You're already using open source security

Open source security is already in data centres, even if network executives think it isn't. One common example is OpenSSL, an open source-library implementation of the SSL encryption standard with an accompanying set of tools and utilities. Any commercial product that uses SSL for such features as Web-based management or client/server control channels almost certainly is using OpenSSL. With no reason to believe that they could write better or more bug-free code, commercial developers naturally gravitate to reusable, open source components wherever possible.

In the security world, open source has had its greatest success at the component level, rather than as full-fledged stand-alone products. These well-tested and well-accepted security components are incorporated into complete products by the ever-growing corps of security product vendors. The Nmap and Nessus network and vulnerability scanners, the Snort intrusion-detection system (IDS), and the iptables firewall often are found - sometimes carefully hidden, sometimes openly promoted - inside the newest security products. In addition, some open-source security products have been taken commercial by their own development teams: Sourcefire's Snort IDS and Tenable's Nessus vulnerability-management scanner are well-known examples.

A consistent trend in security products has been the creation of appliances, packaging familiar open source basics, such as Linux, Apache and MySQL, as a base, then adding a combination of open source security tools and value-added software for management to make a complete product. Most of the packaged security appliances for everything from firewalls to security information management are built on the same BSD Unix and Linux distributions as the application servers you build yourself.

Is it free or isn't it?

The most popular open-source security products - virus scanners, spam filters, intrusion-detection and -prevention (IDS/IPS) engines, and vulnerability management tools - require a fairly constant stream of updates to their internal rules databases to stay useful and abreast of the latest threats.

These rules updates have different names depending on the products, but they're very distinct from software updates. Rules updates for ClamAV and SpamAssassin are still free, at least for now. Indeed, one of the astonishing things about the ClamAV project - certainly the most frequent updater of rules - how long the team has been able to keep updates free (although contributions are solicited). Because these updates consume a lot of time, many enterprise network managers have shied away from ClamAV in the fear that the updates will slow down or, one day simply stop.

>Sourcefire (maintainer of the Snort IDS) and Tenable Network Security (maintainer of the Nessus vulnerability-management scanner) have opted for a mixed commercial and freeware approach to releasing their rules. Recognizing that a major part of the value of these applications is in their frequent rules updates, both companies have made timely updates subject to a modest subscription fee. If a company is willing to wait, it can have the updates at a later date for free.

A subscription fee caters to enterprise-class customers who are willing to pay for security products and need current updates, but prefer open source. Those fees can go into paying people to maintain the rules databases, a fairly thankless job where remuneration is the key to consistency and currency.