Guardent To Sell Snort And Nessus

Cally writes: "An interesting article appeared on the Info-Sec News list the other day about Guardent's new security appliance. Based on Snort, Nessus and IPTables, Guardent are taking the unusal step of trying to sell a product based on Free software into the highly resistant corporate security market. Although Free/Open security software is widely acknowledged to be better than commercial alternatives, it's rarely been trusted in the enterprise - the article points out that, although the NSA use Free software, the need for an expensive government audit prevents the government from saving money and improving security."

Comments

There's no real reason NOT to use open source

[Yakman]

Based on previous security issues in open source it has pretty much become obvious that a major security problem in an open source product is fixed much faster than an equivalent closed source product.

Also, due to the number of people looking at the code of the open source product there's more chance of those hairy bugs being weeded out, or in the case of the software being used here probably has been given the maturity of the software and the caliber of the kind of people who use it.

With closed source or hardware based security solutions you might end up getting hacked because the hacker found a hole the vendor didn't know about and you can't even look at the source to try and work out how they did it.

I'd say the advantages of open source security outweigh the disadvantages, and it's been said time and time again. I doubt it will make a difference with enterprise customers though, they're all in bed with the big companies anyway.

The major issue for them is probably support, even though i'm sure this company will support their hardware there's still the "stigma" that with OSS you've got no central reliable resource to turn to for support.

Anyway, enough rantage :)

Re:FreeBSD network Stack

[Jeremiah Cornelius]

It's not quite right to refer to the Windows IP stack as FreeBSD.

Like almost every IP implementation, the one in Win32 is heavily based on the Berkeley Net4 code. This is hardly surprising. The Berkeley implementation was TCP/IP - long before ther were others. Large blocks of the original Berkeley Net code appear to be copied unmodified in the NT/2000/XP system. This is probably true of AIX, Solaris, etc...

This is a feature of the Berkeley licence.

Contributions?

[illusion_2K]

It would be nice to know that Guardent is contributing to the respective projects that are being implemented on this device (IPTables, Snort, Nessus), but I haven't been able to find any ackknowledgement of it on either Nessus's thanks page or in the credits for Snort.

Certainly they've got people working for them who have the know-how to add substancial features to the projects and it would be nice to know that they're not just freeriding on the software for the managed services platform that this device really is.

why linux as a platform? (import post.not_a_troll)

[Anonymous Coward]

OpenBSD has several advantages over Linux for this application:

• More cohesive codebase, tighter integrated security audits. (==more secure foundation to work from)
• Better firewall and nat features, syntax.
• BSD-licensed foundation, so no hassles if you're using it in a product.
• Cooler logo. ;-)

And of course, since the OpenBSD community has a lot of paranoid ... oops, er ... "security aware" people in it, all the security tools you could ever want are either native or seamlessly ported.

Quite frankly, seeing someone selling a security solution based on open source software and finding out the OS isn't OpenBSD is like finding your cousin Larry using an egg beater to polish his car's paint... You know they must have some reason, but damn if it has any obvious logic to it...

(Linux has it's own place. I use it a lot for developing and deploying java applications, also it's a better DB platform than obsd becuase it has SMP support. Right tool, right job. For security, obsd is the right tool.)

Not as uncommon as you might think...

[kcbrown]

...though the open source roots of many products are not likely to be widely known.

There are probably countless "hardware" boxes that use FreeBSD or some other BSD derivative as a base. The company takes that base and adds their own code to do whatever it is that would be unique to the box, then sells the result as a hardware solution. The box itself might have a lot of proprietary hardware in it, or it might not. That'll just depend on the box.

But either way, open source probably powers a lot more of the hardware (routers, proxies, firewalls, etc.) than the average PHB would expect.

Spouting

[1984]

"Although Free/Open security software is widely acknowledged to be better than commercial alternatives..."

I'm sure this point will rapidly become a chorus in this thread, but that sentence is pointless fluff.

Open source means you can could inspect the source. Iff you choose to expertly inspect the source you may come to understand the security parameters of the application. You'll know how it works, and a lot of what it depends on in terms of libraries, OS calls etc. And you can evaluate on those terms whether it provides an adequate level of security for the environment in which you intend to use it.

If you haven't audited the code, all you know is that the code is auditable. You know nothing about the security of the system.

Most of us here haven't performed any of these steps on systems like OpenSSH, for instance. Instead we rely on two things: that someone else has peformed a competent, honest audit; that so many people use it that if it had problems we'd all know (surely). Both of those are flimsy, when you come right down to it.

Open source only means you could audit it if you wanted to. It doesn't make it any more or less secure than anything else.

No audits for closed source ?

[alphaque]

although the NSA use Free software, the need for an expensive government audit prevents the government from saving money and improving security.

I find this statement terribly interesting. This implies that opensource software is more heavily auditted by the US government than closed source software.

Does anyone else find this ludicrous ?

One of the basic tenets of opensource software is that its bugs/vulnerabilities are presented for worldwide review. Any holes, trojans or vulnerabilities are caught faster and fixed almost immediately. Eric Raymond's find-fix-release cycle has been pretty much implemented in all active opensource projects. I find it interesting that the government, even if it is the NSA, is suspicious of opensource software, yet will trust the closed source products they buy. Isnt this placing your bets in the wrong basket ?

I wont got into the benefit of using opensource in detail, for it is bound to be flogged like a dead horse in the ensuing /. discussion below, but surely to suggest increased audit spending on opensource is FUD.

Additionally, it peeves me a little when everytime opensource is mentioned, the immediate line is drawn to Linux. I think the existence of other top notch operating systems such as FreeBSD, NetBSD and OpenBSD should also play a role in government procurement. The mindshare which Linux has managed to garner in this space is eclipsing decision makers away from proper evaluation and just jumping on to the Linux bandwagon.

After all, one of the basic tenets of opensource is choice. We dont want the lack of choice we have replaced with another lack of choice in operating systems, Linux only.

Re:No audits for closed source ?

[TeeWee]

I find this statement terribly interesting. This implies that opensource software is more heavily auditted by the US government than closed source software.

Does anyone else find this ludicrous ?

This is actually quite sensible. Someone has to pay for the audits. In commercial applications, it will be the vendor.

But with OSS, it isn't clear who is the one responsible for the audits. And it isn't clear which version will be audited (with a theoretically possible fix made every minute). So, it will probably have to be the version to be implemented. Since there is no clear responsible party who can fund the audit, it will have to be the customer.

So in that sense, it is the customer who winds up for the cost of the audit directly, while with commercial products, it will be the vendor who winds up for the cost (and calculates that back into the price of the product).

In one sense, the customer paying for it is preferable, since they can now see how the money is being spent, on the other hand, having the customer pay for it prevents the spreading of the cost. In commercial products, every customer pays for a part of the costs, in OSS, every customer has to pay for the complete audit again unless the results are frozen.

Re:No audits for closed source ?

[Spunk]

although the NSA use Free software, the need for an expensive government audit prevents the government from saving money and improving security.

I find this statement terribly interesting. This implies that opensource software is more heavily auditted by the US government than closed source software.

I'm not sure where the quote is from, so I can't put it in context, but the NSA certainly does audit closed-source software. I think it's more likely the statement is saying that it is irrelevent whether they go with a $500 product or a $0 product; the audit costs far outweigh either.

Change "Free Software" above to "new product" and it makes more sense. Anything new has to be sufficiently better to justify the audit cost.

Giving back to the community

[Radium_]

I hope that, if they make profit using these free softwares, they give some money back to the developers. I know that Renaud Deraison, one of the Nessus core developers, is tired of seing derivatives of his product sold by many companies which *never* give anything (bug reports, patches, plugins, money) back.

Hell, free software needs financial *and* technical support from those who use it. Or you won't be able to use it very long.

Re:Giving back to the community

[Anonymous Coward]

This may be crazy, but if you don't want people doing bad thing X with the code you produce, don't use a license that explicitly permits them to do X.

rarely been trusted??

[Lumpy]

I loves "experts" that dont know what they are talking about.

many of the biggest corperations regulary trust open source tools, espically snort and the others for security.

they dont run around screaming "we use snort! we use snort!"

I know at the corperation that owns my soul we have a clause in the new computer and security policy that free tools are to be sought out and used before money is spent on software.

Yes, they dont have a "linux and oss is evil" clause.... even with Microsoft being one of our major "investors".

Nothing new

[klaun]

SecureWorks has been selling their iSensor product for some time now. It is also based on OpenSource Software using Snort and IPChains. The product comes with monitoring and constant signature updates for the IDS functionality, so that could be seen as the "value-add" for buying what is basically a bunch of free software in a PC box.

Re:why linux as a platform? (import post.not_a_tro

[Zapman]

OpenBSD has a fantastic reputation for security. However, there are several side notes that probably pushed linux over the top.

1) LIDS. If they're using a 2.4 kernel, they can do LOTS of nice security things, like striping root of lots of it's dangerous abilities. Less danger if root is cracked. I don't know if LIDS is in use, but it probably should be.

2) Your 'better firewall and nat features, syntax' is highly debatable. As somone else pointed out, IPTables stateful inspection is far ahead of either ipfilter or pf. And your syntax comment is nothing more than a personal preference.

3) I don't like this reason much, but 'Linux' is much more widely recognised in the business world than 'OpenBSD'. When you come down to it, you have to be able to market this thing. Is this the way it should be? No. But it is, and we have to deal with it.

Using OSS in the Managed Services Market

[MattW]

I was a longtime sr. security architect at a NSP with security services ranked highly by Gartner. One thing I know from interaction with hundreds of customers is that they are interested in your assurances far more than the products you use. We had occasion from time to time to shift vendors, and the customers did follow. There are plus and minus points to everything. The real market isn't for an appliance, but for services sold month-to-month or year-by-year which implement traditional security methods (firewalling, vuln. analysis, IDS, etc) using free software. Instead of saying, "trust this software", you simply say, "We use best-of-breed tools" and you use YOUR reputation to back them.

This isn't all that common yet, although nessus is making a lot of headway being used commercially. It will be more common, though, if the OSS alternatives remain ahead of the curve in development (and eventually probably get funding).