Page 2 of 2

Sometimes tools aren't enough

West argued that sometimes tools alone are not enough and that the projects need to take it on themselves to fix issues and to bake security in as part of the development process methodology.

"The main message coming from the report is around the lack of process and the need for building security in," West said.

In West's view, on the commercial proprietary side large organizations have begun to adopt secure development processes and they do things like risk assessment up front and really make security key at every step of development.

"All the evidence we've seen on the open source side is that that revolution hasn't begun yet for open source security," West said.

West then noted there are exceptions. For example, he cited a new effort from Mozilla with its Security Metrics tracking of how effective Mozilla's security is overall. But he also noted it's not a new secure development effort from a pure coding perspective.

"The first step they have taken is to evaluate their security that's true," West admitted. "Making that available publicly and doing it in a fairly visible way is a really good first step."

LATEST NEWS

UCSD Plans First Flash-Based Supercomputer
Digging Into N.Y.'s Antitrust Suit Against Intel
Analyst: Sony-Ericsson's Android Bid Is Late
Coupon Site Targets Black Friday, Cyber Monday
Microsoft Sites Up Big in Time Spent Online

Overall West noted that a secure development process don't necessarily fit in any one particular place within a development cycle. There are however critical areas that Fortify has identified in its report that are key, among them is the need to cultivate human expertise around security.

"In particular Microsoft blazed this path of having a security lead someone who is within the development organization and whose primary responsibility is security and that's critical," West argued. "That's not happening in open source projects today."

Additionally West commented that security needs to be built into the development process using threat modeling and code review technology.

Other studies in the past from vendors like Coverity have shown open source software to have fewer defects than proprietary alternatives. Coverity which also does source code analysis was also the recipient of a Department of Homeland Security (DHS) grant in which the overall bug count of 250 open source projects were reduced. Outside of the DHS grant, Mozilla has also been a Coverity customer since 2006 to reduce software defects in the Firefox code base.

Fortify's West did not debate that other efforts at open source code analysis exist however he argued that overall there needs to be more of a commitment from open source developers for secure development processes.

"The real goal here is to raise awareness both within the enterprise community that is leveraging open source and the developers themselves," West said. "I feel strongly that we have gone about this in a responsible way and we are not calling attention to specific deficiencies in specific projects. I can't predict what the open source community will say about this report but we're making our best effort to improve the situation through calling attention to it and actively contributing to it through Java Open Review."

Go to page: Prev  1  2