|
 |
 |
Comments
Did you read today's front page stories & breaking news?
SYS-CON.TV
|
Security Successful Open Source Security Is Knowing What to Secure
You can't secure what you don't know you have
Aug. 27, 2008 02:23 PM
Imagine the CIO of a consumer bank who thinks he is running 50 Oracle databases, but now finds out that in fact he has 100 databases installed behind his firewall. He doesn't have any idea where the other 50 came from. He doesn't know the name of the vendor(s) supporting them. And he doesn't have anyone on his IT team assigned to managing them. This scenario would be totally unacceptable to anyone.
Spend Small, Think Small In the past, if developers wanted to incorporate third-party code into their applications, a joint development agreement or in-bound licensing contract would be negotiated. The process would have also included a development manager, procurement lead, and a lawyer. Today's software development world is complex and fast-paced. Software engineers are under increasing pressure to deliver large, high-quality applications in less time, with fewer resources. As a result, the use of community-based open source software components has become one of the most dominant trends in software development. To remain competitive, complexity and weighty processes have dropped by the wayside, with many disappearing altogether. In today's world of 24/7 and persistent network access, developers dispersed across multi-national sites can include open source, freeware, public domain, evalware (demos of commercial software), etc., into the code they are writing without triggering the usual checkpoints in the procurement process. Without these controls, the open source software is unlikely to be detected, monitored, and tracked. As a result, IT organizations are unaware of what exactly comprises their code base.
Reader Feedback: Page 1 of 1
SOA World Latest Stories
Subscribe to the World's Most Powerful Newsletters
Subscribe to Our Rss Feeds & Get Your SYS-CON News Live!
|
SYS-CON Featured Whitepapers
Most Read This Week |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
|
| | | | | | | | |
|
|
|
|
|
|
| | | | | | | | | | | | | | | | | | | | | | | | | | |
|
|
| SYS-CON MEDIA: | | | | |
| SYS-CON EVENTS: | | | | | |
| INTERNATIONAL SITES: | | | | | | | | | | |
 |
Terms of Use & Our Privacy Statement  About Newsfeeds / Video Feeds |
| Copyright ©1994-2008 SYS-CON Publications, Inc. All Rights Reserved. All marks are trademarks of SYS-CON Media. |
| Reproduction in whole or in part in any form or medium without express written permission of SYS-CON Publications, Inc. is prohibited. |
.gif)
That CIO would be shocked to hear that a very similar situation is happening today. But it's not undocumented databases that will surprise him. It is undocumented open source software embedded inside externally facing web and software applications.
In a surprise move on Tuesday, January 10, Oracle wheeled out its Big Data Appliance.
That’s the one it said in October would be ready sometime in the first half. Only nobody believed it meant early in the first half. Heck, it’s not even clear anybody thought Oracle could make the fi...
A Munich court Thursday found Motorola Mobility guilty of infringing an Apple patent and handed Apple a permanent injunction against two Android smartphones.
Apple can enforce the injunction after posting a bond lest MMI succeed in invalidating the slide-to-unlock patent (EP1964022) ...
Quick Response (QR) codes are intended to help direct users quickly and easily to information about products and services, but they are also starting to be used for social engineering exploits. This article looks at the emergence of QR scan scams and the rising concern for users today....
The Chinese company that claims it owns the iPad trademark says it plans to seek a ban on iPad exports out of China, threatening global supplies.
According to what a lawyer for Proview Technology (Shenzhen) Co Ltd told Reuters, the firm is petitioning Chinese customs to stop shipment...
Cisco Wednesday filed suit in the European Union’s second-highest court, the General Court in Luxembourg, challenging the European Commission’s rubber stamp last October of Microsoft’s $8.5 billion acquisition of Skype.
Cisco says it isn’t opposed to the merger, but figures the EC sh...
2011 was a year of rapid adoption for public and private cloud services. Instant and on-demand server provisioning was the driving force behind the massive growth. On top, cloud server templates and script automation simplified application installation for simple and pre-defined applic...
