the cost of “free” - open source strategy forum · 11/6/2017 · the cost of “free” ... no...

N O V E M B E R 6 , 2 0 1 7

C O N F I D E N T I A L

The Cost of “Free”Managing Risk in an Open Source World

Joe McCann, CEO NodeSource Inc.

© 2017 NodeSource2

We’re the Node.js company.


“Open Source is like a free puppy. It's great at first, but then you have to take care of it.”

© 2017 NodeSource C O N F I D E N T I A L5

Free Puppy Task List

• Feed

• Walk

• Train

• Groom


Open Source Task List

• Secure

• Support

• Educate

• Trust, but verify

© 2017 NodeSource C O N F I D E N T I A L

Benefits of Open Source

7


Security

• Broad and continuous peer review

• Infinite eyes > total number of eyes in your company

• Patches come faster from open source than closed-source proprietary vendors


Attract and Retain Talent

• Skills are transferrable

• Large pool of talent available with skills verified by open source activity

• Overwhelming degree of innovation in open source projects favors creative thinkers


Cost Savings

• Per-seat license fee drops to $0 with open source

• No vendor lock-In

• Reduced total cost of ownership


Example

Adjusted to today’s software development costs, building the

Fedora 9 Linux distribution would require a budget of $10.8 Billion.


Accelerate Time to Market

• Many users. No license restrictions on who can use the software

• Many uses. No license restrictions on source code modifications or use cases

• OSS is extremely well-suited to rapid prototyping and experimentation


SaaS is a new way of delivering software.

Open Source is a new way of delivering infrastructure.


Risks

14


Risks Around Open Source

• Brand/Reputation

• Operations

• Personally Identifiable Information (PII)

• Compliance

• Revenue


Heartbleed The Heartbleed bug allows anyone on the Internet to read the memory of the systems protected by the vulnerable versions of the OpenSSL software. This compromises the secret keys used to identify the service providers and to encrypt the traffic, the names and passwords of the users and the actual content. This allows attackers to eavesdrop on communications, steal data directly from the services and users and to impersonate services and users.

More than 2/3 of all web servers on Earth were vulnerable.


left-pad In March 2016, npm attracted national press attention after a package called left-pad, which was depended upon by many popular JavaScript packages, was unpublished as the result of a dispute. Although the package was re-published 3 hours later, it caused widespread disruption and broke countless builds around the world.


Hidden/Embedded Risk Electron is an open source framework based on Chromium and Node.js. However, there is a massive security risk here that is hidden from most users. Google Chrome, also based on Chromium, receives auto-updates for new features and security patches, but, Electron apps do not. Therefore, many of the security vulnerabilities still exist in Electron apps today due to Electron running older versions of Chromium.


MongoDB On May 22, 2017, Coinbase, experienced a massive spike in user traffic as a result of volatile price swings in Bitcoin and Ethereum. Failure to upgrade their current production MongoDB instances ultimately triggered the downtime. Coinbase engineers are not MongoDB experts, and the operational risk associated with open source infrastructure reared its head on the day where they needed the expertise the most.

"...in consultation with MongoDB experts we decided to move forward..."


Request traffic on Coinbase's primary load balancer (incident highlighted).


Equifax On September 7, 2017, Equifax announced a cybercrime identity theft event potentially impacting approximately 145.5 million U.S. consumers.

Equifax said the breach was facilitated using a flaw in Apache Struts. A patch for the vulnerability was released on March 7, yet the company failed to apply the security updates before the attack occurred two months later.

https://en.wikipedia.org/wiki/Patch_(computing)


B E F O R E B R E A C H :

$ 1 6 B M A R K E T C A P

O N E W E E K A F T E R B R E A C H :

$ 1 1 B M A R K E T C A P


$250,000 Vendor Support Contract

$5 Billion in Shareholder Value

to save


Best Practices

24


Enterprise-Grade Vendor Support


“The use of any software without appropriate maintenance and support presents an information assurance risk. Before approving the

use of software (including OSS), system/program managers, and ultimately Designated Approving Authorities (DAAs), must ensure that the plan for

software support (e.g., commercial or Government program office support) is adequate for mission need. ”

United States Department of DefenseClarifying Guidance Regarding Open Source Software (OSS)


Best-in-Class Tooling


“You can run the open source version in production...but should you?”

© 2017 NodeSource29

N|Solid Runtime Certified Modules Dedicated SupportThe secure, reliable way to take advantage of the massive ecosystem of Node.js packages.

Establish and sustain enterprise-grade Node.js development and operations.

A fully-compatible Node.js runtime enhanced to address the needs of the enterprise.

NodeSource is the Node.js company.Run Node.js securely and confidently in production with the product suite trusted by innovative Fortune 500 companies.


The superior Node.js runtime

© 2017 NodeSource31

Feature Node.js N|Solid

Language Uniformity ✓ ✓

Fast, Efficient, and Highly Scalable ✓ ✓

Collaborative Package Management ✓ ✓

Officially Supported Runtime ✓ ✓

Enhanced Security Capabilities 𐄂 ✓

Process Monitoring and Analysis in Production at Scale 𐄂 ✓

Node-Specific Metrics (20) 𐄂 ✓

Turnkey and Standardized Debugging 𐄂 ✓

24x7x365 Technical Support 𐄂 ✓

Advanced Node-Specific Metrics (50+) with StatsD Integration 𐄂 ✓

Enhanced Notification System (Slack, PagerDuty, Webhooks) 𐄂 ✓

Event Loop Delay Alerting 𐄂 ✓

Process Cluster Analysis 𐄂 ✓

Adjustable Resource Usage Time-Scales 𐄂 ✓

Built-In Heap Snapshot Diffs 𐄂 ✓

N|Solid: More than just Node.js


Bringing trust to untrusted third-party JavaScript

© 2017 NodeSource

Feature NPM NCM

550,000+ JS Packages Available ✓ ✓

Immutable Package Registry ✓ ✓

Collaborative Workflow ✓ ✓

Command Line Interface ✓ ✓

Enhanced Security Scanning 𐄂 ✓

Curation of Packages 𐄂 ✓

Trust Score for All packages 𐄂 ✓

All-Inclusive Feature Set (No Need for Add-Ons) 𐄂 ✓

24x7x365 Technical Support 𐄂 ✓

Highly Available and Resilient Private Registry 𐄂 ✓

Automatic Dependency Recertification on Updates 𐄂 ✓

Software License Compliance (OSS and Proprietary) 𐄂 ✓

Application-Specific Package Scoring 𐄂 ✓

Application-Specific Package Bundle Hosting 𐄂 ✓

Test Coverage Checks for All Packages 𐄂 ✓

Cryptographically Signed Packages 𐄂 ✓

NodeSource Certified Modules: More than just NPM


Expect Shadow IT


Institute an Adequate Disclosure Policy


https://securitytxt.org


Reduce Proprietary Tech Footprint

Increase Open Standards Adoption


vs.

C O N F I D E N T I A L

Thank you.

Joe [email protected]

@joemccann

the cost of “free” - open source strategy forum · 11/6/2017 · the cost of “free” ... no...

Documents