How to Choose Between Closed-Source and Open-Source Software
Jamie Boote explains the open source vs. closed source debate and summarizes some different open-source and closed-source software.
Learn
more about how DevOps
teams must adopt a more agile development process, working in
parallel instead of waiting on other teams to finish their components or for
resources to become available, brought to you in partnership with CA Technologies.
“I
suppose it is tempting, if the only tool you have Is a hammer, to treat
everything as if it were a nail.” – Abraham Maslow
When it comes to commercial and open source
tools (i.e., paid and free software) the debate as to which category of
software is better continues, leaving egos, careers, and forums in ruins. I
personally think that it’s impossible to definitively prove that one class of
software is the best for every situation. The best source code scanning tool in
the world may not do a thing for you if it doesn’t run against your code.
The Open Source vs. Closed Source Debate
Compared to the “openness” of open-source
software, closed-source software’s proprietary nature is scary. Its source code
is closed and unknowable. It is also controlled by entities that have the
potential for evil (or, if not particularly evil, they might disappear and
leave their users in a permanently unsupported state). Proprietary software may
have price tags that put it out of reach of your firm’s security budget. Finally,
if something goes wrong, relying on proprietary support can make or break
security operations.
Believe it or not, despite how free it is to
procure open-source software or join community forums, there are costs
associated with using open-source software. When bringing un-vetted software
into your environment, it should be checked over and scanned. If you aren’t
paying for a support contract with the open-source software’s development team,
developers are left to rely on community support and internal know-how to keep
a piece of open source software working.
These technical
debts aren’t as large as the proponents of
commercial closed-source software would have you believe. However, they
aren’t as non-existent as the open source advocates promote either. Factor
these concerns into the decision to pick a piece of software, but don’t let the
support or vetting piece sway you away from a tool that is a better overall
fit.
Outgrowing Maslow’s Hammer
Let’s take a step back from software for a
moment and reflect on the fact that I have eight different hammers in my
toolbox. Now, I’m sure that some folks use a wrench to hang pictures. For me,
each hammer serves a different purpose and not all of them include driving
nails. My demolition hammer knocks holes into existing structures. Meanwhile,
my mallet knocks things into place. Then again, my ball peen hammer helps me
out when I’m working with metal. Just like my physical toolbox, my security
toolbox has a variety of tools that may all look alike at first glance but
actually serve very different purposes.
Identifying, remediating, and even preventing
vulnerabilities should be the goal of any security team. If your security
toolbox only contains open-source or only-closed source software, you may be
ill-equipped for the job at hand. Let’s look at some different tools so that
you don’t have to treat everything like a nail.
1. Fortify Source Code Analyzer
Hewlett
Packard’s Fortify Source Code Analyzer (SCA) was one of the first
automated code scanners that did more than search for instances of strcpy() in
code. It can scan 30+ languages and works well for organizations with a diverse
development environment and a large number of applications in development. This
monster of an application scanner works best when scanning as part of a regular
scripted build.
While it can be run from developer
workstations, the amount of time and hardware required to scan code can make it
more of a hindrance to individuals. The reports that come out of periodic scans
can be uploaded to a team collaboration server for further analysis and
resolution. The built-in GUI is based off of Eclipse and offers many of the
features developers are used to when tracing data and calls.
This is a high-powered tool that can analyze
a variety of programming languages and frameworks, but it also comes with a
high-powered price tag.
- Price: $$$
- Target audience: Enterprises and teams
- Target languages: C, C++, Java, JSP, .NET, ASP.NET, classic Active Server Pages (ASP), ColdFusion, PHP, Visual Basic 6, VBScript, JavaScript, PL/SQL, T-SQL, Python, Objective-C, COBOL
- Ideal runtime: Nightly and weekly builds on a build server
2. IBM Rational Appscan Source
IBM’s answer to Fortify’s SCA is another
enterprise-level tool that is part of a suite of security testing tools. This
tool is also best run as part of a build process where results combine with
previous scans. This allows for the assignment of new vulnerabilities to
developers. The results of the scans are the same, but Appscan Source‘s GUI doesn’t offer
the same amount of developer-friendly tools. Additionally, determining whether
a vulnerability is a false positive or not may involve opening the project in
another IDE such as Eclipse as the Appscan source GUI is lacking access to many
features that developers are used to using when they have to make sense of
code.
- Price: $$$
- Target audience: Enterprises and Teams
- Target languages: C, C++, .NET, Java, JSP, JavaScript, ColdFusion, Classic ASP, PHP, Perl, Visual Basic 6, PL/SQL, T-SQL, COBOL
- Ideal run time: Nightly and weekly builds on a build server
3. Findbugs
This open-source tool can provide value to
any Java development team. It focuses from top to bottom to scan for bugs in
Java code. If you are running development shops that aren’t coding in Java,
this tool will not work for them. These can also include security or quality
issues.
Developers can work directly with Findbugs. It has plugins that work with many developer-level
IDEs and automated build servers.
- Price: 0 for open source
- Target audience: Teams and developers
- Target languages: Java
- Ideal run time: As developers code or on a build server
4. Sonarqube
While not precisely a security analysis tool,
SonarQube can incorporate security vulnerabilities identified
by other applications into its quality checks. Quality software is secure.
SonarQube can provide additional functionality that helps teams ensure that
their software is up to snuff. This open source software can be configured to
work with a variety of build servers to aid teams that want to get a handle on
their quality and security concerns. It can accept findings from both closed
source and open source tools and can turn the open source vs. closed source
debate into a productive conversation.
- Price: 0 for open source
- Target audience: Enterprises and teams
- Target languages: ABAP, Android (Java), C, C++, CSS, Objective-C, COBOL, C#, Flex, Forms, Groovy, Java, JavaScript, Natural, PHP, PL/SQL, Swift, Visual Basic 6, Web, XML, Python
- Ideal run time: At build time
5. Klockwork Insight
Klockwork
originally spun off from Nortel in the early 2000’s to commercialize an
in-house development tool. The software runs like a spell checker that points
out vulnerabilities and errors as developers type them. This also closes the
feedback loop and trains developers to not commit vulnerabilities back to the
repository. Rather than waiting for a weekly scan and then parceling out the
security fixes to random team members, Klockwork Insight puts the onus on the
developer to fix and learn at that point.
- Price: $$
- Target audience: Enterprises and teams
- Target languages: C, C++, C#, Java
- Ideal run time: As developers code
6. Codiscope Secureassist
Another real-time, developer-centric tool is SecureAssist. This tool integrates
into a developer’s IDE and identifies vulnerabilities as the developer works.
It also identifies security issues and provides on-the-spot guidance to help
developers fix the identified issue. It is best used by developers to scan code
as they write it rather than scanning existing code bases.
For a young company that’s still building its
code base or a team that’s starting from scratch, SecureAssist provides all the
source code analysis needed. Enterprises with larger code bases may require a
tool geared towards scanning massive code bases, but could still benefit from a
just-in-time code checker to prevent new vulnerabilities from being introduced.
- Price: $
- Target audience: Enterprises and Teams
- Target languages: Java, .NET, PHP
- Ideal run time: As developers code
Summing It Up
Whether you need to knock out an entire
application with a Fortify or Appscan sledge hammer, tack security details into
place with a SonarQube finish hammer, or mold software into a secure solution
with a ball peen Klockwork or SecureAssist hammer, everybody benefits from the
added security that automated source code analysis tools offer.
Pralhad
Jadhav
Senior
Manager @ Library
Khaitan
& Co
No comments:
Post a Comment