MS Security Chief Says Windows is Safer Than Linux

Kip Winger writes "Mike Nash, Microsoft's Chief Security Executive, has made claims that Windows is more secure than Linux. In a recent online chat, he staunchly defended Microsoft's record on security, basing part of his argument on how Windows Server 2003's 15 patches in the past year are far less than what RedHat or SuSE have had to endure." He also mentioned the recent purchase of Sybari and their Antivirus product.

Comments

What about

[beatdown]

the patched that they should have done?

Re:What about

[halivar]

Apparently, Microsoft policy is only to release patches for vulnerabilities that are currently being exploited.

And yes, this is flamebait. M$ can't (or won't) secure a paper sack, much less an operating system. More patches from Linux vendors means they're actually working on the freaking problem.

Re:What about

[Shkuey]

Apparently, Microsoft policy is only to release patches for vulnerabilities that are currently being exploited.

What about some of the biggest issues in recent history like blaster or code red? Both were patched by Microsoft well in advance of their outbreak. Irresponsible PC users cause a lot of the major security issues in this connected world; you can't put all the blame on Microsoft.

Re:What about

[Dolda2000]

More patches from Linux vendors means they're actually working on the freaking problem.

While that's true, there's another implication as well.

While the patches for Windows includes faults in, precisely, Windows (which is what I'm guessing that he's referring to by saying "15 patches"), the patch count for Linux distros include patches for all programs in the distro. That includes not only the core parts of the operating system. In the @RISK newsletter I'm recieving from SANS, I see almost only patches for more seldomly used software, such as ncpfs, Konversation, Dillo, xdvizilla, mpg321, and so on.

Considering how a Linux distro probably contains at least 10 times as many software packages as a Windows installation (the vast majority of which are optional to install), I can't see how it would be in Microsoft's favor that they're issuing one third as many patches as Linux distributors do.

Re:What about

[Feyr]

apples and oranges really. the 15 vulnerabilities for windows are to the core and system services. the 78 vulerabilities of suse include packages that aren't critical to system operation

a fair comparison would be only counting the patches to the kernel (~5 ?), critical software you can't remove (not sure), and i'd say apache (~ 2-3 ?), and then only the really critical ones (not in useless features that no one use and are disabled by default) (0)

don't get me wrong, i cringe every time there's a security bulletin for the linux kernel, it's a PAIN to fix. even worse than windows in my opinion (since linux servers aren't rebooted as often, you're never sure if the system will come back up properly due to changed lilo/kernel build options/little evil fairie)

Re:What about

[MrLint]

Well yes we do need to read what he actually said :

"Year-to-date for 2005, Microsoft has fixed 15 vulnerabilities"
"Red Hat Enterprise Linux 3 users have had to patch 34 vulnerabilities"
"SuSE Enterprise Linux 9 users have had to patch over 78 vulnerabilities"

Lets read these carefully, because MS are masters of spin. And we know that nothing they say on these topics arent carefully constructed to *sound* like they mean the same thing, but arent in fact the same thing.

MS says they have patched 15. This is not the same as the number that *need* to be patched, how many are still unpatched.

He says the other 'have had to patch' all this really says that the have been patches for 78 things. The only information we can glean (assuming the numbers are correct) is that that the number of things that have been fixed, also no info on what hasnt been fixed, or how many are outstanding.

So really MS isnt technically comparing the same things.

Please also see this comment for another shade of this, being OS patches vs app patches.

Re:What about

[einhverfr]

You ship it, you support it.

I agree, but the point is that it is still like comparing apples and oranges.

Better, lets look at the sum of the security vulnerabilities in the following software (with Server 2003):

Server 2003
MS Office (often gets installed on servers)
Internet Explorer
SQL Server
MS Exchange
ISA Server
Etc.

Now we have a fair comparison. These are all shipped by Microsoft and are about as likely to be installed on Windows Servers as the parallel software is to be on Linux servers.

Additionally lets look at vulnerability counts and their severity rather than patches released. That may provide a better picture.

Re:What about

[sg_oneill]

I'd say verry few of them.

What microsoft miss, is empirically and objectively your system is in a much higher danger of ACTUALLY getting hacked or virussed or whatever.

Lets see. Comparison time. When was the last virus outbreak that trashed linux systems world wide.

oh ...

Anyway, to be more fair, the other point is that most of these security bulletins for linux have been of the 'running nethack as root could break system' type pap that doesnt actually increase the chance of a break in in any sensible way. This is compared to the preponderance of serious worm inducing flaws in windows.

Microsoft can bleat as much as they like, and look I'll be honest, props for the fact that modern windows is probably safer than older windows, but this doesnt distract from a simple home truth:
Linux , Solaris and BSD is your best bet for a secure system. VMS if your a complete paranoid freak.

Statistics trumps rhetoric everytime

Re:What about

[LnxAddct]

Also don't forget that often times,the OSS vulnerabilities are typically theoretical.For example, you see something like a strcpy to an unchecked char pointer somewhere deep in the code. You may not know when its called, why its called, and what series of events might set it off, but you fix it anyway and out goes the patch. Your system then gets patched whether or not that code could have ever even been exploited.

With Windows on the other hand, everything is a severe and serious vulnerability because if some company, or university, or just your typical hacker finds something, it definitly works and can be exploited simply because they found it. It couldn't have been found without them actually executing the exploit.

There are a million other things though to take into consideration, like what you said about how RH and Suse have tons of other software bundled with them. An interesting thing is that RH, Fedora, and Suse are all (according to secunia) patched from all known vulnerabilities. Windows XP Home and Pro both have 18 unpatched vulnerabilities, at least one of them being "highly critical", and Windows 2003 also has 5 unpatched (out of 44). Software will have bugs, we should try our best to code securely, but its never going to work 100%. What is more important is not how many patches were sent out, but how many haven't been taken care of yet. In RH and Suse's case, they seem to be just fine, but Windows has tons of open flaws. OSS also tends to get patches out way quicker. Whats even cooler is that if RH patches something, then Suse can just use that, and vice versa, talk about efficiency.
Regards,
Steve

Re:What about

[The Dobber]

statistics trumps rhetoric everytime

If you're gonna use that angle, then you have to provide the data, or at least point to a source.

I think that I can say for most people here...

[rednip]

rofl

Microsoft is basing that claim by number of patch distributions, not by size for severity, cute. So, just because they (usually) wait up to a month to release a patch, somehow they are better FUD never had so much meaning. I'd be outraged, but words like this are so expected.

Re:I think that I can say for most people here...

[Zab UvWxy]

Ah, but you're missing an important part of the original posting; the reference was to Win2k3 only.

So, you state the words spoken between the lines, M$ is saying "forget our track record, forget what we said before, and ignore everything happening on our desktop systems; our server r0x0rs!", or something to that effect.

It's easy to say that one version of a server OS, that is becoming less and less like its' notoriously hole-ridden desktop bretheren, is so much better than *anything* the competition can offer. It's much harder to actually do something about it; considering they've been saying essentially the same thing for several years now, they're not much closer to achieving the goal of a "trusted, secure" OS.

Credibility and Redmond?

[basking2]

We see these posts trumpeted by entities like Slashdot. It it warrented? Does Redmond have any credibility on things like this left? Should we be paying any more attention to this sort of behavior than to just consider what MS is doing? :\ I'm more interested in the well thought out comments all-y'all have.

Re:Credibility and Redmond?

[CrankyFool]

Redmond has significant credibility within the sector that actually gives purchasing approval (rather than, perhaps, purchasing recommendations). When they come up with something like "look, we only released 15 patches instead of Linux's 1028426," that's a very simple message that many people will have problems seeing through. These people will go away from reading this story believing, simply, that Microsoft is right. Sadly, some of them will likely be influenced by their unwillingness to believe a company representative would utter such a bald faced lie (and of course, in some respects he's not lying. Linux has had a ton of patches; WS2003 has not. Those are the facts. What they mean, of course, is exactly the opposite from what he claims they mean).

Worst of all, though, is that if Information Week or any other "I'm an important IT person and I read industry publications" magazine carries a story on the front page that says "Microsoft Security Chief: Windows More Secure Than Windows," than 3-4 days after they saw the story (and maybe not even read it), your average PHB will just remember the "You know, I seem to remember recently that someone came out and said Windows was more secure than Linux. I don't remember how they proved it or where I saw it, but I distinctly remember it..."

Which is why I do think there's value in a vigorous response and a careful analysis of the claims in an effort to make sure we're ready to vehemently argue against this insanity.

FUD

[Libor Vanek]

FUD on the horizont, sirre ;-)

- if you compare RedHat/SuSE then you have to compare it to Windows Server + complete BackOffice + complete Visual Studio + complete MS Office and you still are not close enough...
- I'd be interested in average time to fix critical bugs...
- also number of known un-fixed cricital bugs will be interesting (incl. IE on Windows)

Not Surprised

[PhreakinPenguin]

"Mike Nash, Microsoft's Chief Security Executive"

What does everyone think he's supposed to say? Windows security is inferior to linux? He'd lose his job.

From TFA...

[jskiff]

"Year-to-date for 2005, Microsoft has fixed 15 vulnerabilities affecting Windows Server 2003. In the same time period, for just this year, Red Hat Enterprise Linux 3 users have had to patch 34 vulnerabilities and SuSE Enterprise Linux 9 users have had to patch over 78 vulnerabilities."

This actually brings up an interesting point. Does Windows have less bugs (I know, I know) than these Linux distros? Or are Red Hat and Novell more proactive to fix the bugs they do have? Unfortunately, my guess is most PHBs would think the former.

no patches available?

[RealityMogul]

If there's only 15 for 2003, then why does that secunia link list 44?

Notably, the RedHat and Suse links list a higher number of vulnerabilities, but also state that there are ZERO unpatched security holes.

Surprisingly, the Windows 2003 product still has unpatched holes.

If Internet Explorer is any indication ...

[reporter]

For 2 reasons, I doubt the veracity of Mike Nash's claims that Windows is more secure than Linux. First, due to the open nature of Linux development, Linux enjoys far more testers than Windows. More eyeballs means that more bugs will be found and fixed.

Second, comparing Internet Explorer (IE) and Firefox indicates that Windows is likely more bug ridden than major open-source software like Linux. I have used both IE and Firefox. From my experience of visiting thousands of pornographic sites laden with naked women beckoning you to "enter" their site (and other things), I can definitely say that IE is chock full of security problems. After 1 week of pornographic surfing with IE, my entire system (browser and OS) becomes infected with malware -- to the point that I must reload Windows. I have yet to experience the same problem with Firefox.

The only thing that I hate about Firefox is that it is very slow, probably due to the fact that my computer system has limited DRAM and that Firefox must swap to disk more often than IE. Such is the price that I must pay to enjoy porn.

just think

[justforaday]

Just think...If MS were to not release *any* security patches at all, they could use that figure as absolute proof that Windows is more secure than anything else out there!

Linux Vs Windows

[KingBahamut]

This is an argument that can largely be debated on a variety of levels. Honestly? Linux and ultimately unix of any flavor has just as many vulnerabilities as Windows does. Difference -- typically most of those vulnerabilities are patched and assessed before they take affect.

Just do a search for Sendmail Vulnerabilities on google.

Result =
Results 1 - 10 of about 143,000 for Sendmail Vulnerabilities. (0.39 seconds).

for Microsoft
Result =
Results 1 - 10 of about 364,000 for Microsoft Exchange Vulnerabilities. (0.18 seconds).

You can have this discussion for days on end, and really, what the *nix community has up on the M$ community is knowledge and ability. No, there arent any viruses that are successfully written for *nix. Spyware isnt even remotely a concept to a linux user. And most vulnerabilities get patched as quickly as they are given POC. Does this mean that linux users patch any more or less than Windows users, no. But we do it more effeciently and with greater success.

Stability wise , come on. Ive got a redhat 7.3 box that baring powerfailures hasnt been rebooted in over a year. Its a good box, it would probably take an Arkady Rossovich low yeild nuke on its head and still live, and I dont know of any windows box thats able to admit that.

Re:Apples/Oranges

[drew]

regardless of how many programs you install on your server, comparing the number of patches realeased by redhat/suse in a given time frame, which covers all applications in the entire distribution regardless of whether you have them installed, to the number of patches released for windows server 2003, which pretty much only covers the os, web browser, and web server, is beyond ridiculous.

not to mention microsofts tendency to roll up multiple patches into one, something redhat/suse can't do because they don't know which packages you have installed, so bugs that affect different packages can't be compbined.

Re:Apples/Oranges

[Bastian]

But a Windows tends to roll a lot of stuff into single programs, whereas the Unix world has a culture of heavy factoring of software tools.

With all of these different tools, and the admin's freedom to install only the tools he/she feels are needed, the Linux world ends up having to create separate security updates for separate tools, where Microsoft tends to release gargantuan security packs that are really a whole mess of patches rolled into one package.

On a similar note, most of the Linux tools come from all sorts of sources operating more or less independently. This would make it all but impossible for you to find a file that includes security updates for both, say, wu-ftpd and Apache.

And the list goes on. The reality is, the model for releasing seucurity updates in Windows is vastly different from the model for releasing them in Linux, and one is natually going to create at least one order of magnitude more discrete security updates. (If I started seeing updates for my software on Linux only as often as I was seeing security updates from Windows, I would think that something is seriously wrong.) What Mr. Nash really needs to be comparing is the relative advantages of the two different models of releasing security updates.

But of course, you're not going to see that since such an analysis can't be plotted in an Excel spreadsheet.

Re:Apples/Oranges

[Mornelithe]

Exactly. If you look at the secunia pages, you'll notice that all of the advisories are from things bundled in Windows or MS Office.

The Red Hat advisories include vulnerabilities for Perl, emacs, xpdf, vim, PHP, acroread, ruby, etc.

Red Hat has vulnerabilities for multiple programming languages, multiple mail servers, multiple PDF viewers, and so on. Many of the Linux vulnerabilities are for programs that have Windows versions, but aren't reported as such. Many other Linux vulnerabilities are for programs that aren't included on Windows at all, and are therefore not reported (I don't see any Adobe Acrobat vulnerabilities for Windows).

So comparing the two pages as if they represent equal things is ridiculous.

Re:No Real Surprise...

[freemacmini]

MS like most corporations know that the truth does not matter to Americans. Americans believe what they want to believe no matter what the facts are.

History also shows that any lie that is repeated enough becomes indistinguishable from the truth.

This is true in politics, it's true in entertainment and it's true in business.

Big difference

[Andy Dodd]

We can choose which of the "bundled" apps to install.

Windows users can't without jumping through MAJOR hoops. (Microsoft claims it is not possible at all, but software like Win98Lite showed people otherwise).

Windows - We cannot install Windows without installing IE.

RedHat, Gentoo, whatever - Lynx, Galeon, Firefox, Mozilla - What browser do you want to use today? Or maybe you don't want any at all! You can make that choice.

Re:It is not LILO....

[wolf31o2]

When one of my servers needs any new services installed or kernels patched, I actually schedule reboot testing. In fact essentially all of my reboots are due to this testing. It does cut into uptime but it means that when I need it, it will be up.

Doesn't everyone do this? Are people really so adamant about having that stupid 300 day uptime that they don't bother doing any testing?

I found the secret long ago that to maintain maximum customer-facing uptime, you never have a single server perform any task. Instead, you use multiple load-balanced servers, with enough redundancy and survivability to handle one server going down for a scheduled reboot. Th euptime on the individual servers becomes nearly meaningless, as the service uptime is what is really important.