Slide 1

Jason Ming Sun ICT Academic Systems University of South Africa jmingsun@unisa.ac.za Government CIO Summit Towards reducing costs of doing business in government and contributing towards achieving clean audit 1 Date: 29 May 2013 Slide 2 Commission 2 2 FOSS Security Slide 3 Commission 2 3 Slide 4 FOSS @ Unisa 4 Slide 5 Community Source www.sakaiproject.org 5 Slide 6 Sakai is 6 Slide 7 Sakai Community Model pilot, production Adopt code, resources Contribute practices, processes, tools and technology Share community, commercial Support 7 Slide 8 Sakai Community Model 8 Slide 9 Sakai Software Suite: CLE 9 Slide 10 Sakai Software Suite: OAE 10 Slide 11 Sakai Foundation 11 The Sakai Foundation has a [more] defined leadership structure in order to ensure that the Foundation's mission to support the community and software is fulfilled. Still, the Board is elected by the members of the community, specifically those institutions that are members of the Sakai Foundation. The Board, in turns, oversees the staffing and financial health of the Foundation. With this structure, the community truly leads the Foundation; the Foundation serves the Sakai community. Slide 12 Sakai is 12 Slide 13 Sakai Security Policy 13 Sakai Foundations commitment to Information and Application Security Security Work Group Vulnerability Classification Security Advisory Protocol Slide 14 Sakai Foundation Commitment 14 Sakai is an open-source software initiative that promotes knowledge sharing and information transparency. However, when dealing with security vulnerabilities the integrity of existing Sakai installations can be compromised by the premature public disclosure of security threats before the Sakai Community has had time to analyze, develop and distribute countermeasures through private channels to institutions and organizations that have implemented Sakai software. Recognizing this danger, the Sakai Foundation has developed a security policy that seeks to safeguard the security of existing Sakai installations as well as provide full public disclosure of Sakai security vulnerabilities in a timely manner. Slide 15 Security Work Group 15 The Sakai Community has instituted a Security Work Group (WG) composed of senior members of the community to respond to reports of security vulnerabilities and who operate using private channels of communication. Besides working to resolve known security vulnerabilities the Security WG will also operate in a pro-active manner, reviewing existing tools and services from a security perspective; defining Sakai security requirements; devising QA/testing models that identify potential security weaknesses; producing security-related documentation; and helping educate developers on web- related security vulnerabilities. Slide 16 Of interest 16 Latest offer by a community member to help educate developers in terms of secure application development: 2 May 2013 Slide 17 Vulnerability Classification 17 Critical Risk the possible exposure of data to unauthorized viewing, modification, deletion or acquisition as well as data corruption Major Risk attacks that could compromise the availability of Sakai or otherwise degrade system performance Minor Risk Slide 18 Security Advisory Protocol 18 3 2 1 Alert Sakai Foundation Partners and designated security contacts with known Sakai implementations Slide 19 Security Advisory Protocol 19 3 2 Alert the wider Sakai Community 1 Alert Sakai Foundation Partners and designated security contacts with known Sakai implementations Slide 20 Security Advisory Protocol 20 3 Alert the Public 2 Alert the wider Sakai Community 1 Alert Sakai Foundation Partners and designated security contacts with known Sakai implementations Slide 21 Of interest 21 Last major vulnerability reported: 15 December 2011 Slide 22 General Security Guidelines 22 download IDE/Compiler/JDKFOSS CodeFOSS Binaries Slide 23 General Security Guidelines 23 Download from source: FOSS Binaries FOSS Code Compilers, Integrated Development Environments (IDE), Software Development Kits Slide 24 General Security Guidelines 24 Verify authenticity of the site: Slide 25 General Security Guidelines 25 Establish an update schedule for security patches at a operating system, application server and application software level. Manage change in your ICT environment according to governance frameworks including ITIL and CoBIT. Slide 26 Cost factors 26 Slide 27 Cost factors 27 Financial resources Optional partnership fees Human resources Physical resources Slide 28 Sakai Foundation Partners Program 28 Sakai partners are paying members of the Sakai Foundation who provide the intellectual, human and financial capital necessary to support both the Foundation and the work of the community. Unisa is a Foundation Partner. Slide 29 Sakai Foundation Membership Fee 29 Regular membership USD 10 000 (ZAR 95 000) per year, renewable annually. Discounted membership USD 5 000 for institutions with limited enrollments (less than 3000) (ZAR 47 250) per year, renewable annually. Slide 30 Sakai Foundation Partners Program 30 Become a member if you want to: Participate in foundation governance Help determine priorities for the community Collaborate in every phase of the software production process Slide 31 Cost factors 31 Financial resources Human resources Super User (train, support) System Administrator (configure, implement) Database Administrator (MySQL/Oracle) Technical Contributor (develop in Java) Physical resources Slide 32 Unisas ICT team 32 Financial resources Human resources Super User/Trainer Business Analyst System Administrator/Integrator Oracle Database Administrator Java Software Analyst-Developer Physical resources Slide 33 Cost factors 33 Financial resources Human resources Physical resources Server hardware or hosting plans (cloud) Slide 34 myUnisa tech architecture 34 Software load balancer [SSL end-point] Internet Firewall Virtualized app server Database server Slide 35 myUnisa tech architecture 35 9 virtualized application servers Ubuntu Linux Server LTS Apache Tomcat 1 virtualized load balancer Pound 1 physical database server Oracle 11g Slide 36 In Summary 36 Slide 37 FOSS Security Success Factors 37 FOSS Security Active Code Review Community Advisory Protocol Trust the Source Keep abreast with security patches and updates Slide 38 Reference links 38 https://confluence.sakaiproject.org search for security policy http://www.sakaiproject.org Slide 39 Thank You 39