Hyper Contextual Software Security Management for Open Source Software

Since the turn of the century, open source software (OSS) has been an active and dynamic research area. OSS development and maintenance are highly distributed processes that involve a multitude of supporting tools and resources. OSS communities use numerous knowledge sources while working on a certain task to help them secure the software products. These not only include security incidents statistics and best practice documents that are published in the open literatures or online communities, but also social networking tools. This often results in additional challenges, as not every OSS project member can correlate particular learned security information with their working context. This position paper outlines the security problems in OSS and describes the use of socio-technical system theory and ontology technologies to capture and model software security knowledge. Our research aims to develop and test a hyper-contextual, knowledge-based environment that stores and process security knowledge to facilitate retrieval in context, and thus allows the non-linearly correlated knowledge between contexts to be identified and transferred between and among OSS developers and users.