Securing Open Source

The dust has not yet settled on the recent discussion in the media on the security worthiness of Open Source Software. In continuation of my assertion that Open Source software can be as secure as one intends to be, I will be making a presentation titled "Securing Open Source" at the DHS Software Assurance Forum at NIST in October. The DHS National Cyber Security Division is the main sponsor of this forum.

What will my presentation talk about? Well, once it is ready I will post it here. In the meantime, I would like to talk about the secure practices we undertake in JBoss development as well as lessons learned during the ongoing Common Criteria Evaluation of JBoss EAP 4.3.

This month, I am moderating a panel as well as chairing sessions at the Oasis Security Forum in London. Stop by if you live in and around London. :)

So what really goes into securing open source? It is mainly the processes followed in the development and maintenance phases of the software. Many a times, open source software is written by enthusiasts and philanthropic developers for whom getting the latest innovation out is of primary importance. In these cases, there certainly is a lack of significance associated to security and maintenance. But these cases do not become the general trend for open source. For Open source projects/products such as Apache Httpd, tomcat, Linux (Red Hat) and JBoss, you have a company(ies) standing behind the success of the project. In these cases, security is dealt with as and when needed. Every security vulnerability is fixed as soon as possible.

Read more here.

Oasis Open Standards Forum in London

At the end of September and beginning of October, OASIS is holding a very important forum in London.
http://events.oasis-open.org/home/forum/2008/about#pc

I am on the Program Management Committee for this forum which has an apt theme "Security Challenges for the Information Society".


-Image source from Oasis Event Page (http://events.oasis-open.org/home/sites/events.oasis-open.org.home/files/images/gebel.jpg)

Gerry Gebel from Burton, an analyst I envy and a good friend (ok, or a person I know) is one of the Keynote speakers.

So if you are going to be in the region around that time, this forum is for you.

I am pretty excited about this forum because it not only covers all the advances in the Federated Identity Space, but also some of my favourite topics such as E-Gov Security, Browsers Security, Healthcare Security, Key Management and Access Control.

Gerry's Bio:
Gerry Gebel, Vice President and Service Director for Burton Group Identity and Privacy Strategies

Gerry covers identity management, federation, entitlement management, user provisioning, authentication technologies, directories, privacy issues, and PKI. Since joining Burton Group in 2000, Gerry has written numerous reports and articles on these topics. Gerry has also been instrumental in advancing the state of identity-based interoperability by leading demonstration projects for federation, entitlement management, and user-centric standards and specifications. Prior to joining Burton Group, Gerry gained experience in architecture, engineering, integration, and production support of mainframe, client sever and distributed systems in the financial services industry since 1986. Gerry was a founding member of Securities Industry Middleware Council (SIMC), a vertical industry organization representing the securities industry to the IT provider community and served as council vice president and Security Focus Group chairman.