Suricata IDS. SURF Security- en Privacyconferentie 'In Control' Februari Victor Julien

Transcription

1 Suricata IDS SURF Security- en Privacyconferentie 'In Control' Februari 2016 Victor Julien

2 blog.inliniac.net Open Source hippie Suricata creator and lead developer Vuurmuur

3 Contents Overview of Suricata Funding Open Source Suricata Funding

4 Who still knows their network? Increasing complexity BYOD IoT VM's and containers ICS/SCADA

5 IDS / IPS Network Intrusion Detection System Passive Out of band Network Intrusion Prevention System Active Inline System to uncover malicious/unwanted activity on your network by inspecting the network traffic

6 Suricata Features Inspect traffic for known bad using rule language Lua based scripting for detection & outputs Unified JSON output for easy post-processing Extract files Scalable through multi-threading

7 #geekpr0n

8 No cmdline ace?

9

10 For your manager

11 Funding Open Source From:

12 Why Consider Funding? I bet you don't even know how the projects you use are funded And I don't mean Ubuntu or Firefox, but things like: Libmagic Libpcre Zlib Glibc Why care about those? They are all relevant to the security of your system

13 OpenSSL Heartbleed exposed how the world relied on OpenSSL

14 Funding to speed up development Suricata Lines of code

15 Funding Open Source Models Services Freemium Donation Grant Funding Dual license

16 Services Code is free and fully available Community contributes to code Funds are generated with Custom dev work Support Trainings

17 Freemium Free Open Source version, limited in capabilities Paid closed source Pro or Enterprise version Often gives tension between community and developers

18 Donation model Just Hope for donations to come in Larger orgs like FreeBSD & TOR foundation have fund raising rounds My feeling is that this is easier for end products than for libraries

19 Grant funding Government / foundations issue grants to push development in a certain area Often short term funding Especially for government: High administrative overhead Limited by fear of competing with market There are many such initiatives, but it's often hard to find them

20 Dual License Open source version for all Paid Non Open Source version for commercial integration Needs copyrights in one entity Contribution License Agreements (CLA) Needs trust in the company/organization Some people will refuse to sign & contribute

21 Code Contributions Not funding, but many project receive contributions in code and development time Often from companies that rely on it: Redhat, Google, etc Or companies that want their platforms well supported/optimized: Intel, Tilera, other hardware vendors

22 Why do devs go OSS? Become (respected) part of community Resume building Idealism Pragmatism (e.g. rely on other OSS components) Just for fun Make a living?

23 OISF Open Information Security Foundation US based non-profit Owns Suricata code Community driven and controlled

24 How a Dutch guy was paid by DHS Indirectly, that is DHS university OISF me My US partner Matt Jonkman had to set up OISF Administrative overhead was significant, but reasonable Seed funding, not long term, so needed a plan for later

25 Industry takes over from DHS Open Source owned by Non-Profit GPLv2 makes commercial integration tricky Suricata was designed to be a building block, not an end product Dual license model to get industry to help sustain development

26 Consortium

27 Services enter the picture Trainings for users and developers Users: 2 day trainings Devs: 5 day trainings Revenue goes into foundation for paying devs Taxing on team: preparation, travel, actual training time Needed to support development, but slows it down at the same time

28 Don't forget grant funding Currently on a project from US Department of Energy (DOE) through Georgia Tech Research Institute (GTRI) Goal is to develop ICS/SCADA protocol support for Suricata Development driven by grant requirements Administrative overhead

29 How is it going for us? Started great (seed funding) Slowed down after that (transition) Needed side (suricata related) contracting to pay rent Currently stable and growing slowly Dedicated fund raising and relation management team member Goal is to grow funding, dev team world domination! Conclusion: it's harder than expected, but it can be done :)

30 Funding Conclusions It's possible to live off of Open Source development But it's hard, requires lots of work, connections and some luck Administrative overhead is a barrier, esp. for tech people Many in open source are very passionate about their work, so blanket funding might be relatively risk free Mismatch between funders and fund seekers?

31 Discussion: Who should fund OSS? Government? Universities? Charities & foundations? Companies? Or none at all?

32 Thanks! OISF: Suricata: Evebox: Me: PS: we have our 2 nd Suricata User Conference planned for Nov 9 to 11 in Washington, DC