11 Chief Information Security Officers (CISOs) Say Open Source Software Provides Security, Potential for Cost Savings

TENAFLY, N.J., Nov. 20, 2017 /PRNewswire/ -- Security Current, an information and collaboration company by CISOs for CISOs, today published a collection of insights from leading Chief Information Security Officers (CISOs) on the use of open source software in their organizations.

Eleven CISOs from across industries weighed in, with most saying that open source software generally has been well vetted for security vulnerabilities by the vast development communities that contribute software to the libraries. What's more, they note that open source can provide more flexibility than commercial software products, which often must be heavily customized at great expense to the user organization.

"Open source code is a part of any modern technology portfolio," said Meg Anderson, VP & CISO at Principal. "Using open source can encourage creativity, increase agility, allow you to learn from outside your own company and attract talent engaged and networked in the community."

There is a consensus among security executives that open source software libraries are generally safe to use. Bradley Schaufenbuel, VP and CISO at Paylocity, said, "I contend that open source software is actually more secure than commercial off the shelf software. Since the source code is available to anyone, that code can be reviewed for security flaws or embedded malware by many."

Alexander Fry, Elsevier VP, Software Security Assurance, concurs. "I have conducted security-focused code reviews and security testing on hundreds of custom software applications that utilize open source libraries and frameworks. It has been my experience that most of the vulnerabilities are identified in custom code, not in open source libraries."

CISOs agree that, though open source software can be acquired for free or at low cost, enterprises must still account for the lifecycle expenditures, including training, support and ongoing maintenance. They note that most open source products are updated frequently, and user organizations must check regularly for updates, patch when needed, and thoroughly test new releases before putting them into production.

"We need to always remember that there is absolutely nothing about open source output that alleviates the need to update/patch it if we rely on some part of it in our environments," David Sheidlower, CISO at Turner Construction, noted.

Randy Marchany, Virginia Tech's CISO, said that working with open source software is a cost-effective way to learn about new features that can benefit the enterprise. "Most commercial security software came from open source software so why not get it from the source? Open source software allows you to test out new features with the only cost to you being that of time. Once your team uses an open source tool, they can use that knowledge to better evaluate a commercial product," Marchany said.

Participating CISOs include:

Meg Anderson, VP & CISO, Principal

Luis A. Arzu, CISO, Farm Credit Financial Partners

Frank Bradshaw, CEO & CISO, Ho'ike Technologies

Mark Eggleston, VP, CISO and Privacy Officer, Health Partner Plans

Alexander J. Fry, VP, Software Security Assurance, Elsevier

Ajit Gaddam, Chief Architect, Visa

Randy Marchany, CISO, Virginia Tech

Pete Nicoletti, vCISO and Board Advisor

Joel Rosenblatt, Director, Computer & Network Security, Columbia University

Bradley Schaufenbuel, VP & CISO, Paylocity

David Sheidlower, CISO, Turner Construction

Read the CISO Perspectives

Security Current improves the way security, privacy and risk executives collaborate to protect their organizations and their information. Its CISO-driven proprietary content and events provide insight, actionable advice and analysis giving executives the latest information to make knowledgeable decisions.

Media contact:
Linda Musthaler
[email protected] 
201-835-9205

SOURCE Security Current

Related Links

http://www.securitycurrent.com