I’ve been thinking about this for a while and the tone of this year’s OWASP Global Summit has brought the topic to the forefront. OWASP, as many of you know, is a fiercely open source community. At times, participants defend its open and freeness a bit aggressively for my taste. Sure, open and free are founding principals of the community. I think these principals are essential, valuable, and worth protecting. However, I also believe the community-more broadly-would benefit from an evolved perspective.
Specifically, I believe OWASP should welcome branded security vendors and named individual practitioners into its arms openly. There are three reasons and as I outline them, think to yourself about what vendors like RedHat did for the Linux community.
First – Commercial entities can provide professional and enterprise-level support for OWASP projects to willing commercial entities. Code-based projects (like AppSensor, ESAPI, or other) are easier to imagine the impact of than others.
Second – Large entities seeking to participate within OWASP need assurances which the OWASP community hasn’t itself provided. Things I’ve heard loud-and-clear include:
- Anonymous participation for industry players working for sensitive organizations
- Structured feedback, steering, and funding for OWASP projects
Vendors do not uniquely possess the ability to provide these capabilities. The community could provide this value but has not prioritized it nor has it been able to convince industry it could appropriately address their security/anonymity concerns or provide tangible value. Vendors have much better luck in these regards.
Third, finally, and most Importantly – vendors desiring to enter the space should be seen as a welcome sign of maturity to the space. Maturity, to me, will mean key advancements:
- Larger and less ad-hoc budgets within organizations for application security
- The emergence of higher and more explicit standards for quality for the community’s free and open software/tools
- Convergence of the security community’s message, which will allow it to be taken more seriously
To facilitate this, I suggest the OWASP board do the following things:
- Explicitly endorse vendor participation, as long as it meets the community’s code of ethics and conduct
- Stop ‘the crank’ over people’s personal / corporate emails being used on OWASP lists
- Protect a commitment to technical quality by avoiding vendor pitches at conferences in chapter meetings, and in posting
I really don’t mind when people use their corporate email addresses when they mail public lists (OWASP or otherwise). As a chapter leader, I don’t (personally) mind when presenters show up with their company’s slide stock though I push them to use the chapter template. To me, corporate emails and slide stock help audience members identify and appropriately couch bias. Given my own profession and employer, my own biases should be evident.
On the community front, my roles spanning the gamut between OWASP Member, Chapter Leader, and invited industry advisor. I see my professional life and my community involvement as being mutually reinforcing and beneficial, rather than conflicts of interest. I enjoy having two outlets for my time and work. And, while, Yes there’s bad individual behavior out there, I’d like to see people more comfortable with their dual-roles. Again, I think their professional career, their volunteer community, and the industry as a whole will benefit.
