Linux security is hopeless.

I don't really believe that -- I just wanted to get your attention. But now that I have it, it is a good time to introduce you to some researchers whose sentiments are just that. In fact, The Aberdeen Group is calling open-source and Linux software the new "poster child" for operating system security for the year of 2002.

In a research abstract published by Jim Hurley and Eric Hemmendinger, (note that the site requires free registration) the two Aberdeen analysts site CERT statistics where 16 of the 29 advisories for 2002 were for Linux/open-source issues -- over half of the total advisories. They also make some interesting comparisons between 2001 and 2002, noting a rise of issues with embedded systems, firewalls, and Trojan activity.

With only seven advisories relating to Microsoft products, or about one in four, the group has now dubbed Linux as the new leader in OS insecurity.

So does this mean that you should dump all of your Linux installations and replace them with Windows? Of course not --- no more than you should have switched from IIS to iPlanet at Gartner's recommendation. What it does mean, as the publication points out, is that all operating systems have security problems, and they always will. The degree that you embrace this and plan for this, is the degree that you will be secure.

[ Read more ]