eWEEK content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More.
Mozilla is well-known for its open-source Firefox Web browser, which is a key target for attackers and security researchers looking to exploit Web users. Standing on the front line of the battle to help keep Firefox and its users safe is Mozilla Director of Security Assurance Michael Coates.
In a video interview with eWEEK, Coates explains what his role is at Mozilla and how the open-source organization goes about building security into everything it does.
Coates runs the security assurance team at Mozilla which focuses on security throughout the lifecycle of everything that Mozilla builds.
“We make sure that everything we do [including] development, deployment and ongoing maintenance is secure,” Coates said.
Security is part of the early development process for features with threat modeling being a key part of the process. Code review tools are used once code has actually been written to help identify potential issues. Then after a software release has been made generally available, Mozilla has a bug-bounty program, which rewards security researchers for responsibly reporting security flaws.
Overall, Coates noted that in the last several years there has not been many issues where there has been an exploitable Firefox issue that has actually put users at risk.
FirefoxOS
Mozilla now develops browsers for Windows, Linux and Mac as well as its own FirefoxOS mobile operating system.
FirefoxOS has a particularly strong security posture from a user permission perspective.
“In other operating systems right now, the user doesn’t understand the permissions they are giving away, at the install time for a new app,” Coates said. “We have adapted a model where the user is prompted when the data is needed within the app.”
So for example, if a user is searching for a restaurant in a particular area and the app requests access to GPS navigation information, that makes sense.
Challenges
For Coates, when it comes to security challenges, his primary issue is dealing with security at scale. Being able to push changes through millions of lines of codes and millions of users is a challenge. The open-source nature of Mozilla and its overall transparency are helpful in overcoming that challenge.
“The elements that make Mozilla what it is are a real benefit for security,” Coates said. “We can talk about issues, and get the community and the brightest minds to try and tackle these problems.”
Watch the full video interview with Michael Coates, director of security assurance at Mozilla, below:
Sean Michael Kerner is a senior editor at eWEEK and InternetNews.com. Follow him on Twitter @TechJournalist.