Does 'open' mean secure?

While hardware vendors and professional services organizations see only opportunity in Linux, it has received less than a full embrace from commercial software vendors. Some companies are openly enthusiastic, for some companies it simply isn't on the radar yet. However, many established players are wary about improving a platform whose premise seems to be that software should be free. If they develop for Linux, they can get caught in a feature and cost of ownership comparison with an open source alternative. And of course there is the behemoth from Redmond, which appears to be fighting Linux on all fronts. Linux has been around for a long time on the Internet, and it is clearly here to stay in corporate environments as well. The question many people have been pondering is not if, but how big of an impact it will ultimately have in enterprise networks. Where will the technology, like the astronomical stock market valuations, ultimately settle? Though not the only piece of the puzzle, understanding how secure an open source operating system is can help us determine how high that operating system will climb the corporate ladder. Can you trust an operating system whose source code is freely available for anyone to review?

Many people have said that the strength of the best encryption algorithms is due to the rigorous review they have had, out in the open, over a long period of time. The more cryptanalysts that try to break a code, the more unbreakable it becomes. When security vulnerabilities are found in Linux, a vast array of programmers can be working on the solution. If that isn't fast enough, you might be able to patch it yourself. The fact of the matter is that both the good guys and the bad guys are constantly probing open source software for security vulnerabilities. In traditional Closed Source operating systems and applications, the bad guys are still probing for vulnerabilities, but instead of using source code, they are reverse engineering the software by testing input buffers and listening TCP ports. But where are the good guys? I believe there are far fewer of them protecting closed source software; they are usually the programmers employed by the company that owns the software. You can be certain that as you are reading these words, a conscientious programmer is looking for security problems within the Linux source code. However, don't be so sure that a programmer is looking for security bugs within you favorite closed source product. I truly believe that open source operating systems can be among the most secure, in fact the most secure shrink wrapped operating system available is probably OpenBSD, which I like to call Linux's Linux.

The natural paranoia that goes hand in hand with the information security market could be well matched with open source. You may very well want to be intimately familiar with the inner workings of the software that purports to be guarding your enterprise. At SecurityPortal.com, we have heard more than one IT security manager say he will not buy security software from country A or country B, because he cannot trust those countries and fears Trojan Horses or worse. While sometimes these fears can be misplaced, it does point out the aspect of paranoia that goes along with information security planning. You can't easily install a malicious backdoor within open source software. We think that will lead to more, not less, open source software providing critical information security functions in corporations. It does not mean that IT security managers need to be programmers, but with open source, they can quickly get an opinion on a possible problem. In fact, those opinions usually find you.

The prevalence of Closed Source software and its accompanying intellectual property rights will be around for some time. If your software codifies a unique business process, you may well want to keep your source code a closely held secret. However, the operating system that provides a foundation for your applications does not hold company secrets and can only be helped by the scrutiny of a mass of programmers. From a security perspective, open source software like Linux has a design philosophy that well suits it to be a serious enterprise player.