#15 - "Historically, the greatest threats in information security have been from internal/insider attacks."
That's because, historically, companies left their internal networks completely unsecured because they only considered outside sources of attack. Many companies still have the belief that a firewall is a catch all and therefore internal security isn't a big issue.
"Excluding a relatively small number of high-profile cases, the supposedly-plentiful Microsoft security holes are frequently vulnerabilities which require physical access to a system or other insider access such as an unprivileged account which can be elevated."
There is no such thing as security if you have physical access to a system. Period. Case closed. If you have physical, unrestricted access to your company's servers, then your company's servers are not secured from internal attack regardless of what OS they're running.
Privledge elevation has little to do with physical access. I can use privledge elevation just as easily from the internet as I can from local access. In both cases I have a valid login to the computer in question. I know of no privledge elevation attacks that require physical access.
If you're suggesting there are more vulnerabilities that allow a valid user to elevate their privledges on Windows than on Linux, than I suggest you do your homework a bit more. Privledge elevation has been a very common problem on almost all flavors of Unix for a long time.
"The bottom line is that Windows has never really exposed much attack surface to the Internet."
You're kidding, right? Most of the fortune 500 companies run Windows servers, and last time I checked, most of the fortune 500 companies also have web sites. In addition, probably 90% of home computers are online, and 95%+ of those are running Windows. All of these are exposed to attack.
"And what would either one of these two studies really mean? That the people doing studies made some money. That's about it."
Sure, you can also find potential bais in any study, but potential is all it is unless you can find evidence otherwise. Find fault in the study to show the bias, don't try and use potential bais to show fault in the study.
This post was edited by RMD on Sunday, September 14, 2003 at 03:55.
|