Forrester questions Linux security
A new study from Forrester Research has concluded that the Linux operating system is not necessarily more secure than Windows. The report, Is Linux more secure than Windows? finds that on average, Linux distributors took longer than Microsoft to patch security holes, although Microsoft flaws tended to be more severe.
But leading Linux vendor Red Hat said that while Forrester's underlying figures were sound, its conclusions didn't give an accurate idea of relative security, as they failed to distinguish between patch times for critical updates and routine, obscure problems.
The report arrives in the midst of a fierce debate around the relative merits of Linux and Windows, and follows a number of reports perceived to have been slanted in Microsoft's favour. Last October, Forrester forbade its customers to publicise studies they had commissioned; it made the move partly because of criticism of a report from Forrester subsidiary Giga Research that found some companies saved money by developing with Windows rather than Linux. Forrester said it stood by the integrity of the study, but had erred in allowing Microsoft to use it in anti-Linux advertising.
Forrester's report may lend credibility to Microsoft's ongoing efforts to play down security concerns about its software. A new tactic in that battle has been to compare how long it takes for various operating system vendors to patch flaws - the "days of risk" for each operating system. Microsoft's argument is simple, said Bradley Tipp, Microsoft’s National Systems Engineer for the UK, last autumn: "Open source systems are likely to be at risk for more days than Windows systems."
Indeed, Forrester found that, between 1 June 2002 and 31 May 2003, Microsoft had the lowest average "all days of risk", the time between the public disclosure of a patch and the time that patch is released by the operating system maintainer, compared with the Red Hat, Debian, MandrakeSoft and SUSE Linux distributions.
Microsoft took on average 25 days to release a patch; Red Hat and Debian 57, SUSE 74 and MandrakeSoft 82, Forrester said. "Microsoft’s average of 25 days between disclosure and release of a fix was the lowest of all the platform maintainers we evaluated," wrote analyst Laura Koetzle in the report. "Microsoft also addressed all of the 128 publicly disclosed security flaws in Windows during our 12-month evaluation period."
