Symantec rubs Windows’ ego; third-party dominance to blame
Symantec, the company responsible for the ever-infamous Norton Anti-Virus, has just released their 11th Internet Security Threat Report this March. The meat and potatoes of the report claim that Windows is the most secure operating system currently on the market(yes, as in Microsoft Windows).
The basis of this statement is that in the last 6 months of 2006, Windows released the fewest system patches and developed said patches in the shortest amount of time. This took into account 6 different operating systems, ranging from Red Hat Linux to OS-X, and even HP-UX.
The report claimed that Windows experienced 39 vulnerabilities, and those vulnerabilities were fixed within an average of 21 days.
Moving on, the report claimed that Apple’s OS-X fell far below Windows in security, because it experienced 42 vulnerabilities and took on average 66 days to repair them. The worst-ranked operating system, HP-UX, had over 98 vulnerabilities and took 101 days to fix them.
However, just like many of you readers who may be quite skeptical at Windows sweeping the “most secure” category, Sun, who is responsible for the Solaris OS, has directly disputed the claims of Symantec’s findings.
“Symantec’s data on security vulnerabilities simply does not match Sun’s. We can’t verify Symantec’s sources and consider their report on Sun inaccurate. From 7/1/06-12/31/06 we published 54 Security Sun Alerts, of which 36 were for Solaris – substantially less the 63 Solaris vulnerabilities claimed in the Symantec report. Past analysis of our vulnerability response shows we responded within five days for the vast majority of vulnerabilities, but averages are skewed by a small minority of 3rd party applications (or code) that are included/bundled with Solaris. Sun responds to all reports of security vulnerabilities, and we stand by our reputation and established track record of responding to security vulnerabilities with Sun Alerts and a quick turnaround time for patches.”
That statement does present an interesting point; Sun says that any vulnerabilities directly related to their operating system were handled within 5 days, where the 3rd party application vulnerabilities, obviously, took longer to handle. However, this does not mean that the operating system, or Sun, was responsible for those vulnerabilities.
Also, let’s take a second to look at what criteria the title of “most secure OS” is based on. It is based on the number of “vulnerabilities” an operating system experiences, and how quickly the manufacturer responds to the threat. It may be very easy for Microsoft to claim the title based on those criterion, because Windows is based almost exclusively on third-party applications and protection software.
Therefore, Microsoft is responsible for very little in regards to direct problems with their operating system, being that the plethora of problems come from third-party programs. It would seem that Symantec’s survey was almost designed to display Windows as the most secure, if they are not including third-party programs in their vulnerability analysis.
Likewise, it is easy to see how they would consider OS-X, which is unquestionably much safer than Windows, more of a “threat”. OS-X experiences very few problems, but because the OS-X has incredible built-in virus protection and safety software, it is held directly responsible for all of the “vulnerabilities” it experienced; though, Symantec did admit that only 1 of OS-X’s 43 perceived vulnerabilities was considered high-priority.
It appears that Symantec’s account of perceived security is full of vulnerabilities as well. We shall see how long it takes them (on average) to remedy these flaws; then we will submit our own first survey of security surveys. How I do amuse myself.
Related Posts:
