Assessing the importance of open-source software development from a cyber-security perspective

点击翻译按钮获取中文摘要

From a cyber-security perspective, closed-source software development projects are seen assomewhat more concerning than projects that publish their source-code (in other words, open-sourceprojects). This is primarily due to the major advantages that open-source software can provide froma security perspective. Having access to the codebase as a member of the public allows the contentsof the software to be verified. Bugs and vulnerabilities can easily be identified, and patches can besuggested to the developers of the software, thereby preventing their use under maliciouscircumstances. Closed-source software cannot provide the same advantages, as members of thepublic are not able to examine the source-code and suggest changes. Also, if a malicious user were toidentify a vulnerability, they may be able to use it to their advantage for a significant amount of timebefore being detected (and in some cases, may never be detected at all). Weiss and Bailetti [1] arguethis point further, stating that the use and development of open-source solutions can help to ensurethat the knowledge of any vulnerabilities are shared between different organisations, preventingfurther incidents.My project would firstly involve attempting to further prove this concept, by showing that variousclosed-source software solutions and implementations do, in fact, contain features that were notnecessarily advertised by their developers (which in some cases may be vulnerabilities themselves, orlead to the discovery of vulnerabilities). I believe that it would be valuable to show this in manydifferent scenarios, so an attempt would be made to carry out this work on a more modern system toshow that this is still a current issue, as well as an older system to prove that the problem has existedfor quite a while. In short, the project's primary aim would be to determine the main advantages ofopen-source software from a cyber-security perspective.