🚀 go-pugleaf

Open Source and Linux: 2002 Poster Children for Security Problems

      Issue@Hand

      Open source software, commonly used in many versions of Linux, Unix,
and network routing equipment, is now the major source of elevated security
vulnerabilities for IT buyers. Security advisories for open source and Linux
software accounted for 16 out of the 29 security advisories �� about one of
every two advisories �� published for the first 10 months of 2002 by Cert
(www.cert.org, Computer Emergency Response Team). Keeping pace with Linux
and open source software are traditional Unix-based software products, which
have been affected by 16 of the 29 �� about half of all �� advisories to
date during 2002. During this same time, vulnerabilities affecting Microsoft
products numbered seven, or about one in four of all advisories.

      Aberdeen Perspective

      Obviously, the label of poster child for security glitches moved from
Microsoft to the shoulders of open source and Linux product suppliers during
2002. Other interesting findings from the Cert advisories for 2001 and
Synopsis

            Open source software is now the major source of elevated
security vulnerabilities for information technology (IT) buyers. Security
advisories from Cert for the first 10 months of 2002 show that open source
and Linux software accounted for more than half of all advisories. The
poster child for security glitches is no longer Microsoft; this label now
belongs to open source and Linux software suppliers.
      2002 include:

        a.. Virus and Trojan horse advisories affecting Microsoft products
peaked at six in 2001, which then bottomed out at zero for the first 10
months of 2002.
        b.. Virus and Trojan horse advisories affecting Unix, Linux, and
open source software products went from one in 2001 to two for the first 10
months of 2002.
        c.. Advisories affecting network equipment products jumped from two
in 2001 to six for the first 10 months of 2002.
        d.. Advisories affecting Apple's OS X-based products shot up from
two in 2001 to four for the first 10 months of 2002.
        e.. Firewalls and other security products were affected by just two
advisories in 2001, but have been linked to seven advisories for the first
10 months of 2002.
      In addition to advisories, which are confirmed vulnerabilities, Cert
also tracks incidents. In 1995 the incidents reported by Cert numbered
2,412. However, incidents tracked by Cert skyrocketed from 21,756 in 2000 to
52,658 in 2001, and then to 73,359 for the first nine months of 2002.
Clearly, the trend in incidents and advisories is going up, and at an
alarming rate. Moreover, the data from Cert shows that the poster children
for security problems change year over year.

      Dispelling Some Myths
      Cert's data contravenes some popular myths that are common among the
pundits and the press. Contrary to popular misperception, Microsoft does not
have the worst track record when it comes to security vulnerabilities. Also
contrary to popular wisdom, Unix- and Linux-based systems are just as
vulnerable to viruses, Trojan horses, and worms. Furthermore, Apple's
products are now just as vulnerable, now that it is fielding an operating
system with embedded Internet protocols and Unix utilities. Lastly, the
incorporation of open source software in routers, Web server software,
firewalls, databases, Internet chat software, and security software is
turning most Internet-aware computing devices and applications into possible
infectious carriers.

      Making Forward Progress
      The easy thing to do is to target technology suppliers in the hope
that they will dedicate resources to cleaning up some of the mess. For
example, Microsoft overhauled its entire software development process to fix
its security problems, and its effort appears to be working. Perhaps it is
time for some of the suppliers of open source and Linux software
      to take similar measures. But the entire IT industry must come to
terms with the new reality of Internet computing as the first step in making
forward progress. One of these realities is that no one vendor or supplier
is more at fault than another. Moreover, the scourge of past days, viruses,
has been replaced by active Internet content that worms its way into any
Internet-aware software utilities and services embedded into devices and
applications that connect people to the Internet (see the Aberdeen Group
report, Active eIRM, September 2002).

      The real issues going forward �� among the press, IT buyers, and
consumers alike �� include (1) the need for more rigor in testing for
security glitches among suppliers before software is released, (2) a
recognition that the software viruses of old are being replaced by harmful
active Internet content, and (3) the need for a more active, almost global
security vulnerability notification and response system.

      It will likely take the software vendor community years to fix their
quality assurance procedures, not months. As a result, IT buyers may need to
look to new security currency solutions to automate the process of
discovering and repairing software vulnerabilities.



      Related Research
       Upcoming Research

      Active eIRM (Report, September 2002)   Security Currency (February
2003)

      Identity Management Systems Buyer's Guide (January 2003)

      Author Bios: Jim Hurley, Eric Hemmendinger



To provide us with your feedback on this research, please go to
www.aberdeen.com/feedback.