Rethinking the Datacenter Sponsored by HP
Today's datacenters need to increase utilization, get control over power and cooling costs, and align with business objectives. Download this eBook to learn about the challenges facing the data center in a world where digital information is growing at a torrid pace and costs are being held in check. Learn more. »
Putting the Green into IT Sponsored by HP
Electricity use in data centers is skyrocketing, sending energy bills through the roof, creating environmental concerns and generating negative publicity. "Going Green" means looking to technologies like virtualization, energy-efficient chips and racks, and implementing policies that extend beyond the data center. Learn more. »
Managing the Modern Network Sponsored by HP
In a global economy where information crosses the globe in an instant, and where Web-based applications power business, it's more important than ever to ensure your network is safe from threats and optimized to deliver the data your business needs. »
Evaluating Software as a Service for Your Business
Sponsored by Webroot
Is Software as a Service just hype, or is something really going on here? See if your company can benefit as SaaS tries to change the face of the enterprise.
»
Is Your Disaster Recovery Plan Good Enough? Sponsored by HP
Preparing for a disaster is more often than not part of the storage planning process, and it is one of the most difficult tasks, since it includes local hardware and software, networking equipment, and a test plan. Learn how to get disaster recovery right. »
Linux vs. Windows: Which is Most Secure?
March 16, 2007 By Kenneth van Wyk
I’m more secure on Linux than I am on Windows. Yup, that’s right. I have no doubt whatsoever that I am.
I started down this path by comparing how secure I am on a Mac vs. on Windows, then I compared Mac vs. Linux. To complete that trifecta, I guess it’s only fair to compare the end-user data security aspects of Windows against Linux.
Before I get into my rationale, though, just a little more background is in order. I started using a UNIX desktop way back in college and was always comfortable there. At my first couple of jobs after college, I mostly used UNIX workstations from Dec and Sun as my primary desktops.
Later, I started using Windows-based systems at the office, but never felt quite at home. I was constantly frustrated by the frequent reboots, lack of serious security capabilities (from my perspective), and such. Then, following a brief foray in OS/2, I quickly gravitated to running Linux at home so I could once again have a real multi-tasking working environment.
Nowadays, my primary desktop is on a Macbook Pro – the best computer I’ve ever owned, without any doubt.
But, I still run a Debian Linux infrastructure for my company, with a couple Samba servers at its core. It’s not uncommon for the Linux systems to go over a year in between reboots. And, I still use XP on another laptop from time to time, generally when a customer requires it or I absolutely must run something like ActiveX controls on a web site. I try my best to learn how to best use the security features of each OS I use, naturally.
So, with that background in mind, it’s clear my views are somewhat biased. However, I consider myself very open-minded and will always give credit where it’s due. Heck, some of my best friends use Windows (but I do my best to talk them into OS X anyway).
• True to UNIX. It’s tough to be entirely fair here, since Windows isn’t UNIX in any sense. But my point here is that Linux does follow the security features and capabilities it inherited from UNIX quite closely. In particular, the notion of an administrative (root) user that maintains and operates the system, and desktop users who only run the software on the system, is completely ingrained in most Linux distributions.
Now it’s true that many Linux users ignore these features and run all their software from a root-level account anyway, but that’s a choice that they’ve made. The system defaults to protecting the operating system components from its user’s actions (intentional or otherwise). That feature alone must account in large degree for the dearth of viruses and other malicious vermin on Linux and UNIX platforms.
Windows, on the other hand, started life as a single user system, with that single user being all-powerful. Although that’s no longer the case, the general attitude can still be found in many Windows-based software products – many of which just can’t be installed and/or run properly without desktop administrator privileges. This is all changing for the better, but it took Microsoft far too long to adopt this default-secure configuration practice.
Qualitative score: Windows gets a D+ while Linux gets an A-.
Kenneth van Wyk, a 20-year veteran of IT security, is the prinicpal consultant for KRvW Associates, LLC. The co-author of two security-related books, he has worked at CERT, as well as at the U.S. Department of Defense.
Tools:
Add www.esecurityplanet.com to your favorites Add www.esecurityplanet.com to your browser search box IE 7 | Firefox 2.0 | Firefox 1.5.xReceive news via our XML/RSS feed
Rethinking the Datacenter
Putting the Green into IT
Managing the Modern Network
Evaluating Software as a Service for Your Business
Is Your Disaster Recovery Plan Good Enough? 
By 
IE 7
Firefox 2.0
