Linux vs. Windows security (page 2 of 2)

In some cases, Windows will even allow digitally signed code to be supplied from outside the system, which means a local systems administrator can't audit the code. Instead the system administrator is dependent on whoever signed the code to perform an appropriate code review.

Application security is improved for Microsoft-only applications on the .NET Framework. Of course, for IT shops with heterogeneous platforms, e.g., Linux, Windows, Unix, and especially for applications built on Java, application security for Microsoft-only products is limiting.

Recommendations

Linux provides superior -to comparable security capabilities in comparison to Windows. Still, the security of a Linux system is largely dependent on the choice of a Linux distribution and the kernel it is based on and the skill of the IT staff to implement and support a Linux system.

In selecting an operating system consider architectural design and the quality and feature/functionality of its components.
Since your success in implementing and maintaining a secure operating system rests with your IT shops, make sure that they have the training and expertise to deploy, manage, and troubleshoot.

Keep in mind the differences and distinctions between operating systems will remain relevant for the foreseeable future even with the potential of Web services and the use of abstraction layers to simplify application resource allocation and manageability.
For CIOs and CTOs security will continue to be a key area of focus due to business continuity and regulatory mandates.

We recommend that users start with an analysis of their operating system security by becoming familiar with key security capabilities that are required to meet the organization's need for functionality, which will reduce risk and ensure compliance.

If you are considering migration to a different operating system or upgrading your current product, select an operating system environment based on a qualitative analysis of security capabilities -- not point products. Formulate discipline on the part of the IT manager and system administrators who need to understand how to apply security best practices.

If you are seeking a quantitative analysis of security vulnerabilities in Windows, Linux or other operating systems start with a quantification of remote exploits vs. writes application attacks.

Looking at the security errata for a Linux distribution such as Red Hat or SUSE can do this. A list of operating system vulnerabilities with explanations can be found at www.securityfocus.com. Keep in mind that the severity of the attack and not just the number of attacks is also a key metric.

However, when business needs are combined with an understanding of operating system security capabilities functional requirements can be fulfilled, risk reduced and compliance ensured.