Lower Your Insurance Premiums: Use Linux 161
Several readers who declined identification have pointed out that this "article over at Interactive Week discusses J.S. Wurzler Underwriting Managers, one of the first companies to offer cracker insurance, charging clients 5 to 15 percent more if they use Microsoft Windows NT in their Internet operations. As insurance companies live and die by their statistics, this is a pretty significant move. The article also has interesting information about tech turn-over in Windows vs. open source shops." However, note that Wurzler is not the only company offering anti-cracking insurance, and the Big Names haven't yet followed this lead, even though they're apparently watching intently. Maybe "treating employees nicely" is at least as important a factor to consider.
Sometimes I wonder... (Score:1)
"NT is more difficult to install correctly and keep up to date than Linux," Spafford said.
I'd say they're both difficult to install correctly, but that Linux is definitely harder to keep up to date. Despite what CmdrTaco et al like to say about apt-get, to update Linux still requires a fairly competent administrator who keeps up to date on patches and knows which one he or she needs to install. Owing to its manufacturer and the google-eyed media frenzy surrounding Microsoft products, NT bug updates get a lot more press coverage.
I think that in general, Windows' installers are much slicker than the half dozen I've played with for Linux. If Linux could improve one thing about their installers, it would definitely be driver support. The general lack of polish (or glitz as some may see it) of Linux systems puts off a generation of IT managers trough-fed by Microsoft.
Also, since [good] Linux sysadmins are in short supply, companies have to pay more in salaries and fiscal items like that than they would for similarly (if the two can be compared) qualified NT/2000 admins. The insurance savings may be negated by this - but if you can run (notice I don't say "get") a much more secure Linux system for the same price as a Windows NT/2000 server, then Linux is well on the way to competing.
Am I the only person worried... (Score:4)
Re:Why isn't MS-NBC reporting this? (Score:1)
Or, at least, they can't do those things without government's help or permission.
Government in service of business indeed a great threat -- but business alone is not. One can try to solve this problem either by restricting business, or by restricting government. I am utterly convinced that the latter is the better solution, and the former nearly impossible (and even if not impossible, the attempt makes enemies of those with the resources and the ability to make things with them... never a good thing).
Why should we let *anyone* assume those risks? (Score:1)
We already deny insurance policies for smokers and sky divers. We already deny insurance policies to citizens of New Jersey. (Don't believe me? Read the fine print on any Geico commercial.) These individuals may exercise their rights in choosing to live the damnable lifestyles they live, but that doesn't mean we have to pay for it.
All rights come with responsibilities. Drivers aren't allowed to drive drunk, but that's what system administrators are doing every day by installing Windows. We have laws against this stuff for a reason. It's time to extend them to computers.
Insurances are about statistics (Score:5)
Ummm.... (Score:2)
Just wondering.
Re:This is just plain silly. (Score:1)
Re:MS creates the illusion of simplicity (Score:2)
Windowsupdate isn't meant for servers.
Re:I wonder if NT's ease of use could be a culprit (Score:2)
Re:I wonder if NT's ease of use could be a culprit (Score:3)
I also have an MCSE I obtained a couple of years ago, and it's really quite simple to secure an NT box:
#1. Subscribe to NTBUGTRAQ.COM
#2. Read www.microsoft.com/security
Microsoft has provided tools which will notify you when security related hotfixes are released. They have provided tools to automate the installation of hotfixes, as well as automate the configuration of servers.
The DNS issue wasn't a bug in Microsoft's software. They suffered a DoS attack on their web servers, so they subcontracted with Akamai to protect against this. If you don't know who or what Akamai does, that's another problem with your paper MCSE.
What security through obscurity argument? Do you even know what that means?
I don't disagree that the lack of qualified admins is the problem. But the documentation and tools are out there, you just have to use them.
But my main point for responding... You shouldn't consider yourself a qualified admin, because you clearly are not.
MS creates the illusion of simplicity (Score:5)
But I think that part of the problem isn't with NT/W2K per se, but with the culture that surrounds MS sys admining. MS tries to make things simple -- and they often seem simple. It's easy to throw stuff up without thinking about it first. And one of the selling points that MS uses in comparisons with Unix/Linux is that W2K is easier.
On a certain level, that means that you get a sysadmin that went to Windows because Unix was too hard. That's a harsh overgeneralization, but I think there's some truth to it.
The problem is that security is hard on any platform. The issues are pretty similar. But if you keep telling people that all of you have to do is click on an icon to set things up, it's not surprising that people click on the icon, take the defaults, and don't think about locking things down.
Re:Idiotic (Score:1)
I mean no disprespect, but on average, people who do not understand how computers work, or how security works into the networked envirnment, would choose windows. There is no reason why windows cannot be as secure as a well locked down linux system, it is just less likly.
I will agree with this if talking about firms with enormously secure, and the reality is that most firms that would actually pony up for "cracking" insurance will be of this calibre: They usually have top notch IT departments. The small shops that account for the overwhelming majority of compromises seldom would get insurance.
Re:Idiotic (Score:1)
I mean no disprespect, but on average, people who do not understand how computers work, or how security works into the networked envirnment, would choose windows. There is no reason why windows cannot be as secure as a well locked down linux system, it is just less likly.
Sorry for the repost but I forgot to put &lt rather than <...I will agree with this if talking about firms with < 100 employees. In that case it is completely true that often Windows is simply what happens to be installed so it is turned into the network infrastructure. However there are a lot of very large companies with very intelligent IT departments that have incredibly secure Windows 2000/NT networks with complete IPSec/SMB signing, Kerberos, certificate authentications, etc. As you mentioned and I will attest, 2000 can be enormously secure, and the reality is that most firms that would actually pony up for "cracking" insurance will be of this calibre: They usually have top notch IT departments. The small shops that account for the overwhelming majority of compromises seldom would get insurance in the first place.
Re:Idiotic (Score:3)
Excellent points, however the fundamental of my position was that saying that the primary decision of the security of a firms infrastructure is what operating system they use is like (and I'll bring this up because there are several other car analogies) giving car insurance based upon the diameter of the tires. I am absolutely certain you could draw a correlation in some bizarre way between different tire sizes and insurance claims, however to use that as the foundation basis for insuring would be quite silly. Just because there is a correlation of something doesn't mean that it's a relevant correlation, or the most pertinent correlation, especially in something as complex as security.
If I read "...and furthermore shops that had installed the latest 2000 hotfixes had their premiums dropped 60%" then it would be credible. The security difference between a shop where the admins keep on top of the systems and one where they don't is huge and decisively paints a picture of the organization. The OS chosen does not (despite the patting on the back by the Linux community it's amazing how often I see scans for Linux vulnerabilities...).
Idiotic (Score:5)
What a ridiculous concept. The security of an infrastructure is far more the people and dedication to keeping on top of issues more than it's the operating system. The recent Solaris/IIS worm took advantage of a year old hole to compromise IIS 5 servers, just as the portmapper/BIND/RPC/POP2/etc. Linux exploits take advantage of ancient (in computer time) and long since fixed holes. Of course it takes a grossly incompetent sysadmin to fall prey to any of these, but unfortunately there are many of those out there.
If there is such a thing as "cracking insurance" (I mean by real insurance firms that aren't just trying to get headlines by making a ridiculous policy) it would be based upon the manpower skills, policies, and possibly the use of outside agents to test the security. The idea that Linux=Secure and NT=Insecure is absurd and simplistic.
Big systems get the same rate as small (Score:1)
Just because your big valuable database has a large loss potential doesn't mean that you get a worse insurance rate.
The difference is in the amount you pay, not the rate.
The article says that a hacking policy costs about $4,000 for $1,000,000 of coverage per year. That means that if you pay them $4000 a year, and get hacked, costing you 15 billion in revenue, they pay you 1 million. If you get hacked and you loose $1.75 in revenue as a result, you get paid $1.75. If you feel that your losses are likely to be on the order of 1 billion, then you can buy 1 billion dollars of coverage for 4 million a year. That 4 million isn't exact, but will be more or less based on risk factors including but not necessarily limited to operating system choice.
So repeat after me, insurance rates and insurance costs are not the same. Indeed, simply because they have more to loose, a big site is likely to be better protected than a small one. Now, the insurance company can measure this in different, more direct, ways, so they probably don't charge you different rates based on sheer size alone. But just because a site has a lot to loose doesn't change the rate.
Re:Use Linux? (Score:1)
Oh, I'd agree with you on that, but Slashdot's reasoning seems to be a bit lacking. First off, people creating new systems aren't going to be buying NT. If they're going the Windows route, they'd be buying Win2K. So, this article doesn't affect those people.
Now, if I'm already using NT and don't want to be subjected the extra fees imposed by this pissant company(*), I'd have to switch operating systems. Except that switching to Linux isn't going to be getting me any bigger insurance discount than if I switch to Win2K. So how is this an incentive?
Anyway, I just found it amusing that the marketing arm of VA Linux (read: Slashdot) would post this now, to take away the heat from the SourceForge fiasco. Maybe some people out there remember that The Register ran a story about the exact same thing over a month ago. (You gonna tell me that scads of people didn't submit it then? If so, I've got a secure RedHat server sitting on some New Jersey beachfront property to sell you ;) ).
(*) Why would I refer to them as a "pissant company?" Well, how many insurance agencies are you aware of that have only eight employees? I think everyone here is grown up enough to admit that we'd have never heard of these guys either if not for this one particular policy, a policy that nobody else in the insurance biz seems to be moving to.
Cheers,
Re:Use Linux? (Score:1)
Yes, and Java 1.2 is somehow called Java 2. Everybody knows that Win2K is the successor to NT4 in the NT line, but nobody except possibly the same people who say "M$" ever calls it NT instead of Win2K, 2000, Windows 2000, etc. When someone says NT, they're talking about NT4 and earlier. If they're including Win2K, they say NT-based. Anyone can argue semantics about this, but we're talking about real-world usage here.
Cheers,
Use Linux? (Score:2)
Sorry, but I don't think the whole eight employees of Wurzler has much of a say-so when it comes to reality.
Besides, why is Slashdot still fighting over Windows NT, the focus of this article? It's about 5 years old now, I'd think that Slashdot would be more worried about Windows 2000.
Also, it doesn't seem the article's author has done much comparing of security patches offered for holes on company web sites, since he chose to only mention NT's, even though there are a lot more for Debian 2.2 and RedHat 7.x, when you take into account how long they've been out. Oh well, what can one expect from Ziff Davis journalism?
Cheers,
Ease of Use bites you on the bum... (Score:1)
Secondly, Unix encourages you to play with the nuts and bolts, whereas the closed nature of Windows programs does not encourage exploration. Therefore when things do go wrong, a Unix sysadmin knows where the Usual Suspects may be found and can get things back up quick, whereas a Windows admin is busy phoning MS support.
Thirdly, it may come down to ability. I'm under the impression that to truly claim to be a Unix sysadmin you really have to know your Unix, and thus only the best get to go for such jobs. I have a fairly shallow knowledge of how most things hang together under Unix, but there's no way in hell that I'd claim my knowledge is deep enough to sysadmin Unix systems for a corporate entity, where hacking threats and downtime are serious issues. Whereas an NT admin waves his MCSE qualification around and gets the job regardless of how good he is at it. I'm under the impression that the best use for such a qualification is as toilet paper.
N.B. Before I get flamed, I do know there are some very good, professional, experienced NT admins out there; its just that you guys seem to be hidden from view by the not so good masses.
A different aspect of lowering insurance premium (Score:3)
There's yet another aspect to lowering insurance premiums in business by switching from Microsoft products to Linux or BSD. As Microsoft moves more and more to coupling your software license registration with particular hardware, that could mean that if your hardware is stolen, you may have to buy another copy of the OS and all the applications, when you buy a replacement PC. If you expect the insurance to cover that added cost, you can expect the premiums to go up with it, too. And if you think Microsoft will readily make exceptions for stolen hardware, then I think businesses will catch on and claim hardware as stolen when in fact it is just sold off to recyclers or employees (who will likely continue using the software if it's from Microsoft).
LMAO (Score:1)
--
Re:This is just plain silly. (Score:3)
Not to imply that I believe you [google.com] or anything, but you fit the stereotype to a 't': once MS finally does produce an OS that's stable, scalable, and secure, they'll brag their asses off over finally providing the most rudimentary services that an OS is supposed to provide, and that they should have been providing since day one. They'll probably even claim that they invented those concepts.
--
Keep it in focus folks.. (Score:2)
Its about statistics, and about more than just the OS.
They found, in their studies, that linux-based shops tended to have less security problems than NT based shops, due to a combination of software, better trained and happier employees, etc.. so they did what insurance companies do.. they said 'if you use linux, we will give you a cheaper premium'.
A real-life example of the same thing.
Auto insurance in Alberta, Canada. If you are under 25, and especially if you are a male under the age of 25, insurance is expensive.
Once you are over 25, it gets much cheaper.
Now... I've been driving since I was 16, and never had an accident. Does this insurance policy imply that I am somehow incompetent? Certainly not... they're just playing at statistics. 80% of their costs come from male drivers under the age of 25, so they make those drivers pay more. Period.
Now pretend young male driver = NT shop, you get the same sort of thing.
Re:Just NT/Linux? (Score:2)
If I was an insurance company what I would want to know is what the maintenance procedures for a site were, and see documentation that they were being followed.
The point about the technical competence and turnover rates is crucial given these issues - a shop that has low training and high turnover is just not going to have the adherence to proper maintenance methods that a shop with low turnover and skilled employees.
Re:Sometimes I wonder... (Score:2)
Linux is harder to keep up to date. This is blatantly untrue. The truth of it is, that when MS released these monolithic SP's and hotfixes, many of them did more harm than good. W2k SP2 and Exchange server are a good example, as well as the still undocumented effect of running the March hotfix on a W2k machine running IE 5.5. While the SP2 problems were at least fixable with a paralell install, the march hotfix is non-fixable without reloading the OS. (Maybe this is why MS will still not claim it as a bug.)
The truth of it is, many shops WILL NOT install a service pack unless there is a specific bug they are looking to quash. Otherwise, the machine will stay at the service pack level that was available when the OS was first installed. Our SUN machines, on the other hand, are regularily patched without a reboot. (or a 2 hour frikkin' download) If the patch causes a problem, It can easily be removed. I could say the same for our SUSE servers, and our AIX servers.
And, while NT bug updates get more press coverage, is because the release sparingly, and then ask that you download a 105 MB patch. In addition, Microsoft will not document a Bug until it has the solution. This has led to severe holes going unpatched for months while it's customers are in the dark. *nix generally releases patches for individual files and programs, their patches are more timely, and much easier to install.
So, to keep it simple, patching an NT server means:
15 committee meetings to decide if we should really do this.
Full back-up of the server.
Install Service Pack and pray.
To patch the SUN boxen??
root# patchadd
Slick installers?? If that's how you choose an OS, you deserve what you get. While I'll admit that many of the Linux installers are nasty, I'll only use the installer once. (Insert rant about paralell installs and the sinking feeling that the 30th software package you installed is what's cusing the "Windows Protection Error")
And finally, if diamonds are in short supply, are emeralds as good?? Are the diamonds worth it? Yes, your usual Unix sysadmin costs more, but has also been in the industry longer, and stands a decent chance of actually knowing the system. Many NT admins are hired right out of the class and just thought, "Gee, computer guys make alot of money." And while many of them get past this stage, that's usually when they become Unix sysadmins. Also, UNIX sysadmins are generally asked to do more with the OS. Like shell scripting for starters. When NT admins have to know wscript, maybe we'll have better NT admins.
I mentioned securing port 139 about a month ago. I got "Port 139????"
Also, in closing, Win NT has too many "Script Kiddie" attacks suceed to be taken seriously. When a frikkin' Outlook worm is a billion dollar virus.... Unix may be vulnerable, but not to the average idiot. Look at the stupid Kornikova(SP?) virus. Two weeks into visual basic, and someone exploits the heck out of MS.
~Hammy
"Your leaving will fill the void that was created when you first came here."
Re:Why should we let *anyone* assume those risks? (Score:1)
You're right saying that Geico (and others) don't offer car insurance in NJ. But I think it's more related to the fucked up legislation we have here...
Oh, and one more thing... don't worry, you're not paying for my insurance. That's why I pay twice the amount I would have payed in another place... midwest for example...
Re:Idiotic (Score:3)
One important thing to keep in mind, nowhere in the article did it say that this was the only determining factor. Odds are, this is only one of several questions they ask you in determining your rates. And, I imagine based on your answers, it's possible for someone running Unix to pay more then someone else running NT. The fact that this isn't specifically specified in the article does not mean that it isn't true. This is a general article, not in depth journalism. Understanding the difference between fluff press & in depth reporting is a good skill to have.
Re:Misleading slashdot headline (Score:1)
In addition, if you patch an app under *nix, you probably just need to restart that app, not do a reboot.
dave
Re:This is just plain silly. (Score:2)
But you don't see this as a problem... Having to do this means that something at a rather fundermental level is badly broken. It might be your setup, it might be your setup, it might be your sysadmin, etc...
Re:This is just plain silly. (Score:4)
The problem is, that all statistical surveyes (for what they are worth) I've seen, all say that MS-based Internet servers, percentetwise are cracked more than their marked share would indicate. Much to my surprise, MS-Windows 2000 servers, are disproportionately more cracked, than even MS-WinNT 4.0.
Why it so, I really don't know; is it because; Sys-admins are insecure about applying hot-fixes (will the server come up again after the reboot?)
Skript-kiddies feels more at home on Win-servers?
Win+IIS are generally insecure products?
Windows servers, are generally runned by less competent/lazy people?
Companies running MS-solutions are to cheap to have a decent security policy?
A penguin ate the Hot-fix?
The insurance companies doesn't care why. They are just greedy bastards, who hates to pay out.
Look, if you want to use Linux or *BSD or some other non-mainstream OS
Take a look a www.netcraft.com : Linux is a mainstream Internet OS. Apache (OSS software) is by far the most dominating web-server around.
The way that America works is that people get together and work hard to put out a product, and then they sell it to people.
That exactly what this insurance company is doing; selling a product. Just be glad that it isn't a monopoly, so you can take your business elsewhere.
Go ahead and flame me
Ok. Flame, flame, flame.
[scorch-mode on]
You, sir - you are a MS zealot!!
[scorch-mode off]
Re:Insurances are about statistics (Score:2)
Also consider the fact that even if white Kids are busted they are routinely let go of by the cops with a scare talk or calling the parents but the black kids are much more likely to get charged with crimes and the DAs are much more likely to seek more severe penalties for them (charging them with felonies instead of misdemeanors for example).
Statistics are one thing the reality is something else.
Re:This is just plain silly. (Score:1)
Hacker insurance will be well-used, I think. (Score:3)
Reading sites like CERT, l0pht and rootshell is never going to become useless, because at some point they will charge you so much for your coverage that you can no longer afford to remain in buisness. There will continue to be a need for security.
At the same time, I do think that for a short time at least, this will lead to lax security in companies which do purchase these policies. Some of them will doubtless reason that simply because they have purchased this policy they have all the protection they need.
That will last just long enough for them to lose some truly critical data or buisness which will seriously impair their ability to operate. At that time, they will take the money their policy pays out to them and hire a team of badasses to come in and secure their network, because they can't afford to have that happen again, even if someone does throw money at them when it occurs. Money doesn't turn back the clock, at least not yet.
All you security consultants are safe, but you might want to lay in some ramen for the next few months if you just got off a four month vacation.
Re:This is just plain silly. (Score:2)
tough titty (as the kitty is reputed to have said.)
No, I'm not trying to be funny.
--
Re:Have you ever considered... (Score:1)
Either that or statistics show that NT has more security problems, which as bullshit as statistics are, this is what insurance companies live on.
Where'd you get that from?
So what should they post, stuff espousing how they love microsoft, in spite of the things microsoft has done to prove they deserve a lot of the crap they catch? I know some of it (ok, a good bit of it) is BS, but from what the article says, it's obvious that it's not Slashdot making this call.
This is how it will change (Score:1)
One way businesses manage risk is to insure against loss. That's costly, so you do what you can to save on insurance costs. Hiring people is expensive. Boring stuff, I know, but think about how that fits into an overall cost picture for chosing an operating system for, say, an e-comerce site.
- Less costly operating system due to no licensing costs, no (or very low) initial purchase (the easy to spot costs we've heard about over & over again)
- An operating system that your hard to find technical people prefer to work with (it's cheaper to keep people than to hire new people)
- And add to that, lower insurance costs
It's not just "free" software anymore, it's a broad cost savings strategy. Bottom line stuff like this often makes business people change their minds about purchases they might otherwise have not thought about.
--ddm
Re:Idiotic (Score:1)
Re:Just NT/Linux? (Score:2)
//rdj
Re:Discount for OpenBSD? (Score:2)
Er, no. If you're running OpenBSD in the default install, which few if any people do you don't need cracker insurance.
On the other hand, say you forgot to apply the FTP globbing patch to your OpenBSD FTP server, then you probably do.
Re:MS creates the illusion of simplicity (Score:2)
I guess that wasn't very clear but it was kind of late, I was too tired to think.
Re:MS creates the illusion of simplicity (Score:3)
With W2K, MS has provided a security update tool that makes use of all the windows update services. My buddy is a really bright guy, he knows his stuff and is a good admin so he makes use of the tool on a very regular basis. The day before the worm struck he ran the security check because he became aware of this vulnerability, according to windows update his system was fine, the relevant patch had been installed correctly. The box got hit anyways.
We took a look and it looks like a subsequent patch or service pack had undone the fix on him. The is the exact reason he uses the windows update service, it is supposed to keep this from happening. Now not only does MS give the hollow illusion of an effective admin tool, they make it difficult (read damn near impossible) to manage patches, hotfixes and service packs without it. MS's security bullitens are lame by any other vendor's standards. They rarely contain a decent amount of information about the problem, other hotfixes that can affect it or how to test for the vulnerability.
I just can't get over some of the stuff that NT admins put up with. They get the buffer overflow of the day, a hotfix that manages to unplug a bunch of old holes and no detailed information from the vendor on the problem! Even the qualified and effective admins like my friend don't stand a damn chance up against those odds.
New way to piss people off (Score:1)
"But wait... I run apache on my IIS"
"Dosen't matter" says the insurance co "we won't drop the bill until you put in a reliable TCP/IP stack"
oh well
Re:I wonder if NT's ease of use could be a culprit (Score:2)
I believe that NT/Win2k's security problems come down to 3 issues:
Re:Discount for OpenBSD? (Score:1)
Re:Idiotic (Score:2)
-----------------------
Re:This is just plain silly. (Score:2)
First, I have seen this in real life, NT looks easy to administer. As a side effect the IT directory decide that anyone can administer it. Wrong. That was the case when I was working in some company as a UNIX and network admin. We did ourself an audit of the publicly accessible web servers and we found that most of them were just a huge security hole: no patch, nothing. When we reported this to the person in charge of the machine, the person didn't even know how to patch it, etc. Security holes ranged from traditionnal buffer overflow to Front Page extension and clueless passwords. That make NT a dangerous toy. Note that most of the fix required a complete reinstall of the system as well. By default, UNIX boxes are most of the time more secure, and since to set it up you meed to have some knowledge it is unlikely to find them administered by clueless users.
Second: security holes statistics shows that NT has more holes discovered. This is a fact. NT can be secured, but it require a lot of work and good skills. People that can do this are more hard to find and more expensive than a senior UNIX admin.
Wurzler does not want to punish people. He wants to optimize his business profits, and for this, like many insurance, raise price based on risks taken. Afterall, doesn't Microsoft do the same: maximizing profit ? Isn't this the American way of life ?
Re: no it doesn't (Score:1)
Besides, it's IIS that has the biggest problems with vulnerabilities, NOT NT or W2K themselves. Ever heard of someone cracking into a NT box from within the network? Me neither. It's always some malformed HTML request taking advantage of some cool MS only feature IIS brings to the game.
NT means NT4. W2K is a new animal.
Re: Because it's a non-story? (Score:1)
Re: so Linux 2.4=Linux 1.0=Unix? (Score:1)
Is it fair that anytime we talk about Linux 2.4 that we can chide it for any faults and ommisions present in Linux 1.0? or just any Unix you can name cause Linux is JUST another Unix
Re:This is just plain silly. (Score:1)
Re:Use Linux? (Score:1)
I would disagree with this. I used to be the webmaster for a 5000 person company which is a division of a really huge company. My arch nemesis was the head of the Novell/NT group. He would not allow me to install Samba on my Sun development web server to allow my develpers access to the box. His reasoning being essentially that it wasn't an MS product.
The point of that being that he is a gung-ho MS supporter and very good at that end of the house. They have been doing extensive testing of Win2K and his take on it is that Win2K pro is a good workstation and that the server version is an utter piece of shit. They will not be deploying it any time soon in any production situation.
---CONFLICT!!---
Fair's fair!! (Score:1)
Buckets,
pompomtom
It is a very real product (Score:1)
Misleading slashdot headline (Score:1)
-
Wurzler found that system administrators working on open source systems tend to be better trained and stay with their employers longer than those at firms using Windows software, where turnover can exceed 33 percent per year. That turnover contributes to another problem: System administrators are not implementing all the patches that have been issued for Windows NT, Wurzler said.
The biggest reason is that unix nuts tend to be better trained (well duh) and that staying on top of patches is critical.I know I could probably find some of my WinNT and Win2000 boxes that need patches - how about the rest of you? I don't run any critical systems on my NT stuff, I only use it for applications where MS has the edge.
-----
Re:Idiotic (Score:3)
>And, I imagine based on your answers, it's possible for someone running Unix to pay more then someone else running NT.
If software costs are any indication, I have generally come to expect to pay more for Unix {hardware,software,personnel} due to the niche market effect and the economies of scale that favor the virtual lock on the marketplace enjoyed by win32.
Indeed, give that:
I would expect UNIX insurance to cost more, even if other statistics indicated that, for whatever reasons, they were compromised less often than an NT box.
Those big UNIX boxes hide more behind them; they simply have more to lose.
Linux, OTOH, (and OpenBSD even more so) would remain the most affordable to insure since they're used by small outfits characterized by:
- Extreme cost consciousness
- High technical expertise
and, as a strong correlation of the first, probably a not-so-valuable database hiding behind a formidable phalanx of protection that is all out of proportion to the value of what they're protecting (kinda like the ratio between the Russian military and Russia:).Re:Use Linux? (Score:2)
The fact that NT has been out for 5 years and is correllated with claims is a major strike against it. If it's fundamental to the OS, then they had 5 years to patch it and haven't gotten it right. If it's because people don't know how to administrate properly, they have had 5 years to develop those skills.
This kind of thing may convince people to migrate to Linux or *BSD when they do move off NT.
Discount for OpenBSD? (Score:2)
Oh wait, I almost forgot: If you're running OpenBSD, you don't need cracker insurance.
Moderators on crack (Score:2)
That post was NOT informative. Funny, maybe. Insightful or troll, possibly. But there is no way that post can reasonably be classified as informative.
Re:Idiotic (Score:1)
It's not just the likelihood of accident that determines premium, a significant factor is the cost of parts and labour - if a big engine costs more to fix it will cost more to insure, regardless of accident probability. That's not to say that the likelihood of accident sin;t a factor - it obviously is, it's just not the only one.
----
Re:Insurances are about statistics (Score:1)
Your post reminds me of 2 things, the story Harrison Bergeron by Kurt Vonnegut, and the introduction to It Makes A Fellow Proud To Be A Soldier by Tom Lehrer. In the intro Lehrer talks (in the 50s) about how the US Army has eliminated discrimination on grounds of Race,Creed,Colour or Ability.
----
Re:This is just plain silly. (Score:1)
Re:This is just plain silly. (Score:1)
Or are you just trying to be funny?
Re:This is just plain silly. (Score:1)
Re:Mmm.... Trollicious. (Score:1)
For a while it seemed like sanity may win out by moderating the post down as troll/flamebait. But then things went back to just buisness as usual.
Re:This is just plain silly. (Score:1)
Oooh, it keeps getting better. Yeah, these Linux zealots are all just a bunch of commies. I see it clearly now.
Have you ever considered... (Score:1)
- ...that NT shops get charged more because it's obvious they have the money to spend?
- ...that Linux shops have low-turnover because GNU/Linux "admins" can't get jobs elsewhere?
- ...that your blatant and igornant anti-Microsoft bias only reinforces Slashdot's reputation as poo?
Well? Have you?--
Re:Have you ever considered... (Score:1)
--
Re:This is just plain silly. (Score:1)
Your trying to tie nationalist sentiment to commercial reality. Fine, there's been plenty of campaigns to 'Buy back America', but there are plenty of American companies being assessed. In the end one American company has assessed that another American company produces products that may be slighly riskier than using another American company's products or using a free alternative.
Microsoft isn't the only American company that deserves to be supported by some grassroots 'Buy back America' scheme. I'm sure there are plenty of other companies that produce less risky products that could be supported.
The veterans fought for all of America, not just Microsoft.
---
What about Unix, Mac, etc. systems? (Score:3)
Windows NT/2000
"Open Source" operating systems
What about shops using Solaris (available, but not open), HP-UX, AIX, IRIX, SCO, MacOS (pre OS-X), OS/2, and so on? Are they charged the same as NT or as Open Source(tm)?
My suspicion is that whoever wrote this article has no idea what open source means, other than 'not Windows.' I could be wrong, but it certainly sounds that way.
Computer failure insurance (Score:3)
One big problem is that many companies hate the intrusiveness of a machinery breakdown insurer. Hartford Steam Boiler won't insure something until their inspectors have been all over it and everything they want fixed has been fixed. Companies with well-run plants get great rates from Hartford Steam Boiler. Others get turned down.
The computer industry has succeeded in pushing failure costs onto their customers, rather than having to insure them. But that may not last forever. It was like that for boilers once, too.
Does anybody else find this amusing? (Score:2)
Re:I wonder if NT's ease of use could be a culprit (Score:2)
Re:Idiotic (Score:1)
"What a ridiculous concept. The security of an infrastructure is far more the people and dedication to keeping on top of issues more than it's the operating system."
That's absolutely true. That's why it's only 5-15% more expensive, because the operating system is only one aspect. If it was all about the operating system, the price difference would be significantly more.
There's no suggestion that the operating system is the only determining factor, just that it's one determining factor.
"The obvious mathematical breakthrough would be . . . an easy way to factor large prime numbers"
Nice M$ Quote (Score:1)
Re:NT is way more secure and stable (Score:1)
memory leaks here we come!
Failing to check the value returned by malloc is a bad idea. A very common bit of bad judgement that always irritates me, but how on earth would it create a memory leak? In C - probably not, in C++ - more likely (if exceptions and the pre-standard style of new are mixed)
If you are going to troll here, (and who doesn't these days?) please try to give those reading at 0 and -1 something interesting to read.
--
Just NT/Linux? (Score:1)
Really, people. I wouldn't consider this article to be very indicative of the true stability of various platforms. For instance, Windows NT 4 is a very old NOS. It was released sometime around 1996. And guess what? It sucks in many ways. But most anyone that has used Win2k (I.E. NT 5) in either a workstation or server environment will tell you that is much more stable and secure.
And what of other *nix and open source operating systems? In general, I consider the BSD distributions to be far more secure than you standard, out-of-the-box Linux distibution.
It would be very interesting to see a breakdown of major OS/NOS systems, with a "security level" rating. I wouldn't consider any study noteworthy that didn't include all of the following: Linux, WinNT, Win2k, BSD, OS X, consumer Windows (9x/Me/XP), and proboably Solaris. It is completely unfair to lump all *nix systems together and all Windows systems together.
Thoughts?
Re:Just NT/Linux? (Score:1)
Re:Just NT/Linux? (Score:1)
Didnt konw they offered insurance... (Score:5)
Do they also offer insurance against a slashdotting?
Re:insurance will encourage *stronger* security (Score:1)
At the same time, I do think that for a short time at least, this will lead to lax security in companies which do purchase these policies. Some of them will doubtless reason that simply because they have purchased this policy they have all the protection they need.
No - all of those policies will demand that the purchaser maintain stringent security. Note that the Wurzel is charging more because it is harder to maintain security when using NT; this itself directly indicates that lax security is not encouraged. If/when these policies become widespread, every time there is a break-in, the insurance provider will conduct a study to make sure that the providee measured up to the security standard outlined in the service contract. If they are found not to have been up to the standard, the provider won't cover the cost of the break-in. Any other policy and they'd soon find themselves bankrupt.
Re: (Score:2)
Comment removed (Score:3)
oh the irony.. (Score:5)
Developers: SourceForge Server Compromised
Re:Discount for OpenBSD? (Score:2)
Play around in NASCAR, though, and you need to know about every bit of the car, straight down to aerodynamics and what part of the track to be on during a turn. EVERY detail matters, and you want it done your way so it will work.
Windows : consumer car :: Linux : stock racing car
So you're a karma whore, eh? For the right price, I'll be a karma pimp...
new story subtitle: (Score:2)
I wonder if NT's ease of use could be a culprit (Score:4)
The problem is I really don't know how to secure an NT server. My mcse classes taught me nothing, other then how to setup a domain controller. I was told that NT was enterpise ready right out of the box unlike unix so it was already secure. I knew this was total bs. The thing is that there are a million resouces out there on how to secure Unix/Linux and all the configuration settings are stored in text files where you can edit them manually, but in NT its hidden in the registry. How many here actually know what the majority of the registry settings actually do? I found 1 or 2 books dealing with NT security at Borders so the situation is getting better as people discover what some of the settings are.
It would be nice to have future mcse or corporate training courses to have security methods in the circulum. Or even discuss several registry settings so we know a little more on how to customize NT. I believe NT may be secure if its done right. I believe the only time Microsoft's website was ever down was due to a linux(not NT) bug in their outsourced DNS servers. Microsoft uses a seperate company which uses linux for their DNS. I don't buy the security through obscurity arguement. Microsoft loves hiding things to make their products look easier and markets them to the average joe consumer. This may be good for home users but not bussiness users.
I remember a Microsoft semeniar where Bill Gates talked about non techie users installing NT to get work done and how great WIndows is because you don't need an admin to setup a server??
Perhaps thats the problem.
I can imagine the paper clip from MS word poping up whenever someone uses regedit in the WindowsXP.NET.
Basically the summary of problems are, lack of documentation, qualified admins, and the reboot problem is why NT is having some problems. The stability arguement is not that important considering bussinesses are using switches and clustering to make NT work. Got to love those clueless CIO's and phb's who insist on using NT over Unix. Well, if they want to pay 3x fold for an NT solution over a unix one, I guess thats their problem.
Re:Use Linux? (Score:2)
Not idiotic (Score:5)
First off, I thought I read about similar action by a London-based insurance company a few months ago - darned if I can find the URL just now tho.
Nowhere did the article say 'NT=insecure, Linux=secure'. This insurance company is doing what all insurance companies do, which is analyze their claims data and make assumptions, inferences, and policy changes based on this data. Of course inhouse skill, training levels, etc. all play into how secure a box or network is. However, according to this insurance company, their numbers are bearing out that it's more expensive to insure companies using Windows NT. Windows may be merely a symptom of a company that is lax about security in general - hiring inexperienced people, cutting security budgets, etc. But they have enough data to make a correlation between NT and higher insurance costs. (more claims? higher $ claims?)
Auto companies insuring cars will rate a sports car as a higher risk, even though it shouldn't happen that way. It's COMPLETELY down to the driver - just because I drive a red convertible sports car doens't mean that I *ever* speed, but statistically people driving red sports cars have higher accident rates, so they charge higher premiums for that car, because it's an indicator of risk. (Not sure on the specifics - I seem to remember red sports cars being higher, but could never afford one anyway, so it's a moot point for me!)
Interestingly, I was doing some work with an auto insurance company a few years ago that was looking at using people's credit ratings as a premium indicator - apparently, a credit rating is as good, or sometimes better, indicator of an auto insurance policy risk. Dunno if it's being phased in anywhere around here (Michigan) but I seem to remember the initial interest was stemming from research in California.
Back to the point - it's not idiotic at all that an insurance company would use something like software choices to base premiums on. Those choices, statistically, will point to other info about the company that is relevant as well. There will always be exceptions to the rule, but statistically, these will prove out - if they don't, insurance companies won't adopt these. If the numbers work out, they'll move in this direction. It's simple numbers.
Re:Well it had better be a never heard of exploit (Score:2)
However, if it is the fault of the company that is paying for the insurance, then the insurance company doesn't have to pay.
To liken it to car insurance, you would get paid if you were in an accident that was not your fault (someone else hits you, mechanical defect in the car, whatever), but you wouldn't get paid if you deliberately smashed the car into a tree.
Regardless of any of this, the rates that the insurance company sets (even regardless of what OS you're using) are based on actuary tables governing the chances that a system will get cracked. Odds are that most systems will never get cracked to the extent that an insurance settlement is required. Just as, odds are, most people that have auto insurance will never be in an auto accident. But they still have the insurance in case they need it.
Kierthos
Simple Questions Agents Should Ask... (Score:5)
Re:Am I the only person worried... (Score:3)
Re:Idiotic (Score:3)
Linux, due to the fact that the source code is open to anyone interested in looking at it and fixing it, and due to the ease with which it can be upgraded, and due to the generally higher level of expertise of system administrators who prefer to use it, is inherently fairly secure, on average.
Windows NT, due to the fact that Microsoft chooses to protect it's business interests, does not disclose its source code, and due to the difficulty people find in upgrading it, and also due to the generally lower level of expertise and experience in system administrators who prefer to use it, is inherently not very secure, on average.
New price list (Score:5)
In order to enhance our services and better serve you, we will adjust the insurance fee a little bit if your company is using the following:
1) Windows 2000/NT +5%
2) Windows 98/ME +10%
3) IIS +15%
4) Exchange +20%
5) Outlook +25%
6) MSN services +30%
7)
8) DNS server on Windows +60%
9) Continue the Windows subscriptions - you must be an idiot, but also our premium customer +100%
Best Rgds,
Your savior
P.S. all % accumulative, per license.
And when you call them fo get the money... (Score:2)
Sorry, we won't pay.
There is a fix for the problem for which you've been hacked, and it was published before you were hacked, therefor, you've been hacked for your incompotence.
Keep on paying the insurance, though, you never know when you might need it.
Your truly,
Dogbert.
Re:I wonder if NT's ease of use could be a culprit (Score:2)
http://www.microsoft.com/technet/security/defau
Yes, the source isn't available for figuring out your own hacks, but there's a plethora of information for system admins...
In general, it's pretty simple to secure Win2K sites. There are two cardinal rules: 1. Turn off everything you don't need, and 2. keep the patches up to date.
Number 1 involves finding out everything that's running - check your Services listing in control panel and find out what everything does, and turn it off if you don't need it. Use Add/Remove Windows Components to remove things like DNS servers or RRAS if you aren't using them.
Number 2 involves subscribing to the Microsoft Security Bulletin Service (http://www.microsoft.com/technet/security/notify
After you're settled with those to, you can then go in to tweaking Security settings on files and the registry.... there are guidelines for that in the Technet site. And then, finally, if you want, you can dig into the registry. But really, to have a secure site, for the most part you can just do everything with the GUI.
--
Convictions are more dangerous enemies of truth than lies.
Re:Perhaps they should base it on the admins (Score:4)
OTOH, almost everyone who uses/admins *nix (and especially Open Source) is a computer geek who really likes and is generally interested in computers. So the level of sophistication, on average, for Linux admins would definitely be higher.
In my mind, Windows is just a version or two away from being truly adminstrable by non-computer-geeks... they've got most of the usability down, they just need a few more setup wizards and (most important) security wizards and an MSCE will be able to run a secure shop. And then the people with the computer smarts can do more thought-provoking activities instead of setting up identical workstations, setting up accounts, and fixing printers...
Linux is much further away from being accessible to people that just want to do their job and go home without thinking about it too much. And the non-thinkers are quite a large portion of the workforce.
--
Convictions are more dangerous enemies of truth than lies.
Re:Why isn't MS-NBC reporting this? (Score:2)
Well, in a totalatarian system, the government is business. So, in a sense, Big Brother was also business.
Anyway, I have some major issues with 1984 and I could go off on a political rant, but I won't. But, right now I'm in the middle of reading Snowcrash and I am coming to the opinion that the biggest threat to personal freedom is not the government, but big business. Business that seems to be above the law. Or just find ways to simply bypass the law with technological means. Which kind of explains it.
But that's beside the point. I was trying to make a joke. Guess it didn't work. ;-)
Any company that can answer these questions: (Score:2)
2) has no money left for insurance
3) has no interest in compensation if their systems go down, because they were already completely "secured" from any use
4) has nothing on their systems worth cracking them for (see 3)
5) has been taken over by their security people, as is the fate of anyone who relies on mercenaries ("money is not the sinews of war")
--
Re:Discount for OpenBSD? (Score:4)
That's a great way to put it. This may seem a little off-topic, but bear with me here. You shouldn't have to know the very guts of a machine to use it - that defeats the purpose of the machine, who's purpose is to make your life easier and give you more free time. But, of course, you should have enough respect for the benefit it provides, to learn how to change your oil and tires. Likewise, Linux and BSD have their obvious redeeming qualities, but none of that matters if the user can't get the system setup properly to see the performance in the first place. The need for systems that provide intelligent install and config systems, without dumbing down the experience in a few important ways, is great - but once again, the user must take enough responsibility to understand a few basic things about the technology that so greatly enhances his life. That which improves one's life must ultimately be appreciated.
So what does all of this have to do with intrustion insurance and the lower opensource rates? Simple. The more complex a system is, the more prone to failure it becomes. Operating systems that try to do everything for the user will always fail - there are simply too many possibilities and branches it must be aware of in order to manage itself. We don't yet have AI, and static code is incapable of handling the infinite number of configurations and situations an operating system will encounter. With systems that bring you much closer to the metal, you tend to be dragged (or to run of your own volition) toward learning more about the system. This leads to greater competency - the insurance rates should be better. It would be the same if UPS's drivers had better training than FedEx's.