Companies should be on the hunt for gremlins in the open-source machine

You may well be reading this article at your desk at work or, perhaps, at home. You may be reading it on a browser based on open source. Your company may well have chosen the browser because it is free.

You aren’t alone. According to the The Ninth Annual Future of Open Source Survey, corporate open-source use and participation has reached an all-time high. This is not only in the user base, but also in the supplier base. According to the survey, two-thirds of respondents said their company creates software for customers built on open source.

Open-source software makes the computer code at its heart publicly accessible. This in turn means that anyone can update it or change it to suit their own needs. Closed-source, or proprietary software, remains the property of its original authors, who are the only ones legally allowed to copy or modify it. So Microsoft’s Internet Explorer is a closed-source product, but if you are reading this article on Google Chrome or Mozilla Firefox, you are making use of an open-source product. The authors of those browsers have made the source code available to you, and – if you were so inclined – you could view the code, copy it, learn from it, alter it and share it. But read to the end before you dive in.

Cost savings vs risks

The opportunities, not only for cost savings, but also for innovation and flexibility are great. Yet there are also risks. Open source can also be open season with the code a free-for-all for everyone from benevolent innovators to corporate hackers. Many companies are used to buying software from Adobe or Microsoft and operate on the, perhaps misguided, assumption that help with any issues is only a phone call away or that regular product updates will fix glitches. You don’t have access to the code, so you couldn’t fix it even if you wanted to and had the means to do it.

Open source is different, though. And this is where businesses are missing a trick. In the same survey, it is telling that more than 55% of respondents admitted that their company has no formal policy or procedure for the use of open source. But the opportunities that might be exploited – and the risks that might be avoided – are too clear to ignore. All software can be attacked; all software can suffer from bugs; but only open source allows you to address those dangers yourself and allows you to benefit from a huge and hard-to-navigate variety of options in software development.

Numbering the risks.J J, CC BY-NC-ND

The lack of a strategy is particularly worrying for organisations who deliver products and services directly to you and I, the consumer. These corporations hold our data, use our data – and may well be opening their doors and windows wide to that data being mined for all kinds of purposes. It might sound like scaremongering, but some healthy caution seems appropriate.

Now, despite the potential exploits and vulnerabilities that open source has thrown up recently, our friendly survey found that more than half those it polled reckoned open source offered superior security when compared to proprietary products. That faith may seem premature, given the many reported hacks and security issues in the press. Certainly a company shouldn’t be blindly downloading anything and everything simply because it is free.

This is a revealing statistic as it points to the argument for both open source and traditional product sourcing. In either case, the lack of a clear strategy and policy for security is worrying. Lou Shipley is the CEO of Black Duck Software, who co-created the survey we have quoted above. He has a vested interest, of course; his company is a consultant for firms using open source. But it’s hard not to agree with his comment that: “companies need their management and governance of open source to catch up to their usage.”

Hacked off

You don’t have to look too hard to see evidence of the dangers. Research recently showed that workers are habitually ignoring known cyber-risks, surfing adult content and downloading unapproved apps.

Companies using both proprietary and open-source cloud computing have suffered data breaches, while Taylor Rhodes, the CEO of cloud computing firm Rackspace, issued a public apology last year after a server reboot, which also affected Amazon, knocked a quarter of its 200,000 customers offline. This was caused by a vulnerability in a widely-used piece of open-source technology called the Xen hypervisor.

Looking elsewhere in the open-source world,cybersecurity researchers recently found that more than 5m Android apps are open to the risk of hacking and any company without security or governance for open source faces huge risks from apps downloaded to devices. From my own research, there is one company I have seen at first-hand struggling with related problems (and which I will keep anonymous). This telecoms firm used open-source plug-ins for its open-source blogging platform and experienced a critical data breach.

In many cases, the lack of a policy, the lack of risk assessment and basic common sense scrutiny caused the problems.

Policy briefing

So what would an open-source policy look like? Well, it can be added to existing policies but it would have to pay attention to specific risks around identified flaws and vulnerabilities in the software – as well as identifying particular needs that a variety of open source options might address. And a policy need not act as an over-cautious block. The key issue is that decisions on when and how to deploy it ensure consistency, safety and integration across different parts of the business, and are linked to the business case and strategic goals.

It goes without saying that when confronted with adapting technologies, the policy also needs to be smart, regularly updated and tuned into developments in security and open source as a field of practice and innovation.

An attractive proposition at any time.Frank Hebbert, CC BY

The policy would not stop there. Open source also creates an opportunity. It isn’t only about downloading freebies. Open source can support the value of “openness” and its use can be empowering and create opportunities to customise products and platforms to enhance branding.

It suggests a culture of openness and an optimism around innovation and collaboration. This is particularly attractive to millennials and can be critical for retaining engineering talent. And interestingly, it may be these very millennials who are contributing to the fragility of IT policies around open source. As far back as 2009, an Accenture survey reported that more than half of the millennial population entering the workforce was “either unaware of their companies’ information technology (IT) policies or… not inclined to follow them.”

In short, there’s no excuse for being piecemeal in our approach. The use of open source demands clear governance, smart awareness of security risks and the setting of clear goals linked to the vision and strategy of the business. The opportunity to do this hasn’t existed with closed source, and just because it is free doesn’t mean it isn’t important.

Paul Levy owns shares in CATS3000 Limited