Tech Shout!

Microsoft, the software giant has frequently been criticized for releasing insecure products, with security holes and vulnerabilities galore. However, Symantec, the world’s leading security company thinks otherwise, and has said so in a forthright manner in its latest research report.

In Symantec’s 11th Internet Security Threat report, the company said that when it comes to widely-used operating systems, Microsoft has being doing better overall when compared to its leading commercial competitors. This report was released this week itself, and covers a vast range of security and vulnerability issues over the last six months of 2006.

The Symantec report found that Microsoft Windows had the fewest number of patches and the shortest average patch development time when compared with the five operating systems that the security giant had monitored in the second half of 2006.

During this period, 39 vulnerabilities, 12 of which were ranked high priority or severe, were found in Microsoft Windows. However, Microsoft took an average of 21 days to fix them all.

The next best performer was Red Hat Linux, which required an average of 58 days to address a total of 208 vulnerabilities. However, this was a significant increase in both problems and fix time over the first half of 2006, when there were 42 vulnerabilities in Red Hat with an average fix time of 13 days.

Next up was Mac OS X, and if you read further you will realize that Apple has absolutely nothing to boast about. Symantec found 43 vulnerabilities in Mac OS X and a 66 day turnaround on fixes. Fortunately, only one was high priority. Like the others, this is also an increase over the first half of the year. For the first half of 2006, 21 vulnerabilities were found in Mac OS X and Apple took on average 37 days to fix them.

In the rear, was HP-UX from Hewlett Packard and Solaris from Sun. HP-UX had 98 vulnerabilities in the second half of 2006 and took 101 days to fix them. Sun, which had 63 vulnerabilities, took an average of 122 days to fix them. The company didn’t do any better in the first half of 2006 either, as Sun took 89 days to fix 16 vulnerabilities.

According to Alfred Huger, vice president of engineering for Symantec Security Center, the real problem is with Web applications, where two-thirds of all vulnerabilities are found. Operating systems are fairly minor, and despite the long time periods, the vendors are doing “an ok job, just not stellar.”