February 2007 – Operating System Vulnerability Scorecard

For the February vulnerability scorecard, I’ve added one additional platform, Novell’s SuSE Linux Enterprise Desktop 10 (SLED10).  As I did for the other Linux distributions, I take the default SLED10 installation and filter out component applications that don’t have an equivalent on Windows such as gimp, OpenOffice, Thunderbird, and so on.  For more details on assumption and methods, please read review my methodology, sources and assumptions on this page. 

I note that I’m a bit late on the February scorecard, largely because I wanted to have posted my Windows Vista – 90 Day Vulnerability Report before showing the 90 days of Windows Vista in this scorecard format.  The March one will come quite a bit earlier in April.

For each of the server and workstation OSes, the charts use a stacked barchart with highest severity vulnerabilities on the bottom and lowest severity on the top.  This allows an easy visual comparison if readers just want to compare just High severity, High + Medium severity, desiring to exclude lower severity vulnerabilities from comparison.

Workstation OS Vulnerability Charts

By workstation OS, I mean an operating system product that forms the basis for a computer users normal day-to-day computer-based activity, such as is comparable to Windows XP or Mac OS X, including a graphical windowing system and Internet browser, but excluding higher level applications such as Word, Excel or Powerpoint or equivalents.

The first chart represents the total High, Medium and Low severity issues fixed for the various products over the past 3 months, ending in February 2007.  Examining the 3-month chart, we see that Windows Vista had the lowest number of total and High severity vulnerabilities fixed.  Mac OS X also had a low number of vulnerabilities fixed in the 3 month period.

Next to get a view of 2007 year-to-date, we have a chart that just includes the vulnerabilities fixed for the products between January 1, 2007 and February 28, 2007.

Server OS Vulnerability Charts

For server OSes, I am considering products that form the basis for a server in the network that would not typically be a day-to-day workstation for an individual user.  This means that, where possible, it is assumed that an administrator would choose not to install optional components like the graphical windowing system, Internet browser and so on.  On Windows Server 2003, those components are counted, since the user does not have an option to not install them.

… and the year-to-date chart for Server OS chart …

What’s Not Covered

Security professionals will correctly note that vulnerabilities represent only part of the security picture, with the risk equation also needing an understanding of the potential threats and value of the information at risk.  However, number and quality of attackers are elements largely orthogonal to factors that vendors have ability to influence.  Vulnerabilities, on the other hand, are a factor that vendors can influence directly by investing in process, testing and other best practice Q&A techniques to reduce bugs and raise quality of shipping products.

To put it into user terms, imagine that you are a CSO tasked with protecting some valuable company information on a company server.  You assume that the information is the target and that potential attackers will attempt to attack whichever platform you select to host the information.  In that case, the threat and value of the information is fixed, and the risk equation depends primarily on the vulnerability of the system you select (until you implement further mitigating actions).

Additionally, some folks have pointed out correctly that to get a full picture of vulnerabilities, one also has to look at disclosed issues that have not yet been fixed – as I did in my Windows Vista – 90 Day Vulnerability Report.  This is true.  However, since disclosed, but unfixed issues are harder to keep up-to-date accurately (until a vendor acknowledges the issue with a fix), I will begin publishing a separate, less frequent scorecard specifically for that metric over past periods.

Regards ~ Jeff

See last month’s scorecard:  January 2007 – Operating System Vulnerability Scorecard