Open Source Answer to Critical Infrastructure Security Challenges

1
Open Source Answer to Critical Infrastructure
Security Challenges

• Vadim Shchepinov, Chief Executive OfficerRED
  SOFT CORPORATION

2
Content

• What is Open Source- New way for Software to be
  developed and utilized- Open Source Paradigm
  Timeline
• Security Requirements and Challenges
• Open Source answer to the security challenges
• Database Management System is the key element of
  Information System Security
• - Open Source RDBMS positioning within global
  IT
• Red Soft- Strategy Products Services-
  Offer to European partners and clients

3
1.1 What is Open Source Free software

• Open source is a model to develop, distribute and
  use software

Closed source proprietary model
Open Source

• Consumer pays and gets software binaries for
  use not source code.
• Traditional Licence allows to consume,
  participate, contribute (report, suggest)

• Consumer gets software and source code without
  paying
• Open source Licence allows to consume,
  participate, contribute (modify, distribute)

patches support
patches support
read source modify
read source modify
use
use
Software Binary source
Software Binary
C2
C2
SV
C1
SV
C1
License
License


redistribute
redistribute
feedback bug reports fixes code feedback
support requests and resolution feedback
feature implementation code
feedback bug reports feedback support
requests feedback features requests
Source Accenture Open Source Business Models 2007
4
1.2 What is Open Source Paradigm Timeline

• Open source model matured into the viable and
  accepted way to produce and use software
  efficiently, quickly and cheaply while being not
  locked-in by a specific vendor

Today
Pioneer Age
GNU ProjectGNU General Public License
GNU/Linux V1.0
Linux V2.0
Free and Community Age
Free SoftwareFoundation
Open SourceTerm defined
ApacheWeb Server V1.0
Adoption by (Enterprise) Developers
IBM commits to Linux
IBM Linux business gt 2 bln
Open Source Based Business Models
Red Hat1 blnin revenue?
Red Hatfounded
Red Hatgoes public
Red Hatacquires JBoss
Commercial Open Source
Borlandopens InterbaseFirebird Project
SUNopens Open Office
Adoption by the Enterprise
ApacheWeb Server V2.2 gt50 of Internet
Open Source enabled Business
1980
1990
2000
2010
Sources Optaros Open Source Catalogue 2007 Red
Soft
5
2. Security requirements and challenges
Information Systems (IS) are defined as key
components of Critical Infrastructure by European
Programme for Critical Infrastructure Protection
(EPCIP) The security of information systems is
very important and they are placed on the 3d
position in the priority list of EPCIP after
energy and nuclear industriesInformation
systems security challenges are

• IS may contain undeclared software functionality
  that might breach user security
• IS require security mechanisms and tools to be
  build in
• IS require a lot of effort and complex procedures
  to manage updates for security certified software
• IS require visibility and transparency for
  developers and IT teams to allow efficient
  development and support with high degree of
  security requirements fulfillment

6
3. Open Source answer to Security challenges
By the very nature of being open Open Source
model and respective products allow to build and
use more secure Information Systems

Closed source proprietary model
Open Source

• Very difficult to trace undeclared software
  functionality that might breach user security
• Difficult to build in the required security
  mechanisms and tools
• Management of updates for security proprietary
  software is very complex and effort intensive
• Low level of visibility, transparency and access
  to necessary info support required by
  developers and IT teams

• Almost impossible to introduce undeclared
  software functionality
• Direct access to code and more effective
  influence on the development road map to take
  into account forthcoming new security
  requirements
• Smooth and straightforward algorithm for security
  recertification of updated software
• Transparent and open solution

7
4. Database Management System is the key element
of Information System security

• Database contains all the information in the
  information system- one source and storage place
  for all info
• Undeclared software functionality kills
  effectiveness of all the security mechanisms
  built into the other layers of information
  systems
• Database holds data and links between the data
  entities which allows structured security
  protection on different levels

8
4.1 Positioning of Open Source RDBMS within
global IT

• Approx. 44 of developers is using Open Source
  RDBMS for development purposes
• Popularity and number of users grows some
  25/year. As of now it is close to the the level
  of commercial, enterprise RDBMS
• The level of discovered, security related errors
  in Closed Code is at least twice higher. Data
  about Undiscovered errors in Closed Code are not
  available.
• Source Evans, IDC

9
5. Red Soft Strategy and Products
Red Soft strategy is to be the Red Hat of global
open source DBMS market

• Red Soft Corporation is the preferred vendor of
  the secure database technology based on the Open
  Source model
• Red Data Base from Red Soft is secure Relational
  Database Management System (RDBMS) based on
  Firebird 2.0 - one of the best established,
  well-known and globally widespread open source
  DBMS kernels in the world

• Red Database is in process of certification of
  security functionality for compliance with
  ISO/IEC 177992005

10
5. Red Soft Offer to European Partners and
Clients
Red Soft is offering its software products,
services and software assembly/production
facilities to companies and partners in Europe

• All the Open Source product range starting with
  Red Data Base delivered and supported by European
  partners
• Off-shore programming work based on Red Soft tech
  stack at production facilities the Russia
• Support and SW development servicesprovided to
  the clients directly and/or via partners

11
6. Questions and Contacts

• RED SOFT CORPORATION
• www.red-soft.biz
• Vadim Shchepinov, Chief Executive Officer
• vadim.shchepinov_at_red-soft.biz
• Office Phone [phone]