OISF

OISF
Name	OISF
Type	Non-profit
Formation	2000s
Headquarters	Unknown
Region served	Global
Leader title	Executive Director

OISF OISF is an independent nonprofit organization focused on open-source network security research, software development, and community coordination. The organization collaborates with a wide array of partners across the technology sector, including industry consortia, academic institutions, standards bodies, and civil society groups. OISF's work influences software projects, incident response efforts, and policy discussions involving major vendors and interoperability forums.

Overview

OISF engages with projects and stakeholders such as Linux Foundation, Apache Software Foundation, Internet Engineering Task Force, OpenBSD Foundation, Free Software Foundation, Mozilla Foundation, Cloud Native Computing Foundation, Open Networking Foundation, Electronic Frontier Foundation, Center for Internet Security, Internet Society, European Union Agency for Cybersecurity, National Institute of Standards and Technology, MITRE Corporation, Carnegie Mellon University, Stanford University, Massachusetts Institute of Technology, University of California, Berkeley, University of Cambridge, ETH Zurich. Its remit includes collaboration with vendors and platforms such as Microsoft, Google, Amazon Web Services, Cisco Systems, Juniper Networks, Palo Alto Networks, Fortinet, VMware, Red Hat, IBM, Oracle Corporation, HP Enterprise, Arista Networks, Dell Technologies, NetApp, Broadcom Inc., NVIDIA, Intel, ARM Limited, Qualcomm. OISF often contributes to interoperability testing with projects like Suricata, Snort, Zeek (software), Open vSwitch, Wireshark, iptables, pfSense, pf (OpenBSD), SELinux, AppArmor, Kubernetes, Docker (software), Ansible (software).

History

OISF traces its roots to early 21st-century efforts around network intrusion detection and open-source security tools, alongside contemporaries and influences such as Guillermo Baltra, Vern Paxson, Martin Roesch, Clifford Stoll, Bruce Schneier, Eugene Kaspersky, Mikko Hypponen, Dan Kaminsky, Richard Clarke, Whitfield Diffie, Phil Zimmermann, Jon Postel, Ray Tomlinson, Vint Cerf, Bob Kahn, Tim Berners-Lee, Linus Torvalds, Eric S. Raymond, Ken Thompson, Dennis Ritchie, Grace Hopper, Alan Turing, Claude Shannon, Ada Lovelace, John McAfee. Throughout its development OISF interacted with policy and incident-response bodies including FIRST (organization), US-CERT, NCSC (United Kingdom), Europol, Interpol, CERT/CC.

Organization and Governance

OISF maintains governance relationships and membership models similar to Linux Foundation, Apache Software Foundation, Free Software Foundation, Open Source Initiative, Electronic Frontier Foundation, Internet Society, IEEE Standards Association, World Wide Web Consortium, IETF Modernization Initiative, OpenID Foundation, FIDO Alliance, Cloud Security Alliance, Trusted Computing Group, ISO/IEC JTC 1, NATO Cooperative Cyber Defence Centre of Excellence, European Telecommunications Standards Institute. Leadership and advisory boards have included figures from MITRE Corporation, SRI International, RAND Corporation, Brookings Institution, Center for Strategic and International Studies, Atlantic Council, Harvard University, Yale University, Princeton University.

Projects and Initiatives

OISF sponsors and participates in software and standards projects, joint initiatives, and testing programs with entities such as Suricata, Snort, Zeek (software), Open Information Security Foundation (legacy projects), Open Threat Exchange, MISP (software), STIX, TAXII, MAEC, CVE, CWE, MITRE ATT&CK, Common Vulnerabilities and Exposures, OpenC2, STIX/TAXII, ThreatConnect, Splunk, Elastic (company), Grafana Labs, Prometheus (software), Kali Linux, BackBox, Metasploit Framework, Nmap, OpenVAS, OSSEC, Wazuh, AlienVault.

Technology and Research

OISF's technical work intersects research and engineering communities around suricata, IDS/IPS architectures, network telemetry, packet capture, pcapng, NetFlow, IPFIX, sFlow, eBPF, XDP, DPDK, OpenFlow, BPF Compiler Collection, LLVM, GCC, Rust (programming language), C (programming language), C++, Python (programming language), Go (programming language), Lua (programming language), YARA (software), Snort (software), Bro (software), Zeek (software), OpenSSL, LibreSSL, BoringSSL, TLS (protocol), DNS (protocol), BGP, IPv6, HTTP/2, QUIC, DoH, and cryptographic standards bodies like IETF and NIST. Research collaborations include projects with Carnegie Mellon University, MIT, Stanford University, ETH Zurich, University of Oxford, University of Cambridge, Tsinghua University, National University of Singapore.

Community and Events

OISF engages with communities through conferences, workshops, and training linked to Black Hat USA, DEF CON, RSA Conference, BSides, USENIX Security Symposium, ACM CCS, IEEE S&P, Chaos Communication Congress, CanSecWest, KrebsOnSecurity events, FIRST Conference, SANS Institute, OWASP Global AppSec, Google Summer of Code, Linux Plumbers Conference, Open Source Summit, FOSDEM, REcon Montreal, ShmooCon, BlueHat, Hack In The Box.

Impact and Criticism

OISF's contributions have affected toolchains, incident response, and threat intelligence sharing used by organizations such as CERT Coordination Center, US Department of Homeland Security, European Commission, NATO, United Nations, Interpol, Amazon Web Services, Google Cloud Platform, Microsoft Azure, Alibaba Cloud, Tencent Cloud. Criticism and debate have arisen around topics involving adoption, funding models, transparency, and interoperability with standards promoted by IETF, ISO, NIST, and practices advocated by civil society groups like Electronic Frontier Foundation and Access Now. Academic critiques in venues such as IEEE Security & Privacy, ACM Transactions on Privacy and Security, and policy discussions at Brookings Institution and Carnegie Endowment for International Peace have examined trade-offs between detection efficacy and privacy, as debated by researchers like Eugene H. Spafford, Ross Anderson, Shafi Goldwasser, Ron Rivest, Adi Shamir, Leonard Adleman.

Category:Information security organizations