OPEN SOURCE SECURITY ANALYSIS Evaluating security of Open Source Vs. Closed source operating systems Carlos Serrão, Daniel Neves, Paulo Trezentos UNIDE /ISCTE, Av. Forças Armadas, Edif. ISCTE, 1600-082 Lisbon, Portugal Email: {Carlos.Serrao,Daniel.Neves,Paulo.Trezentos}@adetti.iscte.pt Keywords: Open source, Security, Closed source, DRM, operating systems, Linux, enterprise systems security Abstract: Open source software is becoming a major trend in the software industry. Operating systems (OS), Internet servers and several other software applications are available under this licensing conditions. This article assesses the security of open source technology, namely the Linux OS. Since a growing number of critical enterprise information systems are starting to use Linux OS, this evaluation could be helpful to them. To illustrate the fact that application security depends, above all, on the security of the OS underneath, we present the case of a DRM (Digital Rights Management) solution – MOSESOpenSDRM - implemented on top of the Linux OS, in the scope of the EU MOSES IST RTD programme. Some of conclusions hereby drawn are not compatible with some Microsoft funded studies that point to the fact that open source OS’s are more insecure. This main idea was firstly present by the authors in the Interactive Broadcasting Workshop - IST concertation meeting hosted by the European Commission in September 2002 (Brussels). 1 INTRODUCTION When assessing the security of enterprise systems, one key point should be taken into account: the security dependencies. This is particularly true in desktop client applications where the security depends on the platform hardware security and on the OS where they run on. The analysis exposed in this paper makes some considerations and tries to help answering a question so often discussed: “Are open source operating systems more insecure than the closed source ones?” Security advantages and disadvantages of both systems should also be considered since the question might have different answers depending on the kind of application and existing threats. In the example use case provided here, a DRM (Digital Rights Management) client and a server infra-structure, security is a major issue and its analysis will dictate if it is feasible or not to deploy on open source technology. In the same spirit, other applications are security dependent and need to have strong reasons to backup their choices concerning architecture and operating system decisions. 2 RELATED WORK Many articles have been written about this theme. Some of them, favour the idea of “Security by Obscurity”, and others point to “Security of many eyeballs”, concerning the closed-source perspective in the former statement, and the open-source perspective in the latter one. Closed source advocates the secrecy of source code as a critical security feature. It is based on the notion that secrecy is necessary to hinder intruders and, if a security exploit does occur, keep damage to a minimum (Anderson, 2001). Others defend that the security benefits of open source software stem directly from its openness. Known as the many eyeballs theory, it explains that an operating system or application will be more secure when you can inspect the code, share it with experts and other members of your user community, identify potential problems and create fixes quickly (TrueSecure, 2001). Without the source code, we