Technology news and Jobs 
Information Technology News Vista more secure says MS director
Information Technology News Vista more secure says MS director | Vista more secure says MS director |
|
| by Stephen Withers | |
| Monday, 25 June 2007 | |
  
Featured Whitepaper
5 Best Practices for Smartphone Support
He compares this with 36 fixed and three unfixed vulnerabilities in XP, 214 fixed and 59 unfixed in Red Hat Enterprise Linux (counting only those in a "reduced component set" that he feels is comparable to Windows), 74 fixed and 11 unfixed in Ubuntu 6.06 (similarly reduced), 123 fixed and 20 unfixed in Novell SLED 10, and 60 fixed and 16 unfixed in Mac OS X 10.4. "In all four cases studied for the 6 month period after ship, Windows Vista appears to have a lower vulnerability fix and disclosure rate than the other products analyzed, including the reduced Linux installations," concludes Jones. "This affirms the early results that we found after 90 days and provides a supporting indicator that the Microsoft Security Development Lifecycle process and heightened focus on security is having a positive impact on Microsoft Windows in terms of fewer vulnerabilities." There seems to be general agreement among commentators that Vista has benefited from Microsoft's increased emphasis on security compared with XP, but various holes are being picked in Jones' methodology when it comes to comparisons with other operating systems. Should so-called silent updates (where neither the existence of the fix nor the vulnerability are disclosed by the vendor) have been included? Should Microsoft's record be compared with those of specific Linux development teams rather than particular distributions? Do the reduced component sets for the various Linux distributions actually provide a meaningful point of comparison with Vista? Does counting disclosed patched and unpatched vulnerabilities provide a sufficient measure of an operating system's security profile? Has Vista been around long enough for researchers to gain a true view of its level of security? It is perhaps significant to note that Jones issued the report under his own name, not as a Microsoft document. While he did mention it in his TechNet (ie, Microsoft) blog, the main discussion and the report itself is hosted at CSO Online.{moscomment} |
Tags
| < Next story in category | Previous story in the category > |
|---|
