I was reading Chad Perrin’s post about Linux security vs. closed OS security, and since I’ve worked for years in both server environments, a couple of things struck me:
1. Linux has the advantage of the community spotting vulnerabilities and posting patches much faster than a closed OS like Windows. This is an obvious advantage in terms of quality and quantity of AVAILABLE fixes.
2. Windows updates are generally far easier to get and install (many times automatically). This provides an obvious advantage in terms of ease of staying up to date.
These two particular points are the most important, IMHO. I’ve been in several environments where people rely on the IDEA that Linux (and all of it’s apps) is secure enough (especially with that expensive firewall). These people will only upgrade once in a while, or will use a package manager like Yum to keep their system up-to-date.
Most Linux admins can tell you that many default package managers do not have up-to-date versions of many apps, so the systems remain vulnerable while the server lies unprotected from a slew of vulnerabilities. The end result here is that if a Linux admin does not regularly keep the systems up-to-date, then it’s a time bomb.
Anyone can look at the latest Changelog for a Linux app, see that the latest version fixed a vulnerability that could give attackers privileged access, start looking for servers that have not been patched yet, and take them over.
While Windows may be slower to patch holes, the process is so much easier that it often becomes automated by patch management software.
3. Someone pointed out that the most secure PC is the one disconnected from the network. The safest, greenest car is also the one that is never driven, but that’s not an option for most people.
4. A properly-configured firewall and NAT can eliminate a LOT of security woes. Patching that database server may not be as big of a concern if it is located on a part of the network that is not directly accessible from the outside.
All this said, I run Linux (CentOS or Fedora) servers whenever I can, because I believe that the true difference in operating systems is in performance. There’s simply no way for an operating system with a large GUI overhead to outperform a properly-tuned text-based system when using the same hardware. But that’s an expanded topic for another time.
