If you are like me, and you have been involved in cryptography and Cyber Security for a long time, it's obvious to you that commercial open source code is more secure. As a matter of fact, in the late 90s, many of the Intelligence agencies mission systems and the DoD tactical systems moved to open source ONLY to improve security. Today, the majority of the critical systems in the Intelligence agencies (the people that care most about Cyber Security) run on open source operating systems like Solaris and Linux. The same is true of places like the FAA, IRS, and a whole lot of other organizations that care about security.
We have a saying in the world of Cyber Security: Security through obscurity, isn't. However, to many, it may not be so obvious, so let me walk you through some of the reasons that commercial open source software tends to be more secure, then I will give you some data at the end to back it up.
First of all, you need to look at the supply chain issues. The reality is today, that ALL software is written globally. You need to deal with the fact that Microsoft, Oracle and IBM software is written in India, China, and Russia. In fact, the majority of all software, open or not, is written all over the world. By making the code open source, nothing can be hidden in the code. 
If the Trojan Horse was made of glass, would the Trojans have rolled it into their city? NO. Open governments are more secure for their citizens, and open source software is more secure for anyone running it. Public scrutiny is a beautiful thing. Just look at free press in this country and open government. We want and need security, peace and tranquility for our citizens. The founders of this country based our government on openness. Open Source enables security. It's pretty obvious when you think about it.
I'm not the only one saying that, of course. One recent examination is in the light of large scale computer intrusions detected coming from a PRC based hacker group. This week the New York Times and CNET ran a story by John Markoff titled "Vast
Spy System Loots Computers in 103 Countries" which details these
attacks. In a related technical report issued by the University of
Cambridge "The snooping dragon: social-malwar surveillance of the
Tibetan movement" on these widespread series of attacks, researchers point out many ways these threats could have been mitigated, including strong endorsement of open source SE Linux and Trusted Open Solaris.
Let me give you another analogy...
I usually like to use car analogies, but lately I've been using this suitcase analogy to make my point about open source and security. Imagine you enter the security line at the airport and there is a proprietary vendor in front of you with his locked suitcase telling the TSA official not to worry, and to trust him, stating he has checked everything in his suitcase and it is safe. How would this make you feel? Pretty vulnerable...right? Wouldn't it be better if the person in front of you is a true open source advocate and welcomes the TSA official to check anything he wants...because he has nothing to hide?
Who are you going to feel safe about getting on the plane with? It's a no-brainer...so why would you trust a vendor to put stuff on your server with life critical or mission critical systems, where no one can see what is on the server except for that one company, or that one group of people. I have sometimes heard some proprietary vendors say about open source code "but everyone can see how the security works." They are making the point for me! That is why open source code has to be made stronger on open source than on proprietary software products.
Proprietary (closed source software) developers say “trust us.” Commercial open source software developers say “see our security...everything we do to build security in: our documentation, models, architecture, review processes, programming language selection, coding standards, source code, verification analysis methods, instrumentation, tools, techniques, automation, certification, ongoing deployment risk management results, remediation, ...” You get the picture. For commercial open source software the security advantages are more than just the ability to view the source code, it's the entire open technology development life cycle that begins with security fundamentals and security goals very early in the process.
The newly announced Building Security In Maturity Model is a great way to openly see how experts can analyze the effectiveness of a software security group and it should be apparent that having commercial open source software developers allow their data collected and security initiatives assessed in public view will increase their resulting security if properly vetted. Think about it, all physical security is open source. You can go to any lock and see how it works at the patent office or on line, but that exposure only makes it more secure.
I often hear from the proprietary vendors that they have "the right" people reviewing their code. That proprietary vendor guy in my suitcase analogy probably had "the right" people back at the office check his suitcase (in China), so the TSA official should just allow the suitcase to go through security without checking it...right? Wrong. With Open Source EVERYONE is looking at and in the suitcase...Even the intelligence agencies.
The Intelligence agencies are part of the Open community that look at code. Keep in mind there are millions and millions of lines of code out there. In Microsoft it's like 30 million lines of code, Oracle I would guesstimate at 15 million lines of code. Solaris has 20 million lines of code. (See page 19). Then you add Linux in at around 12 million lines of code and MYSQL... it compounds quickly. There is no way that a few hundred experts can really review all of the code out there. It truly takes a village.
To make the point even more, when Sun open sourced Solaris - Solaris previously had the highest rating in security that the government offers in enterprise operating systems and still does today. Plus it is certified by the federal government, reviewed by all the best experts in Sun (there are a lot of smart of people at Sun) the intelligence agencies and lot of other smart people out there in the community. When we released the code, within one month we had 28 new vulnerabilities identified by the 160,000 people that are in the Solaris community, and we were able to fix them before some one used them to do something bad.
Same thing happened when we opened sourced Java. Java has had almost no security issues in its entire history. There were three or four issues that came up that we were able to fix before someone could use them for wrong doing. As soon as you move to Open Source there is a lot more that the community will pick up, and you are going to fix it before it can be used for an infiltration rather than after.
So that's why the national security agencies and others made this big initiative to move to open source, because, the public scrutiny increases the quality of the code just like it does with physical security. You know when you use the RSA algorithm, which you use every time you buy something online. The algorithm was done in the public, it was done in Open Source, it was criticized, it was changed, it was criticized again, and it was changed before it was put into production because we have got lots of people looking at it, lots of people criticizing it for security.
Then there was the clipper chip. So the clipper chip was done by the Clinton administration, you may or may not remember it, and the whole idea of the clipper chip was, we won't tell you how it works but you should trust it is secure.
The clipper chip was compromised within 48 hours of its release. Why, because it had a secret in its code inside the lock, the inside was made of paper (they used a 16-bit checksum). It was not open sourced, so it was immediately compromised. Had it been open source, everyone would have seen the weak checksum, and it would have been corrected before it was deployed. The RSA algorithm to my knowledge has never been compromised today other than (brute force).
Remember, security through obscurity, isn't. How many times do we have to see that truth repeated? If you look at common criteria certifications, the two enterprise operating systems with the strongest protection profile and the strongest certification are both Open Source. Open Source drives more security.
Eventually, the trend toward higher assurance levels will hopefully benefit from new open source projects such as Open Proofs and related open source tools such as Why with the associated formal methods open source software components. Again, Open Source drives more security.
If you take a look at the National Vulnerability Database, you can see almost every open source product has had less vulnerabilities exposed and less vulnerabilities exploited against it than the equivalent proprietary products. The NVD is a product of the NIST Computer Security Division, Information Technology Laboratory and is sponsored by the Department of Homeland Security’s National Cyber Security Division.
Here is some risk data provided by the Airius Risk Report® developed from Homeland Security's NVD. 
Here you can see that all the proprietary software products have a MUCH higher security risk than their open source equivalents.
Here they are side by side, and you can see in each case, the open source product is statistically more secure. So the Data does back up the logic. And it's not like the open source products are not widely deployed either...There are over 6 billion Java deployments, 14 million Open Solaris, 120 million Open Office, and 115 million MySQL deployments.
Clearly security is the number one reason to move to open source...Check back soon for the number 2 reason to move to open source.
Airius Risk Report:12/31/07, Copyright Airius Internet Solutions, LLC 2009
Governments do not need to settle for the packaged solutions that a vendor is selling them. They can take existing open source solutions, join the community process, and add the features that are right for them, not what a vendor “thinks” is right for them. This is happening all over the government in the Intelligence agencies with examples like FMAC and SE Linux in places like NASA with the World Wind Java 3D project DISA's Government Forge.mil project and many, many, more.
However, if the product is open source, because you can see how the interfaces are implemented, it makes reverse engineering them a much more simple process. Being able to see the source code also aids with interoperability, because it removes any ambiguity on how the interfaces are implemented.
