SYS-CON MEDIA Authors: Jason Bloomberg, Elizabeth White, Zakia Bouachraoui, Andy Thurai, Liz McMillan

Related Topics: Open Source Cloud, Cloud Security

Open Source Cloud: Article

Qualys Starts an Open Source WAF Project

IronBee open sourced, community under constuction

On Monday at the 2011 RSA Conference, Qualys announced that they were creating an open source Web Application Firewall (WAF) project. Companies create open source projects for a variety of reasons. Those reasons include attempts to commoditize a market, build a community, or dump a failing project. One way to understand which kind of open source announcement Qualys is making is to find out how they are investing in the project. If they are not allocating any resources to the new project, you can be sure this is the later kind of announcement, otherwise known as a “dump-and-run.” However, if a company has real people whose principal job is to work on this project in the open, then this project is for real. Communities do not build themselves any more, so trying to ascertain the level of “open source marketing” efforts can also shed light.

Several questions were sent to Qualys about this project, and here are the responses they sent. The responses were penned by Ivan Ristic, director of engineering at Qualys.

Q: Where did the name come from?

A: We spent a lot of time in looking for a good name for the project. Today, just having a reasonably unique name is difficult enough, but we also wanted something to represent the spirit of the project. We believe that the association with bees describes our intentions well, which is to build a community focused on mitigating application security issues.

Q: Why is Qualys doing this now?

A: Initially, the motivation came from our own need. We were looking to complement our current services with a real-time access control. There is an opportunity to integrate scanning with real-time mechanisms, combining the best of both world. Scanning is a pro-active activity that can be very deep and complements real-time monitoring which is continuous.

Q: Most companies open source a project when they want to a) commoditize a market or b) abandon a product but make the code available. Which one is it?

A: I don't believe it's either of those. We simply looked for the best possible approach to developing a complex product that needs to run in some very diverse environments. Only the involvement of a large community can deal with that diversity of environments. And only a liberal open source license can remove the barriers to wide adoption (including adoption in commercial environments, for example cloud and infrastructure providers).

Having said that, commoditization is likely to come as a byproduct of the approach. However, that will only change the playing field, moving it into a different direction. Because of the Apache 2 open source license, a high quality product such as IronBee will help everyone, not only Qualys.

Q: The INSTALL file says its not ready for users yet. When will it be?

A: We announced IronBee as early as practically possible, in the spirit of open source development. We with to involve others sooner rather than later. The first production ready release will be ready by the end of the year. Practically speaking, we expect to have a working product earlier than that.

Q: How many employees from Qualys will be working on this? Will they be full-time on this project?

A: The IronBee team currently consists of 3 employees, and we have 2 further positions open. With small distractions (on other projects, for example our SSL research), they will all work full time on IronBee.

Q: Will Qualys provide a community manager?

A: Yes, and we already have one -- Will Metcalf, a long-time open source contributor, is the community manager.

Q: How much will Qualys invest in "community development"? in USD.

A: I don't want to discuss the actual amount, but the size of the development team is a good starting point to estimate the size of the investment.

Based on these answers, it is safe to say that this is a real, serious project. Use of the Apache license shows that Qualys is serious about open-ness. The only concern is that the project is not fully functional at the moment, so open source developers should take a wait and see approach as to when this get to “release status”.

More Stories By Bill Roth

Bill Roth is a Silicon Valley veteran with over 20 years in the industry. He has played numerous product marketing, product management and engineering roles at companies like BEA, Sun, Morgan Stanley, and EBay Enterprise. He was recently named one of the World's 30 Most Influential Cloud Bloggers.

Latest Stories
The Software Defined Data Center (SDDC), which enables organizations to seamlessly run in a hybrid cloud model (public + private cloud), is here to stay. IDC estimates that the software-defined networking market will be valued at $3.7 billion by 2016. Security is a key component and benefit of the SDDC, and offers an opportunity to build security 'from the ground up' and weave it into the environment from day one. In his session at 16th Cloud Expo, Reuven Harrison, CTO and Co-Founder of Tufin, ...
While the focus and objectives of IoT initiatives are many and diverse, they all share a few common attributes, and one of those is the network. Commonly, that network includes the Internet, over which there isn't any real control for performance and availability. Or is there? The current state of the art for Big Data analytics, as applied to network telemetry, offers new opportunities for improving and assuring operational integrity. In his session at @ThingsExpo, Jim Frey, Vice President of S...
"We were founded in 2003 and the way we were founded was about good backup and good disaster recovery for our clients, and for the last 20 years we've been pretty consistent with that," noted Marc Malafronte, Territory Manager at StorageCraft, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
Historically, some banking activities such as trading have been relying heavily on analytics and cutting edge algorithmic tools. The coming of age of powerful data analytics solutions combined with the development of intelligent algorithms have created new opportunities for financial institutions. In his session at 20th Cloud Expo, Sebastien Meunier, Head of Digital for North America at Chappuis Halder & Co., discussed how these tools can be leveraged to develop a lasting competitive advantage ...
In his keynote at 18th Cloud Expo, Andrew Keys, Co-Founder of ConsenSys Enterprise, provided an overview of the evolution of the Internet and the Database and the future of their combination – the Blockchain. Andrew Keys is Co-Founder of ConsenSys Enterprise. He comes to ConsenSys Enterprise with capital markets, technology and entrepreneurial experience. Previously, he worked for UBS investment bank in equities analysis. Later, he was responsible for the creation and distribution of life settl...
DevOps is often described as a combination of technology and culture. Without both, DevOps isn't complete. However, applying the culture to outdated technology is a recipe for disaster; as response times grow and connections between teams are delayed by technology, the culture will die. A Nutanix Enterprise Cloud has many benefits that provide the needed base for a true DevOps paradigm. In their Day 3 Keynote at 20th Cloud Expo, Chris Brown, a Solutions Marketing Manager at Nutanix, and Mark Lav...
@CloudEXPO and @ExpoDX, two of the most influential technology events in the world, have hosted hundreds of sponsors and exhibitors since our launch 10 years ago. @CloudEXPO and @ExpoDX New York and Silicon Valley provide a full year of face-to-face marketing opportunities for your company. Each sponsorship and exhibit package comes with pre and post-show marketing programs. By sponsoring and exhibiting in New York and Silicon Valley, you reach a full complement of decision makers and buyers in ...
According to the IDC InfoBrief, Sponsored by Nutanix, “Surviving and Thriving in a Multi-cloud World,” multicloud deployments are now the norm for enterprise organizations – less than 30% of customers report using single cloud environments. Most customers leverage different cloud platforms across multiple service providers. The interoperability of data and applications between these varied cloud environments is growing in importance and yet access to hybrid cloud capabilities where a single appl...
"At the keynote this morning we spoke about the value proposition of Nutanix, of having a DevOps culture and a mindset, and the business outcomes of achieving agility and scale, which everybody here is trying to accomplish," noted Mark Lavi, DevOps Solution Architect at Nutanix, in this SYS-CON.tv interview at @DevOpsSummit at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
In today's always-on world, customer expectations have changed. Competitive differentiation is delivered through rapid software innovations, the ability to respond to issues quickly and by releasing high-quality code with minimal interruptions. DevOps isn't some far off goal; it's methodologies and practices are a response to this demand. The demand to go faster. The demand for more uptime. The demand to innovate. In this keynote, we will cover the Nutanix Developer Stack. Built from the foundat...
"NetApp's vision is how we help organizations manage data - delivering the right data in the right place, in the right time, to the people who need it, and doing it agnostic to what the platform is," explained Josh Atwell, Developer Advocate for NetApp, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
Sold by Nutanix, Nutanix Mine with Veeam can be deployed in minutes and simplifies the full lifecycle of data backup operations, including on-going management, scaling and troubleshooting. The offering combines highly-efficient storage working in concert with Veeam Backup and Replication, helping customers achieve comprehensive data protection for all their workloads — virtual, physical and private cloud —to meet increasing business demands for uptime and productivity.
"Cloud computing is certainly changing how people consume storage, how they use it, and what they use it for. It's also making people rethink how they architect their environment," stated Brad Winett, Senior Technologist for DDN Storage, in this SYS-CON.tv interview at 20th Cloud Expo, held June 6-8, 2017, at the Javits Center in New York City, NY.
A look across the tech landscape at the disruptive technologies that are increasing in prominence and speculate as to which will be most impactful for communications – namely, AI and Cloud Computing. In his session at 20th Cloud Expo, Curtis Peterson, VP of Operations at RingCentral, highlighted the current challenges of these transformative technologies and shared strategies for preparing your organization for these changes. This “view from the top” outlined the latest trends and developments i...
The Internet of Things is clearly many things: data collection and analytics, wearables, Smart Grids and Smart Cities, the Industrial Internet, and more. Cool platforms like Arduino, Raspberry Pi, Intel's Galileo and Edison, and a diverse world of sensors are making the IoT a great toy box for developers in all these areas. In this Power Panel at @ThingsExpo, moderated by Conference Chair Roger Strukhoff, panelists discussed what things are the most important, which will have the most profound e...