other 50 came from. He doesn't know the name of the vendor(s) supporting them. And he doesn't have anyone on his IT team assigned to managing them. This scenario would be totally unacceptable to anyone.

That CIO would be shocked to hear that a very similar situation is happening today. But it's not undocumented databases that will surprise him. It is undocumented open source software embedded inside externally facing web and software applications.

Spend Small, Think Small
Often times the philosophy of "spend small, think small" prevails for most IT organizations. Unless an organization is adopting a large open source project such as Linux, special resources are not being allotted to the management of open source adoption.

In the past, if developers wanted to incorporate third-party code into their applications, a joint development agreement or in-bound licensing contract would be negotiated. The process would have also included a development manager, procurement lead, and a lawyer.

Today's software development world is complex and fast-paced. Software engineers are under increasing pressure to deliver large, high-quality applications in less time, with fewer resources. As a result, the use of community-based open source software components has become one of the most dominant trends in software development.

To remain competitive, complexity and weighty processes have dropped by the wayside, with many disappearing altogether. In today's world of 24/7 and persistent network access, developers dispersed across multi-national sites can include open source, freeware, public domain, evalware (demos of commercial software), etc., into the code they are writing without triggering the usual checkpoints in the procurement process. Without these controls, the open source software is unlikely to be detected, monitored, and tracked.

As a result, IT organizations are unaware of what exactly comprises their code base.

More Stories By Theresa Bui-Friday

As VP of Product Marketing, Theresa Bui-Friday is responsible for Palamida's positioning, core communications content, go-to-market initiatives, and press and analyst relations team. She has over 12 years' of expertise in the software industry with a focus on emerging technology. Prior to Palamida, Theresa was Director of Strategic Marketing at Cacheon. She was also Director of Enterprise Marketing for Embark.com, which is now Princeton Review, where she held global responsibility for product marketing of the enterprise product lines, including competitive and market evaluation, strategic planning and outbound marketing programs.

Comments (0)

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.