Cloud Computing

A recent published security hole in Microsoft Windows  allows users with restricted access to escalate their privileges to system level. The most disturbing part in this expose is that this hole lay hidden in the OS from 32bit versions of Windows NT 3.1 upto and including Windows 7. That’s a hole that lay undetected for 17 years!

And it’s not only Microsoft that’s facing the music. High-risk, kernel level security flaws continue to be reported in RHEL, SUSE and Debian. The philosophy followed, when encountered with a security flaw, by both of them are quite different and must also be considered when deciding on an environment prone to attacks.

Microsoft follows the traditional approach, security through obscurity. The belief here is that if inherent flaws both theoretical and actual are not disclosed to the public, the chances of finding and exploiting them are drastically reduced. Debian follows a much more radical and much debated philosophy, full disclosure. The logic here is that even though blackhats (a hacker who breaks into networks or computers) may misuse this disclosure, whitehats (ethical hacker or penetration tester who focuses on securing and protecting IT systems) will be able to obtain more info and generate patches quickly.

But at the end of the day, whatever be the excuses, high risk enterprises will always value security over marginal cost benefits. A thorough understanding of the underlying technologies, adequate security audits and risk analysis needs to be done before suggesting cloud based solutions to enterprises.

An excellent article on Linux vs. Windows Security can be found here.