Sessions

Toward an Open Source Process for Security Vulnerabilities

*
Accepted Session
Business
Long Form
Intermediate
osb2012-0786
Scheduled: Thursday, June 28, 2012 from 10:00 – 11:45am in B301
Session notes

Excerpt

Security vulnerabilities can be a source of anxiety and lost sleep, or they can be a carefully managed opportunity to bring communities together, practice safe operational practices, and prevent problems. Join me to discuss how we can all manage our security issues sanely and cooperatively, and lose less sleep!

Description

Software security vulnerabilities are a real source of stress in the open souce software community, and need to be handled efficiently and effectively. At ISC, because our specialty is software used as critical internet infrastructure, we deal with these issues often. We have been working for the past two years through a substantial change and improvement to how we manage these vulnerabilities, from finding them through fixing them through communicating about them with our users, vendors who include our software, security and government organizations, and others. Through our Phased Vulnerability Disclosure process, we provide increasing levels disclosure of vulnerabilities through a series of notifications, so industry can prepare without rushed actions, and critical infrastructure can be upgraded without “bad guys” knowing about the vulnerability. As an organization dedicated to open source software and open process, ISC is publishing the policies, processes, and tools involved in our process, and seeks to engage with the rest of the open source community to ensure that our process works smoothly for all of us, and to assist others who want to build similar processes for their own open source projects and organizations. This session will be part lecture on how ISC has done things, part a discussion of resources available for management of vulnerabilities, and part a brainstorming and planning session on how open source organizations can best collaborate to handle such issues effectively in the future.

Tags

community, collaboration, security, Process, policy

Speaking experience

I have spoken at many conferences and company events over the years. Last year I gave a talk about agile software process at Open Source Bridge. I gave a similar talk to this one at LISA USENIX '11 to a nice sized and enthusiastic audience.

Back to list of sessions

Speaker

  • S640x480-crop

    Larissa Shapiro

    Mozilla

    Biography

    Larissa works on the Mozilla project, serving as the “senior program manager for product management operations”, which means lots of things, but the biggest thing it means is that she builds and implements effective product management processes for the project.

    Prior to joining Mozilla, Larissa was the first (and only) Product Manager at Internet Systems Consortium, an open source public benefit organization which is the creator and maintainer of BIND, the DNS software which serves 80% or more of the nameservers on the internet. She lives in Santa Cruz, California, with her family. When she is not working on open source projects, she likes to garden and sing the blues.

    Sessions