I'm studying for the Certified Cloud Security Professional (CCSP) exam and am confused by some statements that were made regarding cloud application security. Specifically a statement on proprietary software vs open source:
Perhaps one of the main points in favor of proprietary options is the possibility that liability will map back to the vendor -- that breaches or other impact due to failures in the program can be blamed on the vendor, who may be help accountable (although it's difficult to think of examples where this has occurred).
I don't understand -- if I'm using opensource software to protect some asset in my organization, how does that completely absolve the developer? Are open source use licenses that good? Or is this predicated on the assumption that I'm not paying anything for open source software? Or perhaps it's based on the assumption that as a customer who had the opportunity to review the source code for security issues, I did?
Don't get me wrong, I'm not implying that everyone should have the means to sue open source developers (certainly not!!) but I want to understand why the cloud application security material in this course seems to have a blanket statement essentially saying "if you're using open-source security software, you can't hold the developer liable."