Linux/Windows security debate rolls on

Analysts are split over which is more secure: Windows or its operating system rival, Linux.

Forrester Research has concluded that Windows is actually as secure as Linux, suggesting that Microsoft provides security updates more quickly than companies such as Red Hat.

But the Linux distributors covered by the report - Red Hat, SuSE, MandrakeSoft and Debian - have insisted that Forrester did not take into account that they handled critical flaws much faster, often within hours.

And another report, from the Robert Frances Group, and sponsored by IBM, rates Linux an A- for server and A for desktop patch management, versus Windows at C+ and C- respectively.

The report states: "Windows requires substantial improvements before it will be on a par with Linux, and desktops receive the lowest score because of the high cleanup costs many companies have experienced dealing with viruses."

But Neil Barrett, visiting professor of computing criminology at Cranfield University, maintained that it is staff skill levels and type of deployment that dictate the level of security provided by either operating system.

"A well managed Linux or Windows can be made more or less as secure as possible," he told vnunet.com.

Barrett added that it takes more effort to make Linux secure because it requires a greater level of staff knowledge, but that by default "out of the wrapper" Linux is a tighter operating system.

He said that Microsoft now has a single highly motivated team handling patches, which had to be set against the open source community response which depends on the collective.

Barrett added that neither Linux nor Windows came near the level of security of mainframe operating systems.

The Robert Frances Group report has Linux outscoring Windows in nearly every security category on both server and desktop.

It places Linux higher for operating system functionality, deployment/management, patch management, network layer, standards compliance and trusted computing, in which both are rated very low.

Both get a maximum A for the applications stack, while Windows 'wins' for security certifications. Here the report suggested that Linux trails Windows but will catch up in nine to 15 months.