Symantec's 11th Internet Security Threat Report

sprkymrk

Interesting article on Symantec's 11th Internet Security Threat Report that said "Windows Gets The Fastest Repairs" among the top 5 Operating Systems.

http://www.internetnews.com/security/article.php/3667201

Of course, it was Mark Twain that said "Facts are stubborn things, but statistics are more pliable."

The actual Symantec report can be found here:
http://www.symantec.com/enterprise/theme.jsp?themeid=threatreport

JDMurray

The top five OS manufacturers are listed as:

1. Microsoft (Windows) - 21 days to fix
2. RedHat (Linux) - 58 days to fix
3. Apple (OS X) - 66 days to fix
4. Hewlett-Packard (UNIX) - 101 days to fix
5. Sun (Solaris) - 122 days to fix

Ignoring for a moment that this is the first "Top 5 OSes List" I've seen that doesn't include IBM, I think this list is very accurate. Microsoft is not only the OS business that is the most "under fire" from attackers and critics alike, but also has more resources than the other four companies combined. Windows Vista would be roundly rejected if Microsoft didn't put security first, and this is the motivation for Microsoft to quickly fix (most of) the known security vulnerabilities.

Apple and RedHat are actually very small companies in comparison to the other three. Apple and RedHat rely on the bogus marketing hype that Linux and OS X are inherently more secure than Windows, so they are very skiddish about releasing security fixes for fear that they will spoil this image. Also, Apple and desktop RedHat users may be less concerned with system security than enterprise-level Windows customers, also reducing the motivation to quickly release patches.

HP and Sun are hardware companies that traditionally consider software as "something used to sell hardware" (although Sun has changed it business model to making money from software in the past ten years). Releasing patches is something they do only when enough of their customers complain. And based on the track record of both companies for hushing-up severe hardware flaws, both also believe that frequent patch releases is a sign of poor product quality.

And as the article points out, the "other four" OSes have such a small marketshare as compared to Windows that they can afford to lag behind in the frequency of patch releases because they such less likely targets. (This is really bad reasoning.)