This month I was pleased to attend a public meeting of the
Open Information Security Foundation in Washington, DC. I got a chance to meet several people I have known for many years through their work with Snort, such as
Matt Jonkman,
Will Metcalf,
Victor Julien,
Frank Knobbe, and two guys from a federal agency that have extended Sguil way beyond what I knew anyone was doing! The group posted
DC Brainstorming Meeting Notes, but I wanted to record a few thoughts here.
OISF is a US nonprofit, a 501c(3). Their goal is to produce a new network inspection and filtering engine (IDS/IPS) that will be released under GPLv2. They can not and will not commercialize, sell, patent, copyright, or profit from the engine. Rather, others who participate in the OISF Consortium (listed on their Web site) are donating coders, equipment, and financial support in exchange for the ability to commercialize the engine.
OISF works with the
Open Source Software Institute, famous for getting
FIPS validation for OpenSSL -- something everybody wanted but no one wanted to fund alone. OISF is part of the
DHS Homeland Open Security Technology (HOST) program. OISF has received legal guidance from the
Software Freedom Law Center.
OISF has many goals for their engine, outlined in the notes I linked earlier. Most interesting is their goal for a production release by the end of this year. If they are to make this goal, I think the project needs to severely limit the requirements for the first release. I would focus on the following.
- Developing the rules language.
- Implementing IPv6.
- Implementing multi-threading.
Those three tasks are monumental, but they would immediately differentiate OISF from other options. There is talk within the project of semi-Snort compatible output, so you might send OISF data to a file in Snort Unified or Unified2 format to be read by Barnyard or Barnyard2.
If you want to know more about the project, the
Mailing Lists are the best option. As it develops I will discuss it here.
Thank you to anyone who voted for me to join the board of the Open Information Security Foundation. They are most famous for their Suricata intrusion detection engine, but I expect additional outputs as time passes. I appreciate those of you who supported my goal to join their board. I will try to provide fair and useful input to the project.
