Re: [libreoffice-users] Security at Libre Office

On 17/02/2022 23:00, Anna Aeloiza wrote:

> I am looking to replace our Access Database.

LibreOffice does include a database component. However, your 
organisation will have to retain the services of an individual, or 
organisation to either migrate your existing databases to a database 
engine that plays nicely with LibreOffice, or write custom scripts that 
ensure that MicroSoft Access plays nicely with LibreOffice.

> How is your security at LibreOffice?

What is the threat model?
What is the use case for your organisation?

As far as security goes, pointing to the organisations that use 
Libreoffice does not mean anything, because good computer hygiene is the 
overarching behaviour. That said, it is telling that intelligence 
service of countries in Europe, Africa, and Asia have decried the use of 
Microsoft Office, and strongly urged the people and organisations within 
their country to use Linux and LibreOffice.

> Do you have two-factor authentication?

That sounds your organisation is looking for a cloud based solution.  As 
such, contact Adfinis (adfinis.com), Collabora (CollaboraOffice.com), or 
another commercial support vendor of LibreOffice, for assistance in both 
migration from your existing office setup, to LibreOffice, and ongoing 
support.

> I am sorry i dont know the terminology but our IT department would want to know the security of 
> your software. Thank you.

What threat models is the IT most concerned about?

CVE 2021-25635 was reported 19 January 2021, with the fix being included 
in the 7.1.1.1 release on 12 February 2021. Call that three weeks to fix 
what is arguably the most severe security related bug in the last three 
or four years.
To put that into perspective, _Project Zero_ reported (Feb 2022) that 
Linux developers take 25 days to fix a security issue, Apple takes 69 
days to fix a security issue, Google takes 44 days, and Mozilla takes 46 
days to fix security issues.

Despite the severity of that bug, were the people in your organisation 
to practice good computer hygiene, they would not have been affected by 
it, even if they were specifically targeted. This is the key to 
security. How well do the people in your organisation practice good 
computer hygiene?


Which security protocols and standards does your IT department need 
adherence to?

There is an alphabet soup of protocols, standards, proposals, and 
working agreements, some of which your standard LibreOffice install 
adheres to, some of which require installing an extension or two, and 
some of which require extensive customization.

jonathon

--
To unsubscribe e-mail to: users+unsubscribe@global.libreoffice.org
Problems? https://www.libreoffice.org/get-help/mailing-lists/how-to-unsubscribe/
Posting guidelines + more: https://wiki.documentfoundation.org/Netiquette
List archive: https://listarchives.libreoffice.org/global/users/
Privacy Policy: https://www.documentfoundation.org/privacy