Study Recommends Mac OS X as Safest OS

rocketjam writes "The British security firm mi2g has concluded a comprehensive 12-month study to identify the safest 24/7 computing environment. In the end, the open source BSD and Mac OS X came out on top with the fewest security breaches against permanently connected machines worldwide in homes, small businesses, large enterprises and governments. The study found Linux to be the most breached environment 'in terms of manual hacker attacks overall and accounts for 65.64% of all breaches recorded'. Windows was the most breached environment in government computing and led Linux, BSD and Mac OS X by far in economic damage caused by breaches." We mentioned their previous study too. As before, the study ignores the thousands of automatically-spreading viruses for Windows.

Comments

Breaches Recorded

[kevjava]

As a Mac user and Linux guy, I have to say that this kind of study is a little tilted... how many Mac users and Windows users really know how to record a breach into their machine? Neither ships with process accounting on out of the box, to my knowledge.

I recently had some puke engage in comment spamming my website. Traceback revealed he was using a Windows XP machine infected with the Subseven trojan. I'd be willing to bet that breach was not recorded.

Sources?

[truthsearch]

I can't find the source of the reported breaches. How did they determine which breaches to investigate? Were they only breaches reported to them? I can state for a fact that many companies do not report breach attempts to anyone. So this investigation probably isn't of a very accurate sample pool.

Security by obscurity?

[the_mighty_$]

I am glad you pointed out that this is about manual exploits, NOT about which OS has the best security. If we were talking strictly about vulnerbility the story would be quite different. Quite simply, Mac OS would lose (IMHO): http://www.computerweekly.com/articles/article.asp ?liArticleID=131513&liArticleTypeID=1&liCategoryID =2&liChannelID=22&liFlavourID=1&sSearch=&nPage =1

Not only safe but fun!

[ericdano]

Seriously. The Mac OS is much more "fun" to use. I have a Windows XP and a Mac OS X machine next to each other. I find myself using the Mac one more. Not cause it's faster, it's not (933 machine compared to a 2.5 machine), but the experience is more enjoyable.

Not that this matters. But it's also good to know its safe. But how many people actually direct connect to the internet? Doesn't it make sense to have some sort of cheap firewall/router box to protect you?

Re:Before people go nuts...

[Stephen Samuel]

Wait! Everytime Microsoft makes this argument in defense of Windows shoddy security, Slashdot laughs them down. Suddenly the argument is valid for Linux?

The response to the 'popularity' point for Linux vs Windows is that the popularity of Windows does not come close to explaining the statistical difference... Counterexamples include considering that Linux is a fer more popular internet server than Windows is, but still gets fewer total exploits in that field.

For Linux Vs Mac, It's harder to say that the difference is or isn't due to the market share, and the authors are simply acknowledging that. Perhaps, in time, someone will do a study to attempt to distinguish that difference (and we can then bash and/or praise that to our hearts' content)

My conclusion, too

[upsidedown_duck]

My own anecdotal experience would be roughly the same (sans OS X experience). I have known someone whose Linux box was rooted, but it, too, was a manual attack. Windows goes without saying. OpenBSD goes without saying, too (oppositely, of course).

Linux is a very good general purpose OS, but it's development is volatile enough that it requires a conservative approach with respect to security. I would use an older more mature kernel along with manually paring down the rc directories and inetd.conf, among other things. OpenBSD, on the other hand, is stripped out of the box, and the user must add services. I generally feel that Solaris ranks more with Linux, in that a manual hardening effort really is necessary. Never would I put Windows on the Internet--it would be like swimming in the ocean with steaks tied to my legs.

Re:Before people go nuts...

[geoffspear]

I don't argue that Linux is more secure than BSD; I just think that arguing it's less secure based on this study is ridiculous. I'm an OS X user and I'm heavily in favor of BSD-style licenses (I've only ever contributed to projects with BSD licenses, in fact), but it's impossible to take a "victory" away from anyone here. There's no victory because the report is meaningless.

The sad thing is that they apparently went through a lot of effort to collect data, but at least as they've presented it the data makes it impossible for anyone to draw any conclusions. The whole thing was wasted effort unless they've got some more data they didn't bother putting into the study, that can show successful attacks as they relate to attempted attacks against each platform, or at least related to how many of each platform are actually installed and meet their criteria.