Slashdot Log In
Free Open-Source vs. Commercial Security Tools?
Posted by
Cliff
on Mon Feb 07, 2005 02:02 PM
from the don't-buy-into-the-FUD dept.
from the don't-buy-into-the-FUD dept.
sahirh asks: "I work as a penetration tester and recently started writing a whitepaper on the benefits of free, open-source security tools over commercial tools. Through my own experiences, I've found that many free tools such as Nessus and Kismet are more reliable and have better features than expensive commercial alternatives like ISS Internet Scanner or Airopeek. I've also noticed that tools like Ettercap have no commercial alternative. Further, the flexibility offered by the open-source nature of such tools is a great benefit. I'd like to ask for Slashdot's experiences and opinions on why you don't need to spend thousands of dollars on an expensive tool to perform a professional security assessment." Update: 02/07 11:15pm EDT by C : Thanks to all who wrote in to let us know the proper URL to the Kismet site.
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
I want his job (Score:5, Funny)
I have no joke here, I just like saying, I work as a penetration tester ...
Re:I want his job (Score:4, Funny)
Parent
Snort (Score:4, Interesting)
Re:Snort (Score:4, Informative)
For pen-testing, check out the Metasploit framework [metasploit.com]. It's truly cool.
Also, have a look for scanrand, part of paketto keiretsu (doxpara.com appears to be having trouble right now, so don't go looking right now).
There's always the old standbys, as well, like dsniff.
Parent
Re:Snort (Score:3, Informative)
Actually we found that Sentarus is a much better snort-based product. We kicked Sourcefire out after 2 weeks, they just don't get the concept of a GUI. Talk about butt ugly and unmanagable.
Valuable Open Source Security Assement Tools? (Score:5, Informative)
Re:Valuable Open Source Security Assement Tools? (Score:3, Informative)
Re:Valuable Open Source Security Assement Tools? (Score:4, Interesting)
Parent
Agreed (Score:3, Insightful)
Re:Valuable Open Source Security Assement Tools? (Score:5, Informative)
Heh, recommending a security tool that OpenBSD removed because the Ethereal team does not care about security [openbsd.org]
Just because something is open source does not imply that it's secure.
Parent
Re:Valuable Open Source Security Assement Tools? (Score:5, Informative)
I was just thinking about structural ways to work around this in ethereal (like priv sep) -- in the meantime, I would point out that the biggest difference between ethereal and it's commercial equivalents is is that, with ethereal, you find out about the security problems quickly -- whereas with commercial equivalents, you might not find out for a while (if ever), and you'll probably end up paying for the upgrade to make it secure.
Another point is that it's most often the newer disectors that contain the holes. If you're worried about security and working in a 'hostile' environment, you're probably best to disable any disector that you're not intending to use. -- in fact, that might be a good idea to do in Ethereal, generally: Disable all but the most common dissectors and wait for the user to enable them explicitly.
Parent
Re:Valuable Open Source Security Assement Tools? (Score:3, Interesting)
Part of the nature of ethereal is that just about any hole is going to be a remot hole, since it is pretty much only dealing with remote (network) data. This is made worse by the fact that it's usually run as root and has no privelege separation (that I know of). OBSD, on the other hand has the luxury of separating remote holes from local holes when they carp about OpenBSD's security.
This, however, does not excuse the ethereal community
Accountability (Score:3, Insightful)
However, for protecting yourself, I think there are ethical reasons to use Free Software - Stallman argues that you should choose software for those reasons alone, and not technical reasons. If you listen to Linus, however, he tells us that technical reasons are valid reasons to choose to software. Your decision on this issue is the first step to your overall decision.
Re:Accountability (Score:4, Interesting)
I'm on our network security team and when doing audits we do have a few commercial tools, but we also use OSS tools like Nessus because IME they're better overall.
Parent
Re:Accountability (Score:4, Insightful)
Passing the buck is standard corporate politics. It's true that this leads to a lot of dysfunctional organizations and bad decisions. But if you choose to fight this trend, you better be very good at what you do. And at covering your ass.
Parent
Re:Accountability (Score:3, Interesting)
Why can't you? The law on this is untested in many areas. What makes you so sure you couldn't make a case against them?
What a pile of shit? (Score:5, Funny)
I know Microsoft readily accepts monetary responsibility for their products being crap and causing crashes, viruses and trojans in my system.
In fact, Bill and Steve cut me a check weekly.
Parent
Re:Accountability (Score:5, Interesting)
Parent
Accountability vs Responsibility (Score:5, Insightful)
Your responsibility is to protect your company AND get it back on its feet after a breakin. You can't rely on a lawsuit to do that in any timely fashion, only after the company has gone out of business and everyone has long since gotten new jobs. Even then, you'd be lucky to get pennies on teh dollar in restitution. So what good does it to sue the developer or seller?
You have to get the company going again as quickly as possible. It just might be helpful to have sources to what failed to see how it failed and how the breakin occurred. Proprietary software is useless there.
Parent
Re:Accountability -- Reminde me not to hire you (Score:5, Insightful)
I mean, it's not like most commercial vendors take any responsibility for their software, anyways -- have you read your EULA's recently?
At least with open source software, you have the option of fixing any bugs yourself if the vendor refuses to. With Proprietary code, your only choice is to grin, bend over and wait for your bill.
Parent
Re:Accountability -- Reminde me not to hire you (Score:3, Insightful)
Commercial is not the same as inferior. MANY MANY commercial products are better than the open source version. Your bias is showing.
I have a similar job. (Score:4, Funny)
That's your day job... (Score:5, Funny)
Hmmm (Score:3, Interesting)
Go to SANS training. (Score:5, Informative)
We were reviewing everal six-figure pieces of equipment and found the same thing - we knew they saw traffic they didn't like, but we didn't know WHY.
Now that everybody uses snort rules, the training is still helpful to show you WHAT you're seeing and IF it's truly bad or just another false positive.
FWIW, why get the snort stuff one vendor removed? Just go straight to the source.
Re:Go to SANS training. (Score:4, Informative)
I dig Snort, been using it a while. The SANS training made it USEFUL. The course filled in gaps in my knowledge at a rapid rate, and I usually HATE computer training courses precisely because the bandwidth is too low.
Richard Beijtlich wrote "Tao of Network Security Monitoring" which is a really, really good next step.(http://www.bookpool.com/.x/kzaxqc7ob1/sm/03
It covers the use of a variety of different types of intrusion indicators to quickly get to the meat of the matter. He's critical of the SANS course as too bit-addled. I can see what he means - you do spend 2 days (of 6) on tcpdump, vs. just one on Snort per se, but that gives you a great background to use tons of other tools. Once you have that, the other tools are easy.
SANS also has security auditing, incident handling, firewall + VPN, and some PHB type classes.
I'm a fanboy.
Parent
Re:Go to SANS training. (Score:3, Informative)
I took the IDIC course a while back (i.e. my analyst number is less than 100) and noticed the same thing. The layout was a bit different then, but I caught myself thinking "why are we spending a day and a half reviewing TCP/IP?" After listening to
Penetration Tester (Score:3, Insightful)
VIsa / MC Compliance (Score:5, Informative)
In order to comply you must have various levels of security testing done and certified by an approved vendor [visa.com].
Don't Forget (Score:3, Insightful)
There is security implied simply by the fact that the product is open source. That is to say that its failings and potential security weaknesses have been evaluated by a community beyond the original developers and is always open to scrutiny.
besides the obvious (Score:5, Informative)
one commercial one that I _really_ like is Languard Network Scanner from GFI.
While it is closed source, it has 30-day full functionality, and has limited functionality after that. Still even with the 'limited' functionality, it provides the full scanning capabilities, it just doesn't let you use some of the features that I never use anyways (scheduling, etc).
I'd really recommend giving it a try, its pretty slick.
Anything, as long as... (Score:3, Insightful)
b) see a.
I do not see the need to stick to ideals in a world of security, use the best tool for the job, and stay vigilant (if OS is the best tool, then only merit it on this, not the fact that it is OS)
Assumed a thief (Score:5, Interesting)
They provide a remote collection agent that can be monitored with the licensed full version. That was not good enough in our instance due to the layout of our network and needing to install our licensed copy, at the work site, fix the problem and then uninstall the software. After much desk pounding they finally gave in and let us have unlimited installs of the same number. But only after threatening a move to open source.
Our take on the issue is, we need to install the product how we see fit. We payed for it. It doesn't matter to us if we aren't using the software how they "envision" it should be used. We were due a refund if they refused to let us use a product we payed for.
The advantage of creating your own security (Score:3, Insightful)
Take physical security as a metaphor. You want to secure your physical plant, so you hire a security specialist. You hire his services and he peruses your building. He suggests locks here, cameras there, and a whole plan on making your business less prone to break-ins and the like.
However, what's so great about this? Two things. One, everything is transparent. It's not like joe security officer is selling you a security package and not telling you where he's going to put that $50,000 you just paid for. He has to give you a full plan (the code!) that you approve of. Plus, the plan is customized for you. It's your plan, not someone elses. It's based on your requirements and your specifications. If a security company comes to you and says they'll put a camera in every room and be done with it, is that really enough for you?
Tie that back to open source. The code for open source security solutions are that plan you need. You can provide input on it and change it as much as you want to match your individual needs. And the code will be more unique than a commercial security program, which is the same from site to site.
I can't say that open source is necessarily for everyone. Maybe a camera in every room is all you need. Maybe you just need a security guard out front. The advantages I see here are businesses where security is an important part of business, and where companies don't want control of their own data in the hands of anyone but themselves.
Counter-point instead (Score:4, Insightful)
Basically, most people (including CEOs and the like) think that the more something costs, the better it must be. After all, if Product A costs you $100 and Product B costs you $5, then there must be a lot more features and hard work put into Product A to make it cost more than Product B.
Plus, when people hear 'open source', they think of crackers/evil people getting their hands on the source code and exploiting all sorts of 'holes'. Since they can find out how it works, it must be really easy for them to exploit it.
I wouldn't be surprised if many people, on first look, would rather pay $10 for a Linux distro rather than get it for free because 'free' has all sorts of bad connotations locked in with it this day and age. They assume it's the difference between going to a 12-year old's lemonade stand and going to starbucks for a smoothie. "You get what you pay for."
Deploying Software (Score:5, Interesting)
1. Personnel changeover. DoD loves to move people around between departments and installations. It's hard to find people savvy enough to run open-source software and keep them in one spot. It's much easier to give whoever is holding the position a phone number and tell them to call tech support with problems.
2. Personnel skills. DoD is huge. Because of this, the chances of getting skilled and motivated people at all of your sites is slim. Again, the phone call seems to make everything better.
3. Contracts. Things are usually purchased in bundles and as part of a big plan. It's much easier to brief to a non-tech boss that you have the support of another company and not that "I'm sure we can figure it out."
4. Uncle Sam's pockets are deep.
I agree that open source software is often better. But it doesn't give the non-tech group that warm fuzzy it needs to. In the end, the boss doesn't want to up a creek without a paddle. Having that phone number to call adds a much wanted security blanket, even if it's only a facade.
Re:Deploying Software (Score:5, Insightful)
Linuxcare and the like flamed out for poor core business practices and poor market targeting (do not ever, I repeat do not EVER, try to make money directly supporting end users). MySQL AB, Best Practical, Trolltech, &c seem to be doing pretty well though....
Parent
Re:Deploying Software (Score:3, Interesting)
Having that phone number to call adds a much wanted security blanket, even if it's only a facade.
My first though on reading this was, "well their must be dozens of security firms that will offer support for such popular tools." I mean surely IBM if no on else will be happy to take your money and answer calls about nmap or snort or ethereal? So I did what anyone would do, and googled a bit. I could not find anyone in 2 minutes of searching. Perhaps my google-fu is weak. Is this really an untapped mark
how can you be sure of quality of closed source ? (Score:3, Insightful)
Right Question? (Score:3, Interesting)
"I'd like to ask for Slashdot's experiences and opinions on why you don't need to spend thousands of dollars on an expensive tool to perform a professional security assessment."
It sounds like you're already set in your opinion and just asking for justifications. That doesn't usually develop any new insights or make good comparisons. If you really want to sell people on Open Source, do a fair and un-biased comparison. An obviously biased comparison is easily detectable and loses credibility. I really don't think Open Source needs biased comparisons to look good.
Docmentation (Score:4, Funny)
Different markets (Score:3, Insightful)
Also, a number of commercial products are not written with just the user in mind - the larger ones also involve things like generating pretty reports for use in the CTO's bonus negotiations and suchlike.
Finally, lots of the commercial products try to be competitive by doing everything at once, whereas the OSS tools tend to be more focused on specific functionality, following the traditional unix approach.
Of course, all these points are generalisations and there are exceptions to them all, but that's what you get for asking such a general question.
"I work as a penetration tester..." (Score:3, Funny)
There is commercial free/open source software (Score:4, Informative)
What if some of the developers of those F/OSS packages are paid money to code free software? MySQL comes to mind when I think commercial free software, although it isn't related to the software you search. There has been always money to be made in free software business. Your question should be about free vs. non-free.
Quoting RMS:``Free software'' does not mean ``non-commercial''. A free program must be available for commercial use, commercial development, and commercial distribution. Commercial development of free software is no longer unusual; such free commercial software is very important.
Check the license first (Score:4, Insightful)
And that is a bigger problem for our lawyers then the efficacy of the tool itself.
Otherwise, why must it be an either/or decision? Why can't you have a mix of open and commercial and achieve a balance of cost and effectiveness?
Also consider the total lifecycle costs. A $30,000 appliance out of the box may be cheaper than an open source tool running on an 'extra' server you have laying around plus 250 hours/year of your time fucking with it. Sometime the best security is the security that makes the most rational sense for you to afford.
Interesting Business Card (Score:3, Funny)
Bad link (Score:3, Interesting)
Nessus is not quite free anymore (Score:4, Informative)
Check it out for yourselves, there are three feeds now. The main feed which used to be free is now on a seven day delay. While this doesn't affect a lot of the scanning efforts it is nice to know about the vulnerability that just came out.
Often when a new serious vulnerabilty makes news a company would like to know how they are affected right away. Now they will have to wait 7 days!
I don't think that there is anything wrong with this, I mean the developers at nessus (tenable lightning) have to eat too. But calling it free just seems sort of inaccurate now. Scanners without updated signatures work about as well as razors without the blades.
A 'Direct Feed' is commercially available which entitles subscribers to the latest vulnerability checks. Customers who purchase a Lightning Console or NeWT Pro scanner receive access to this feed with their annual product maintenance.
A 'Registered Feed' is available for free to the general public, but new plugins are added seven days after they are added to the 'Direct Feed'. To obtain access to the 'Registered Feed', users are required to enter contact information for tracking and also agree to Tenable's license agreement for the plugins.
The 'GPL Feed' does not require registration, and includes plugins written by the user community. As manager of the Nessus project, Tenable continues to accept plugins written from the Nessus and NeWT user communities. Plugins accepted with a copyright under the GNU Public License will be distributed to the Direct, Registered and Public feeds at the same time.
Pricing
The access to the GPL feed and to the Registered Feed is free. Pricing for the 'Direct Feed' is based upon the number of Nessus or complimentary copies of NeWT in use within your organization, consultancy or service. The cost is $1200 per scanner per year. For more information, please contact Tenable's sales staff.
vuln scanners (Score:4, Interesting)
Now one can also take the Open Source approach here and write their OWN signatures but many companies just don't have the staff for that type of thing. The vulnerabilty details are so sparse these days (not so open disclosure rules) that recreating the actual exploit never mind finding a way to detect it remotely is beyond the skill of most teams in the limited timeframe that it's of vital importance. A team will have around 24-48 hours after a patch is released until some evil doer[s] have reverse engineered the patch and created an exploit out of it, slipped in a pre packaged payload and owned 3 out of your 7 class B segments. Sometimes less. I think the ISS worm last year was the record, something like > 20 hours from patch to worm [witty worm i think].
Some intersting article [zdnet.com] on scanning here [64.233.161.104] and here [nwc.com]
Just one other side note about the articles, Foundstone was purchased by McAfee last year so disregard those.
Re:Huh? (Score:5, Funny)
Parent