which is the most secure OS, that is, not easily prone to crash!!
Printable View
which is the most secure OS, that is, not easily prone to crash!!
You may want to look here as this has been discussed many times.
http://www.antionline.com/showthread...erating+system
or here (a poll and discussion started by HackerDan) http://www.antionline.com/showthread...erating+system
or here for a discussion about which OS is best for you http://www.antionline.com/showthread...erating+system
and lastly a bit of a server discussion http://www.antionline.com/showthread...erating+system
once again ...... the security of the OS depends on the user who is controling it ...the OS is not secure by itslef ....you have to secure it ..... install firewalss ....antiviruses...anti - spyware tools and so on .... for more information visit
http://www.antionline.com/showthread...=linux+windows
http://www.antionline.com/showthread...=linux+windows
http://www.antionline.com/showthread...=linux+windows
I and most people I know would recommend Linux if you're really concerned about security, however, Memory said it best with "the security of the OS depends on the user who is controling it ...the OS is not secure by itself ". Really, you should go with whatever you are most comfortable with using and then secure it to the best of your abilities with all the things Memory just listed. About "not prone to crash": Linux is nowhere near as prone to crashing as Windows (in my opinion).
-keezel
"Memory" is totaly right....One may be more secure than the other one...and it is all up the the user
It always bugs me when people refuse to give a simple answer to a simple question.
First off... I went through all the links presented here, and none of them accurately focused on security.
Second off... system security does _NOT_ depend on the admin. This is a silly myth fabricated by people who do not understand OS security well enough to discuss it objectively.
More secure operating systems have clearly defined security guidelines which enable an organization a greater level of assurance that the system is secure correctly, and not on the whim of the admin. Even more secure systems use mandatory controls that begin completely removing security from the admin/user's hands altogether. Even more secure systems not only ensure that the system is in a secure state but that it is not possible for the system to migrate to a less secure state, all information in these systems migrate only up (if at all) ensuring that as the system migrates toward entropy (as all systems do without intervention) it gets more secure not less secure as standard operating systems.
So what does all of this mean for you? Officially speaking, the most secure OS currently is STOP by WGS. AITS by AII is more secure, but has yet to complete formal evaluation, so statements about its security are assuming that AII made a rather large error. Below that we have Trusted XENIX, which is a hybrid of UN*X (user interface, etc. Looks like UN*X but is not actually UN*X), TOS (MAC, etc), and NT (Audit trails were borrowed as XENIX was a MS product) Though XENIX was an MS product, Trusted XENIX was actually put out by TIS, the same company that created FWTK, though the were purchased and broken apart. Below this we have all the more standard trusted operating systems, HP-UX BLS, TRIX, Trusted Solaris, etc. It is important to note that although these systems share UN*X system names, they are not in fact UN*X systems. They are trusted operating systems that are built to work like their untrusted counterparts.
FreeBSD has attempted to become a trusted operating system with the inclusion of the TrustedBSD project into FBSD 5.x. It is my opinion that the MAC and ACL implementations in FBSD 5.x are some of the worst I have ever seen and this coupled with the poor documentation and their optional nature leads me to believe their inclusion is short term.
Recently several flavors of TOSes based off of Linux have surfaced including Pitbull LX, SE Linux, LIDS, Trusted Linux, and a MAC enabled Linux for the dreamcast no less. ;) Of these I would say that Pitbull LX is likely the best implementation, however it is worth noting that none of these are genuine trusted operating systems on account of their being monolithic kernels, which is a strict no, no in the world of good, secure OS design.
Even more recently kernel drivers for NT have surfaced which provide it with various types of mandatory access controls. Considering NT's better audit trail, separation of admins and operators, as well as it's more finely grained discretionary access controls with single action commands... if you wish to have a standard high security system this might be your best choice.
If you are looking for completely free, SE Linux is for you. Its Flask security architecture is both powerful and simple to adjust to.
If you wish to use Linux and cost isn't a concern, Pitbull LX is the best choice in my opinion, its domain based access controls are very powerful, simple to administer, and document. Plus it works in a manner that will be very logical to those new to this type of system as they simply place various services in their own compartments. Pitbull also features several other standard and not so standard security mechanisms like least privilege and networks flags. (a personal favorite item of mine)
If money is no object and you want something with mucho power, check out trusted Solaris, all the power of Solaris with mucho cool security mechanisms. :)
best of luck,
catch
I was going to bring in some secure systems used by the military to lock down defense system, and I don't mean administrative LAN stuff but that is typically outside the scope of discussion here. Then again maybe I am wrong to assume that.
I agree with you, we all tend to reduce this issue to a simple answer and then leave it to just a single choice, typical Nix versus typical Windows.
There are some advance operating environments out there with fail safes, such as you described. There are even more that are still theoretical. I mean when was the last time you heard of a military satellite being hijacked or an accidental rocket launch? These things are running an OS no one else has, and it’s locked down into compartmented access.
After considerable thought, I have tried over the years (deflating my ego) to clearly define admin and operator duties and keep them separate. That is more of a policy issue in my case because I do not use any of the advanced operating systems you have mentioned. I have even gone to the point of having secured physical access to a console by entrusting to third party individuals with absolutely no ties to me.
An excellent case point you have presented
Solaris, who has the money for that OS. I'm poor, can't afford it. Memory is right the OS only as secure
as the admin or user. I have seen new *nix users install with not knowing that they had to install a firewall
, harden the kernel, checks sys logs. or even implent security features. Still some OS'es have better built-in
features to make it more secure or less. But the admin must know how to lock down services and uninstall service
that's not needed. I would suggest which ever suits your needs. For the task at hand or what U actually
need :-T *nix I love it cause it doesn't listens to anyone, but I can tame it to listen to me %-<|>
Any OS not connected to a network is 100% secure, barring physical security of course. :-)
Barring physical security? So in other words you mean it is 100% secure from network attacks. It isn't secure from users, administrator errors, malware, or TEMPEST.Quote:
Any OS not connected to a network is 100% secure, barring physical security of course.
In other words, it is 100% secure from everything but threats?
http://wwws.sun.com/software/solaris/binaries/get.htmlQuote:
Solaris, who has the money for that OS. I'm poor, can't afford it.
Whew, $20... damn that is expensive. ;)
This is why ISO15408 takes documentation into consideration. Systems lacking a standardized manner of implementing security are inherently less mature and less secure as they require heroics on the part of the admin. Many systems ship with not only good documentation but either in its most secure state (eg. OpenBSD) or with scripts/apps to put the system in a secure state (NT).Quote:
Memory is right the OS only as secure as the admin or user. I have seen new *nix users install with not knowing that they had to install a firewall , harden the kernel, checks sys logs. or even implent security features. Still some OS'es have better built-in features to make it more secure or less. But the admin must know how to lock down services and uninstall service that's not needed.
I got a private message regarding this thread and OpenBSD. Although OpenBSD ships in a more locked down state it offers no additional security functionality over other flavors of UN*X. OpenBSD does not protect against rights propagation that I discussed in my "How to hack (nearly) any OS" tutorial. OpenBSD does not protect itself from trusted malicious users, trusted malicious code, or even trusted weak code (bind springs to mind).
OpenBSD is in fact the apex of flawed security assumptions, the idea that the system is only as secure as the admin is answered by shipping the system in as minimal state as possible thus not requiring the admin to do anything to lock down a default install. The second is that secure code makes secure systems, hence all of OpenBSD's code audits. This is refuted by the simple question. is it feasible for the OpenBSD team to make the OpenBSD code 100% perfect? No of course not, they would need a _hell_ of a lot more money than they have, not to mention that ensuring that ever supported 3rd party app is also perfect. If this isn't possible in their current situation, why try? Doesn't it make more sense to design a system keeping in mind that it will fail, but ensure that it fails into a secure state? More advanced systems do this (NT's CAF is a fine example) This of course doesn't even take into consideration the weaknesses of the OpenBSD DAC architecture (multiple actions with a single command).
catch
Huh, true there is Tempest. Make sure that that PC not connected to a network; is shielded in a grounded copper room. Then placed in the middle of the floor on non conductive risers, then shield the Box and monitor in Tempest proof boxes. And you might have that one covered. Still have the human element to contend with though. ;)
PS. That might stop microwave espionage too unless someone can figure out some resonant component of the wall...
:eek:
Quote:
Originally posted here by catch
[B]
Barring physical security? So in other words you mean it is 100% secure from network attacks. It isn't secure from users, administrator errors, malware, or TEMPEST.
In other words, it is 100% secure from everything but threats?
So how do I secure my servers from the threat of a metor smashing into earth? I see you live in CA, as do I. So how do I secure it from earthquakes toppling the building down on them? HOW do I secure it from the prediction that california will break off and fall into the Pacific?
Just curious since you wanted to be specific and take my origional post out of context.
Hmm I actually wrote a tutorial on Risk Management for this site as well that covers all of this. All of these risks can be mitigated if need be, via safegaurds and/or insurance.Quote:
So how do I secure my servers from the threat of a metor smashing into earth? I see you live in CA, as do I. So how do I secure it from earthquakes toppling the building down on them? HOW do I secure it from the prediction that california will break off and fall into the Pacific?
Out of context? What was the context of your post? it was a silly childish remark that demonstrates no knowledge of security and added no value to the topic at hand.Quote:
Just curious since you wanted to be specific and take my origional post out of context.
I was making the point that reduction of functionality != greater security... though sometimes the two go hand in hand.
catch
Quote:
Originally posted here by riya_here
which is the most secure OS, that is, not easily prone to crash!!
If your interested in an OS that will take a beating and still ask for more with a smile. Looking into one of the *BSDs. Dont believe me, check out this link http://uptime.netcraft.com/up/today/top.avg.html , that's from netcraft survey, you'll be able to see the servers that have the longest uptime. Some of these servers have been up for years. What do they all have in common?
--PuRe www.pureescape.net
PuReExcTacy makes a good point and provided a nice resource defending tha stability of BSD, I in fact have two BSD systems pushing 600 days uptime and both of these systems are pushed to about 90% of capacity for a good 11 hours per day. (Remember that much of Yahoo and for a long time much of Hotmail, two of the busiest sites on the net ran on BSD)
However... the uptime data on netcraft isn't quite that useful... it doesn't do a very good job in considering load balancing clusters. This is why many never down systems have such low uptimes. Systems like NT can have very high uptimes as well (one of the test servers at my work is just passed 18 months as well), however when these systems are clustered, the admins can be lazy and just reboot the systems after changes rather than using the live update tools and other "tricks" to set system changes without rebooting.
As a side note... there are various VMS systems at tech colleges around the country featuring uptimes of around 20 years. (NT of course was based off of VMS ;) )
BSD's biggest weakness is in other aspects of security, nearly every other OS, Linux, Solaris, NT, MVS, etc have high security/high assurance extensions availible for them. the best BSD has is Trusted BSD/FreeBSD 5.x and these are, in my personally and professional opinion, highly suspect in design.
catch
Quote:
Originally posted here by catch
Hmm I actually wrote a tutorial on Risk Management for this site as well that covers all of this. All of these risks can be mitigated if need be, via safegaurds and/or insurance.
Out of context? What was the context of your post? it was a silly childish remark that demonstrates no knowledge of security and added no value to the topic at hand.
I was making the point that reduction of functionality != greater security... though sometimes the two go hand in hand.
catch
Excuse me, risk managment and mitigation are themselves != to security. Risk managment is identifying a problem before it occurs and devising ways it *mitigate* them if they were to occur.
Neither of which makes any improvement in security at the OS level. And to call a tongue in cheek comment like my first post "childish" is in itself childish. Further more your blind assumptions about my knowlege of security again is a childish remark which only added to your obviously self promoted ego. It also added nothing to the topic at hand which you so hypocritically pointed out.
Aghhhh my old night mares are coming back. Many a sleepless nights hacking away at monchrome consoles trying to bring up ailing PDPs. Agghhhh. Of course that was YEARS ago but the hatred is there and ingrained. Just sharing a funny look at VMS. After being awake for 3 days straight you tend to visualize ectreme prejudice in your captors. :)
I think this thread has accomplished it's goal and the orignal question was answered. IMHO, some of the negative comments are taken out of context. Smile and go grab a coka cola. Get out of the NOC/'puter room and Take in some sunlight. ;)
Slightly off topic, but how about this for a secure system? Can't remember the source of this quote I'm afraid .......
"The University of North Carolina has finally found a network server that, although missing for four years, hasn't missed a packet in all that time. Try as they might, university administrators couldn't find the server. IT workers tracked it down by meticulously following cables until they literally ran into a wall. The server had been mistakenly sealed behind a drywall by maintenance workers. " :D
love roadclosed true enough no o/s is truly safe however have one quick question am not used to working with meneed a ghost surf or set of proxy servers that will not change settings and a 1024 encryption for ie if possible that will still let you into msn or that can be disabled easily to go in not my usually o/s sooo...plz assist;)