Is Open Source Software Really more Secure?
The constant stream of Windows vulnerability attacks result not solely due to security holes in the Operating System, but also because of the ubiquity of Windows as both a client and server operating system makes it a prime target for any malicious intent. While open source zealots declare Linux to be inherently more secure by virtue of its communal development process, Linux has yet to attain the level of success of Windows and thereby remains a lesser target to hackers, making such claims difficult to quantify fairly.
Linux market share is rapidly growing, and some claim that the operating system may become scrutinized more closely for vulnerabilities, creating the possibility of more attacks as it becomes more attractive to hackers. However, this scrutiny certainly has a benign effect, as well. Turnaround times for patches in Linux and other popular Open Source offerings have traditionally been very rapid, which allows proactive organizations and individuals to more quickly reap the benefits of a strong patch management strategy.
The security of open source software has been both idealized and made the subject of targeted disinformation.
Generally, two philosophies exist:
that open source is more secure because it is more rigorously reviewed;
and, that proprietary software is more secure because access to the source code is limited.
While seeming contradictory, both schools of thought have validity depending on circumstances. Open source philosophy states that open source software cannot rely on obscurity for security — because the source code is transparent, security
must be implemented well at the source code level. Also, open collaboration is thought to result in the earlier discovery and correction of security flaws—an aspect of the thesis that “given enough eyeballs, all bugs are shallow.”
Even the most ardent open source believers would say that neither of these two claims actually guarantees the security of all open source code. As Gartner analyst John Pescatore states,
“…just releasing source code on the Internet doesn’t mean that the software is more secure, and it often can result in less-secure software.”
Having enough eyeballs reviewing the code depends on the open source project having a strong community, with many sharp individuals contributing to reviewing the source code. Projects such as OpenSSL, Apache and the Linux kernel itself enjoy such large communities, and consequently have excellent security records. Lesser-known projects for which community enthusiasm is spare may not deliver the same level of security.
Overall, two factors generally assure a greater capability to be more security-hardened than proprietary software: broad community involvement and trusted certifications or evaluations, such as Common Criteria.
Conversely, in open source projects for which community enthusiasm has yet to build, proprietary software may be more
secure, as well as have a richer feature set. For this reason, it is recommended that one blend open source software with proprietary offerings to adequately meet an organization’s or an individual’s desired security requirements.
For more information check out “The Benefits of Open Source,” a short excerpt from Unix System Security Tools, at:
http://www.albion.com/security/intro-7.html.