Greetings,

Many times throughout my security years of both teaching and learning, I find that at least once every few months someone asks me "What Operating system is the best?" or "What Operating System is better/more secure/less secure/faster/cooler/easier to hack with". To each I've given the same answer and thoughts that I shall share here, as I merely feel it is time to do so. Do not expect a list of Operating Systems, nor expect biased opinions in this post. I want to offer insight to one of the most valuable peices of wisdom one can have in the security buisness.

The answer to the question of "What Operating system is the best?" is quite simple:

Each and every Operating System is capable of preforming and responding just as well as the next.

That's correct. Now, set aside differences, stereotypes, and your past knowledge for a moment, please. And allow me to share my thoughts with you. Here is a quote I want you to never forget, something that I have never forgotten once my mentor taught me: The OS is only as good as the Admin, and the OS can never make up for a bad admin. A veteran of a Windows Operating System can lock up any windows distro in a heartbeat, more secure than an SElinux kernel on OpenBSD running tripwire, by using their knowledge and experience of windows. A newbie of OpenBSD, however, can make it as insecure as an unfirewalled, unupdated, windows 95 distrobution. Think about this for a second, if you will for me. An Operating System can have all sorts of default safeguards and built in security functions, plus unlimited tools at the admins disposal to secure it with. But, if the admin is not familiar with that Operating System, whichever one he is using, then it is all useless to him.

There is an old adagio: "A firewall is no good if you do not know how to configure it and read the logfiles"

It holds true to Operating System security, upkeep, and usage. While so many people may argue about "LINUX IS TEH GOD!!!111 windows is INSECURE omfg!!!11FIVE" and about "LINUX IS 31337 :P yuh rght", they are forgetting how important it is to learn and master both. A good security admin doesn't just brag and become a fanboy about their OS, they dig deep into the core of it to discover how they can tweak and modify it in each and every way, so that when the time comes to modify it, they already know how. Be it mastering the Registry in Windows, which by the way is actually every single module configuration that directly links into the Windows kernel at your finger tips. Or be it learning how to use KDE, even if your past experience with it was shotty. Why is it so important to focus deeply onto your OS of choice? I'll tell you why.

When an admin is comfortable with their OS, they can begin to actually learn. Thus is the root of my entire answer. Despite what OS you are on, find the one you are most comfortable with and master it. Because when you master it, nothing can penetrate you, and you are quick to both problem solving and prevention. Forget the stereotypes of Windows not being "leet enough", or Linux being only for "geeks". Find what you like best, and master it. This leaves me to the last part of my post here, dear friends.

When you have mastered an OS, truley knowing it inside and out, then move onto a new one. A completely different one. If you mastered Gentoo Linux to the bone, then give Windows XP a shot. Remember, shove aside stereotypes and previous bad experiences and use that to drive you even harder to make it WORK like it should. With equal knowledge of multiple operating systems, not only does that widen your "hire me" contract, but it helps build general knowledge about computers, period.

So I say again, and I leave you with this: Each and every OS is just as good as the next, and can do the same thing in different ways. The key and the challenge is finding the OS you are most comfortable with, blowing off the windows and linux zealots that will stereotype you, and actually learning. Remember, there isn't a single thing that Linux can do that I can't make Windows do just as good, and there isn't a single thing that Windows can do, that I can't make Linux do just as good.

Take care, be well, and do not take this as a flame war post, but as something to honestly think about, grow on, and take to heart.

kindest regards,
Pooh Sun Tzu