Posted on 02/16/2005 10:13:59 AM PST by ShadowAce
Comment There are rare occasions in IT when a particular architecture reaches a point where it stops being purely IT driven and takes on a life of its own.
The last year has seen the open source movement reach such a cult status; and at the vanguard of open source fashion can be found the Linux operating system. While the platform appeals at several levels for potential users, some of a philosophical nature and others far more concrete, it is noticeable that a couple of its qualities have recently been called into question.
Microsoft, a supplier of operating systems with which Linux competes, has recently taken to the press to question two of the pillars upon which Linux and Open Source have made their names - cost of ownership and security. Now questions concerned with the cost of ownership of any system, Linux, Windows or otherwise, are incredibly complex to resolve and, frankly, very few organisations have any idea regarding how much they spend on IT ownership at a system, application or platform level.
However, when it comes to the question of security regarding Linux as a platform, Nick McGrath, head of platform strategy for Microsoft in the UK, has been quoted as saying: "The biggest challenge we need to face centres on the myth and reality. There are lots of myths out there as to what Linux can do. One myth we see is that Linux is more secure than Windows. Another is that there are no viruses for Linux."
In one respect, McGrath is correct and this concerns the lack of malicious code threats to Linux. Over the last few months, several instances of malicious code have been discovered that target Linux explicitly. However, the number is extremely small compared to the number of attacks launched against Microsoft Windows, and indeed against several other operating systems.
There are several factors behind there being a far smaller number of attacks against Linux. Not the least of these is the fact that the platform, whilst it is gaining traction fast, is still relatively small in the world of business critical production systems. It will be interesting to see how the attack threat develops as Linux continues to move into everyday business use, although the open availability of the code base on which Linux is built should help to minimise the number of security holes that exist in the code.
However, some people are also questioning whether the open source model itself can provide organisations with both the security and the comfort that they require to run Linux in vital operations. Once again, McGrath asked the question: "Who is accountable for the security of the Linux kernel? Does Red Hat, for example, take responsibility? It cannot, as it does not produce the Linux kernel. It produces one distribution of Linux."
In this area McGrath is completely missing the point. In the vast majority of circumstances, when a customer builds a solution on the Linux operating system, they do so using a distribution of the operating system, not the kernel alone. And when a mission critical system is deployed, it is almost unknown for the organisation concerned not to take out support cover for the operating platform. With major IT vendors such as IBM, HP, Novell (SuSE) and Red Hat offering to support Linux, there is no shortage of suppliers willing to provide as good a security guarantee, in terms of patch management, as that provided for any other operating system, including Windows and the leading Unix platforms.
Using Linux is itself no guarantee of "security". The same is true for all operating systems. Each platform needs to be managed actively. Bugs, viruses and other malicious threats to a system will occur. This is why it is vital that every IT system be supported with excellent management procedures to ensure its long term availability and security. Technology alone is never "secure".
However, there are no obvious security issues visible today to indicate that Linux is not ready for enterprise deployment. The code base is managed by all of the distributors and enjoys the active backing of many of the largest IT vendors. Security and Linux may be a myth, but no more so than for any other operating system. A Linux platform needs to be managed in the same way as any other. However, at the moment, the number of threat notices that the operating system attracts every day is relatively small.
Linux does have an active role to play in business and the platform continues to mature rapidly on all levels, including security. Is it perfect today? No. Is it perfectly secure? No. But then no operating system available today is perfectly secure, although zOS on the IBM mainframe gets pretty close. Is Linux "Security" A Myth? Yes, but then all "security" is a myth; people and processes secure systems, not technology alone. However, Linux is usable, relatively secure and enjoys support enough to allow its use in mainstream business where appropriate. Oh, and it is being used.
Linux Security ping!
Wow! An entire arcticle that says nothing.
Yes, it is. There's very few people looking for holes in the code to launch malware upon because the payoff of potential victims is so small. Also the code is wide open for anyone who may decide to one day begin looking for holes in Linux, and that includes the malware authors.
Open source proponents claim the number of "good eyes" will exceed the number of "bad eyes", but that's only their hope, they have no way of quantifying their claim. In fact, attempts to show that ANY good eyes were reviewing open source code for security issues have failed, such as this:
http://www.securityfocus.com/news/7947
I posted this partially as a discussion point, but also as a refutation of that myth.
And, of course, hiding the code has proven to work wonders, hasn't it?
I believe this is so, same with Macintosh security. The simple reason is that there installed base of Windows dwarfs the rest combined.
Now, open source MIGHT have an advantage because of the "good eyes", but that remains to be seen.
Don't bust my chops either, I have a Mandrake 10.1 installation at home, and am in the process of justifying me a miniMac purchase!
This does not address the end-user security issues, which involve millions of ignorant users running Windows on the desktop and connecting to the internet.
They would almost certainly be helped by running Linux instead, because they would be running under a user account and not as root. If you're a desktop, you don't have to offer any network services, so they'd be as close to completely secure as you can be.
Eh. Linux and Windows fanboys aside there are no absolutes in IT -- esp when programmers are involved. Linux core most likely is more secure. But like anything else, who runs 'kernel' as their enterprise service(s). Lump on the IIS, Apache, PHP, .Net, SQL, CGI, then get ready to get hacked ;)
MS FUD ALERT!!!
Not only that, they also think that Firefox/Mozilla, Opera, Lindows, Apple, (anything but Microsoft) is the world's savior and can do no wrong, never get a virus, never get spyware and never crash. And all the problems with all internet connections is the result of the villians knows as Microsoft.
Who knows... all I know is I'm spending too much time applying "fixes" to about 70 machines.
Going behind a secure, disconnected LAN next week. One gateway/firewall to the world. I'm fed up.
Err...there IS a group working at getting Linux (or at least one distribution thereof) formall certified as being military-level secure, something Windows can't claim.
(Don't have the details handy, but they're out there nonetheless.)
Linux is definately not bullet proof, but out of the box it blows Windows away, and configured by a competent security person, it makes Windows, even if configured by a competent security person look very poor.
As software becomes commodity, opensource will continue to dominate. Commercial software will be left with niche specialty verticle markets.
Not to be a stickler, but if you run Linux and then want to run IIS on it, let alone .NET you probably have issues above and beyond your security plans.
Err...I work for the DoD and our Windows sytems have overall higher classification ratings than any version of Linux.
Zone-h has taken over for attrition.org in maintiaing realtime stats for overtly compromised websites. Today, like most any other, Linux is taking a beating...
196 single IP
267 mass defacements
Linux (78.4%)
Win 2000 (14.7%)
FreeBSD (3.0%)
MacOS (1.5%)
Win 2003 (0.9%)
Win NT9x (0.4%)
SolarisSunOS (0.2%)
Before you ask, I'm at home on my lunch break. Heading back now. OUT.
Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.