FOSS Security – What, Why and How
Deepak Pandey
Typical Organization Structure – The Expectations
Development Team
Operations Team
Security Team
Want Flexibility to use new tech stacks and libraries on the go
Want Stability to ensure business is not impacted regardless of development issues or security issues
Want Security at every step of development lifecycle to protect enterprise and customers
84% of Open Source code bases containing at least one vulnerability
Free and Open Source Software (FOSS) Security
FOSS refers to software that is both free to use and open for anyone to view, modify and distribute. Broadly FOSS has 2 risks – Licensing and Security
Typical FOSS Categories | Relevant Examples | License Risks | Security Risks |
Operating Systems | Linux, FreeBSD | Compliance with GPL and other licenses is critical. | Security vulnerabilities can affect system integrity. |
Web Browsers | Mozilla Firefox, Chromium | Compliance with open-source licenses is essential. | Browser vulnerabilities may lead to data breaches. |
Office Suites | LibreOffice, OpenOffice | Ensure proper attribution and compliance with GPL. | Malicious macros and document exploits can be risks. |
Programming Languages and Development Tools | Python, GCC | License compliance is necessary for code usage. | Code vulnerabilities can be exploited for attacks. |
Content Management Systems (CMS) | WordPress, Joomla! | Plugin and theme licenses may vary; check them. | Vulnerable plugins or themes can be entry points. |
Database Systems | MySQL, PostgreSQL | Licensing variations in different DBMSs, be aware. | Database breaches due to misconfigurations or flaws. |
Graphics and Design | GIMP, Inkscape | Ensure compliance with licenses for image assets. | Malware hidden in graphics files can be a threat. |
Server Software | Apache HTTP Server, Nginx | Be aware of module-specific licenses in Apache. | Server misconfigurations may lead to vulnerabilities. |
Content Management and E-commerce | Drupal, Magento | Check licenses for third-party plugins and themes. | E-commerce platforms may be targeted for attacks. |
Virtualization | VirtualBox, QEMU | Review licenses, especially for proprietary features. | Vulnerabilities can lead to VM escape or data loss. |
Security | Wireshark, OpenSSH | Ensure license compliance for any bundled components. | Vulnerabilities can expose sensitive network data. |
FOSS Risks | Description |
Security Risks | |
- Vulnerabilities | FOSS can contain security vulnerabilities that, if not patched, can be exploited by attackers. |
- Lack of Timely Updates | Some FOSS projects may lack dedicated support teams, resulting in slower responses to security issues. |
Compliance Risks | |
- License Violations | Failure to comply with FOSS licenses (e.g., GPL, Apache) can lead to legal and financial risks. |
- Unclear Licensing | Understanding the licensing terms of all FOSS components used can be challenging, leading to legal issues. |
Quality Risks | |
- Inadequate Documentation | FOSS projects may have incomplete or outdated documentation, making implementation and troubleshooting difficult. |
- Instability | Some FOSS projects may be less stable or feature-rich than their proprietary counterparts. |
Dependency Risks | |
- Dependency Chains | FOSS often relies on other FOSS components; issues in one component can affect the entire stack. |
- Abandoned Projects | Abandoned FOSS projects can leave users with unsupported and potentially insecure software. |
Integration Risks | |
- Compatibility Issues | FOSS may not seamlessly integrate with proprietary software or existing infrastructure, causing compatibility problems. |
- Costs of Integration | Integrating FOSS into existing systems can be costlier than anticipated if customizations and support are required. |
Community and Resources | |
- Resource Limitations | Smaller FOSS projects may have limited resources for development, support, and security maintenance. |
- Community Dynamics | Community-driven projects can be subject to conflicts or changes in direction affecting stability and direction. |
Vendor Risks | |
- Vendor Reliability | Obtaining FOSS from commercial vendors can result in vendor lock-in, unreliable support, or changes in licensing/business models. |
Continuity Risks | |
- Dependence on Individuals | FOSS projects often rely on key individuals; their departure or loss of interest can jeopardize project continuity. |
- Project Forks | Conflicts within the FOSS community can lead to project forks, causing uncertainty about which fork to follow. |
Variety of FOSS Risks
Too Much Theory – Give me a meme now!
Image Source: https://xkcd.com/2347/
FOSS Category | Relevant Examples | Tool to Review License Risks | Tool to Review Security Risks |
Operating Systems | Linux, FreeBSD | FOSSology, ScanCode | Lynis, OpenVAS, Nessus, ClamAV |
Web Browsers | Mozilla Firefox, Chromium | FOSSology SPDX ScanCode | OWASP ZAP, Nikto, Vega, W3af, WebScarab |
Office Suites | LibreOffice, OpenOffice | None (security assessment typically at the OS level) | |
Programming Languages and Development Tools | Python, GCC | Static Analysis Tools (e.g., SonarQube, HCL AppScan CodeSweep), Dynamic Analysis Tools (e.g., Burp Suite) | |
Content Management Systems (CMS) | WordPress, Joomla! | Security plugins/modules for specific CMS (e.g., Wordfence for WordPress) | |
Database Systems | MySQL, PostgreSQL | Nessus, OpenVAS, SQLMap, DBScan | |
Graphics and Design | GIMP, Inkscape | None (security assessment typically at the OS level) | |
Server Software | Apache HTTP Server, Nginx | Nessus, OpenVAS, Lynis, Nikto, Nmap | |
Content Management and E-commerce | Drupal, Magento | Security plugins/modules for specific CMS or e-commerce platform (e.g., Drupal Security) | |
Virtualization | VirtualBox, QEMU | Nessus, OpenVAS, Lynis, Nmap, OWASP Amass | |
Security | Snort, Wireshark, OpenSSH | Nessus, OpenVAS, Lynis, Wireshark |
How To Assess?
Too many tools, too little time!
FOSS Maturity Model – where are you now?
Maturity Level | Description |
Level 0 | No FOSS Policy: We consume FOSS but do not understand risks |
Level 1 | Ad Hoc: We use FOSS and understand the risks but do not always review our FOSS |
Level 2 | Defined: We use FOSS, know the risks and review the risks continuously |
Level 3 | Leader: We are Level 2 as well as encourage our developers to mandatorily contribute and support them on FOSS projects |
Major Takeaways
Questions