Open Source Software Security Research Articles

On business adoption and use of reproducible builds for open and closed source software

Reproducible builds (R-Bs) are software engineering practices that reliably create bit-for-bit identical binary executable files from specified source code. R-Bs are applied in some open source software (OSS) projects and distributions to allow verification that the distributed binary has been built from the released source code. The use of R-Bs has been advocated in software maintenance and R-Bs are applied in the development of some OSS security applications. Nonetheless, industry application of R-Bs appears limited, and we seek to understand whether awareness is low or if significant technical and business reasons prevent wider adoption. Through interviews with software practitioners and business managers, this study explores the utility of applying R-Bs in businesses in the primary and secondary software sectors and the business and technical reasons supporting their adoption. We find businesses use R-Bs in the safety-critical and security domains, and R-Bs are valuable for traceability and support collaborative software development. We also found that R-Bs are valued as engineering processes and are seen as a badge of software quality, but without a tangible value proposition. There are good engineering reasons to use R-Bs in industrial software development, and the principle of establishing correspondence between source code and binary offers opportunities for the development of further applications.

A Theoretical Framework for Enhancing Open-Source Software Security

Cyber security is a rapidly developing field and open-source software (OSS) is being led by a collaborative community and a transparent nature. This research intends to make a theoretical framework highlighting the symbiosis of community engagement models, governance models, and the security of open-source ecosystems. The significant purposes aim to investigate how community engagement affects open source software development, analyze the deployment of the governance systems in widely used open source projects, and create the theoretical model that brings the cybersecurity processes in those practices. The literature survey covers existing research on open-source software development, community engagement, governance models, and cybersecurity practices within the OSS ecosystem. Through literature review the basic concepts are investigated using conceptual analysis to determine which principles and mechanisms the Community Model Engagement and Governance models operate, influencing the security of Open Source Software. Open-source project policy recommendations are the foundation for the security of communities where members fully contribute to better governance. This includes developing a fundamental conceptual analysis to lay out the framework's principles and operation (mechanisms). This contributes to the overall development of the theoretical framework. This research expects to develop a standardized theoretical framework that tackles the community engagement-governance models-security software link from new and insightful perspectives. Practical policy recommendations to protect OSS projects will be presented to solve the cybersecurity problem easily and immediately. This study aims to add to the academic and practical discussions that focus on human and organizational components' critical roles in securing open-source software. The discussion of theoretical aspects gives this platform a unique angle that fits well into the technical approach while improving the understanding of a legally open cybersecurity community

Software Reliability Prediction of Open Source Software Using Soft Computing Technique

Background: In software development, reliability performs a significant role. It is the nonfunctional requirement of the software. Before using the Open Source Software (OSS) for software development, it is essential to check the quality of the open source software. It is challenging to identify that which OSS is suitable for development of software. Conventional software reliability prediction models are suitable for the Commercial Off The Shelf (COTS) software but it is not sufficient to predict the software reliability of open source software as it has some extra features such as source code is freely available and it is modifiable also. Methods: Most of the researchers have given the mathematical model based on crisp set theory to estimate the reliability of software. Proposed methodology does not rely upon a scientific/mathematical model. In this approach, fuzzy logic based soft computing approach has been used to analyze the reliability of OSS. The goal of this paper is to propose a fuzzy logic soft computing technique based model using three reliability metrics for estimating the security of open source software. Results: The software reliability model is tested on few software applications, and the outcomes affirm the productivity of the model. Conclusion: In order to assess open source software reliability a fuzzy logic based soft computing technique has been proposed.

Open source software security vulnerability detection based on dynamic behavior features.

Open source software has been widely used in various industries due to its openness and flexibility, but it also brings potential security problems. Therefore, security analysis is required before using open source software. The current mainstream open source software vulnerability analysis technology is based on source code, and there are problems such as false positives, false negatives and restatements. In order to solve the problems, based on the further study of behavior feature extraction and vulnerability detection technology, a method of using dynamic behavior features to detect open source software vulnerabilities is proposed. Firstly, the relationship between open source software vulnerability and API call sequence is studied. Then, the behavioral risk vulnerability database of open source software is proposed as a support for vulnerability detection. In addition, the CNN-IndRNN classification model is constructed by improving the Independently Recurrent Neural Net-work (IndRNN) algorithm and applies to open source software security vulnerability detection. The experimental results verify the effectiveness of the proposed open source software security vulnerability detection method based on dynamic behavior features.

ON THE SECURITY OF OPEN SOURCE SOFTWARE.

30Nov 2017 ON THE SECURITY OF OPEN SOURCE SOFTWARE. Prattay Sanyal , Shubham Sharma , Deepa Bura and Prasenjit Banerjee. Department of Computer Science and Engineering, ManavRachna International University, Faridabad, India. Department of Computer Science, Accendere Knowledge Management System Pvt. Ltd., New Delhi, India.

오픈 소스의 소프트웨어 보안 문제 및 시큐어 코딩 적용방안

오픈 소스의 소프트웨어 보안 문제 및 시큐어 코딩 적용방안

Open source software: determining the real risk posed by vulnerabilities

Open source software (OSS) still has a little trouble in shrugging off its ‘alternative’ image and that could be making many organisations vulnerable. The fact is that, far from being the concern only of sandal-wearing digital activists, OSS underpins a high proportion of most corporate software development. And, as Chris Fearon, head of Black Duck Software's Open Source Security Research Group, points out in this interview, if organisations don't take OSS security seriously, they could be making the task of an attacker easier. Open source software (OSS) still has a little trouble in shrugging off its ‘alternative’ image and that could be making many organisations vulnerable. The fact is that OSS underpins a high proportion of much corporate software development. And as Chris Fearon of Black Duck Software's Open Source Security Research Group points out in this interview, if organisations don't take OSS security seriously they could be making the task of an attacker easier.

Comparison of open source maturity models

Component based development was formerly dependent on propriety/closed source software’s (CSS) components. Open Source software components has attracted noteworthy attention and become an operational alternative of proprietary software because of OSS security, cost effectiveness, quality, flexibility and freedom. Due to the increased attention on component-based development in the past decades, companies have widely adopted open source software (OSS), with the view that using the right software is critical to project success. The availability of Internet as a marketplace for components and wide adoption of OSS has introduced new challenges for selection of software components. Source Forge, other general and domain specific software repositories, different software foundations and individual OSS providers offer an abundance of OSS components. Identification, evaluation and selection of best possible OSS Components for the required need is a quite challenging job. As a reaction to these challenges different methods have been proposed for OSS maturity measurements. E.g. Capgemini-Open Source Maturity Model(C-OSSM), Navicasoft-Open Source Maturity Model (N-OSSM), Qualification and Selection of Open Source (QSOS), Open Business Readiness Rating (Open BRR) and Easiest Open Source (E-OSS).In this paper we compare different Open Source software maturity models available in the market that will help user in OSS component selection.

Migrating from Closed Source Software to OSS–Security Issues and Challenges

Open source software (OSS) allows users and developers to, amongst others, study, modify and redistribute the source code. At the other end of the spectrum, closed source software (CSS – the antonym of OSS) disallows users and developers to access and modify any source code. This paper presents an overview of the migration from closed source systems (CSS) to open source systems (OSS) with respect to Security Issues and Challenges. The paper proposes a Model to address such challenges. The various OSS initiatives undergone by different national governments are highlighted. A comparison of OSS security and CSS security aspects, and an overview of security challenges during migrations to OSS are presented. On the strength of these comparisons, and using summative content analysis, a model to address security challenges during migrations to OSS is proposed. The model is developed through enhancements of previous models aimed at addressing security threats and protecting sensitive information during system migrations.

Open source = open invitation?

This paper finds that ongoing questions about the security of open source software may be unfounded, but users require better proof and assurance.

Open source: does transparency lead to security?

A recent report criticising the security of open source software, and a flame war among Linux developers, have cast some doubts on whether open source software can achieve a sufficiently high level of security. Yet others believe that the principles of transparency and community involvement actually contribute to higher levels of software quality, including security, than can be achieved in the closed world of proprietary software. It's an important issue as open source projects continue their inroads into mainstream, enterprise solutions. Steve Mansfield-Devine examines the arguments and touches on the efforts being made to develop best practices, methodologies and tools to ensure security in open source software. Debates about open source software quickly develop a religious dimension. And nothing is more likely to set off an argument of inquisitional proportions than accusations of shortcomings in an area as important as security. Two recent events highlighted the issue of the security of open source software (OSS): one was a report claiming that open source developers are failing to achieve the necessary standards. The other was a suggestion that Linux kernel developers may have tried to cover up security vulnerabilities. However, when it comes to ensuring the quality of software from a security standpoint, is there really any difference between open source and closed source?

On the security of open source software

Abstract With the rising popularity of so‐called ‘open source’ software there has been increasing interest in both its various benefits and disadvantages. In particular, despite its prominent use in providing many aspects of the Internet's basic infrastructure, many still question the suitability of such software for the commerce‐oriented Internet of the future. This paper evaluates the suitability of open source software with respect to one of the key attributes that tomorrow's Internet will require, namely security. It seeks to present a variety of arguments that have been made, both for and against open source security and analyses in relation to empirical evidence of system security from a previous study. The results represent preliminary quantitative evidence concerning the security issues surrounding the use and development of open source software, in particular relative to traditional proprietary software.

Guest Editorial Open source software: investigating the software engineering, psychosocial and economic issues

Guest Editorial Open source software: investigating the software engineering, psychosocial and economic issues