- [Instructor] There's a wealth of complete
free-to-use security software available for download
from the internet,
and we'll be covering many of these packages.
In addition, some commercial software vendors
provide community versions of their software,
which enables us to have a fully operational,
entry-level package at no cost
and then upgrade if we need the additional paid features
or vendor support.
We'll be covering some of these packages also.
There are many types of open-source software.
Some focus on just one feature,
while others offer a comprehensive solution.
Some offer detailed documentation,
and some have little more than a starter guide.
Some are workstation tools,
and some are server-based solutions.
The obvious start point for anyone wanting
to use open-source security software is, of course,
the Kali Linux workstation
and the Kali Purple server platforms
from Offensive Security.
These come as installed with hundreds of software packages,
and there are many more hundreds which are not installed
by default but exist in the Kali repositories.
We'll cover these tools shortly.
Another workstation platform is the Parrot system
used in the Hack The Box Labs.
When using open-source security software,
we need to be aware of its provenance, its quality,
and its integrity.
Open-source software doesn't often come with star ratings,
so we need to check it out ourselves.
We can do this by searching the internet for reviews,
or in this day and age,
we can ask our friendly AI assistant for advice.
For example, when I asked Copilot the question,
"Is Wazuh a good open-source software package?"
the answer is as follows.
I won't read this out,
but we can see that Copilot is very happy with Wazuh.
Of course, this answer is only as good
as the information Copilot was trained on,
but that's an issue for another time.
There's one area of use of open-source security software
that's come under scrutiny lately,
and that's the use of open-source libraries
built into other products, such as OpenSSH.
In 2021, the White House required all vendors
supplying software to the government
to provide a software bill of materials
showing the libraries incorporated in their products
in order to gauge the provenance, quality,
and integrity of the underlying product components.
Open-source software is a good option,
but one we need to be diligent about when adopting.