The Open Learning Centre

IT Security and FLOSS

The United Kingdom goverment's Department for Trade and Industry (Dti) produces regular reports on IT security in conjunction with, and sponsored by, major industry players, including PriceWaterHouseCoopers. The reports can be downloaded from here: http://www.pwc.com/.../7FA80D2B30A116D7802570B9005C3D16.

The findings are very interesting from an Open Source perspective.

• The average UK company now spends 4-5% of its IT budget on information security,
• 62% of UK companies had a security incident in the last year,
• The average cost of a UK company’s worst security incident of the year was roughly £12,000 (up from £10,000 two years ago).
• Overall, the cost of security breaches to UK plc is up by roughly 50% since two years ago, and is of the order of ten billion pounds per annum.
• Worryingly, a quarter of UK businesses are not protected against the threat from spyware.

If, after reading the various reports from the Dti and PwC, we now look at the Wildlist which attempts to report all known viruses actually active and "in the wild" you will note that everyone of them is targeting proprietary software systems. Mainly Microsoft's Win32 implementation (Windows)... In fact it is very hard to find any real data on the number of Linux viruses that are in circulation. It appears to be a very small number... Here is an excellent article (although a few years old is still very relevant) which goes a good way to explain why Open Source software and Linux in particular are very hard to attack with viruses when compared to Microsoft's software for example.

When you consider the cost of implementing good IT security in capital expenditure, additional staffing and/or consulting fees and the cost of incidents themselves, the Open Source software stack has a great deal to offer.

Finally, if you are still sceptical, ask yourself why it is that most all commercial security products such as, IDS (Intrusion Detection Systems), Firewalls, Proxy Servers and network filters run on Open Source software?