Slashdot Mirror

← Back to Stories (view on slashdot.org)

Guardent To Sell Snort And Nessus

Posted by timothy on from the you-shore-got-a-purty-box dept.

Cally writes: "An interesting article appeared on the Info-Sec News list the other day about Guardent's new security appliance. Based on Snort, Nessus and IPTables, Guardent are taking the unusal step of trying to sell a product based on Free software into the highly resistant corporate security market. Although Free/Open security software is widely acknowledged to be better than commercial alternatives, it's rarely been trusted in the enterprise - the article points out that, although the NSA use Free software, the need for an expensive government audit prevents the government from saving money and improving security."

4 of 105 comments (clear)

  1. There's no real reason NOT to use open source by Yakman · · Score: 3, Interesting

    Based on previous security issues in open source it has pretty much become obvious that a major security problem in an open source product is fixed much faster than an equivalent closed source product.

    Also, due to the number of people looking at the code of the open source product there's more chance of those hairy bugs being weeded out, or in the case of the software being used here probably has been given the maturity of the software and the caliber of the kind of people who use it.

    With closed source or hardware based security solutions you might end up getting hacked because the hacker found a hole the vendor didn't know about and you can't even look at the source to try and work out how they did it.

    I'd say the advantages of open source security outweigh the disadvantages, and it's been said time and time again. I doubt it will make a difference with enterprise customers though, they're all in bed with the big companies anyway.

    The major issue for them is probably support, even though i'm sure this company will support their hardware there's still the "stigma" that with OSS you've got no central reliable resource to turn to for support.

    Anyway, enough rantage :)

  2. No audits for closed source ? by alphaque · · Score: 4, Interesting
    although the NSA use Free software, the need for an expensive government audit prevents the government from saving money and improving security.

    I find this statement terribly interesting. This implies that opensource software is more heavily auditted by the US government than closed source software.

    Does anyone else find this ludicrous ?

    One of the basic tenets of opensource software is that its bugs/vulnerabilities are presented for worldwide review. Any holes, trojans or vulnerabilities are caught faster and fixed almost immediately. Eric Raymond's find-fix-release cycle has been pretty much implemented in all active opensource projects. I find it interesting that the government, even if it is the NSA, is suspicious of opensource software, yet will trust the closed source products they buy. Isnt this placing your bets in the wrong basket ?

    I wont got into the benefit of using opensource in detail, for it is bound to be flogged like a dead horse in the ensuing /. discussion below, but surely to suggest increased audit spending on opensource is FUD.

    Additionally, it peeves me a little when everytime opensource is mentioned, the immediate line is drawn to Linux. I think the existence of other top notch operating systems such as FreeBSD, NetBSD and OpenBSD should also play a role in government procurement. The mindshare which Linux has managed to garner in this space is eclipsing decision makers away from proper evaluation and just jumping on to the Linux bandwagon.

    After all, one of the basic tenets of opensource is choice. We dont want the lack of choice we have replaced with another lack of choice in operating systems, Linux only.

  3. rarely been trusted?? by Lumpy · · Score: 3, Interesting

    I loves "experts" that dont know what they are talking about.

    many of the biggest corperations regulary trust open source tools, espically snort and the others for security.

    they dont run around screaming "we use snort! we use snort!"

    I know at the corperation that owns my soul we have a clause in the new computer and security policy that free tools are to be sought out and used before money is spent on software.

    Yes, they dont have a "linux and oss is evil" clause.... even with Microsoft being one of our major "investors".

    --
    Do not look at laser with remaining good eye.
  4. Using OSS in the Managed Services Market by MattW · · Score: 3, Interesting

    I was a longtime sr. security architect at a NSP with security services ranked highly by Gartner. One thing I know from interaction with hundreds of customers is that they are interested in your assurances far more than the products you use. We had occasion from time to time to shift vendors, and the customers did follow. There are plus and minus points to everything. The real market isn't for an appliance, but for services sold month-to-month or year-by-year which implement traditional security methods (firewalling, vuln. analysis, IDS, etc) using free software. Instead of saying, "trust this software", you simply say, "We use best-of-breed tools" and you use YOUR reputation to back them.

    This isn't all that common yet, although nessus is making a lot of headway being used commercially. It will be more common, though, if the OSS alternatives remain ahead of the curve in development (and eventually probably get funding).