Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

What is worth keeping in mind (security-wise) when choosing a set of hardware?

For example, might a cheap (or obscure) setup like a Raspberry Pi make for a less secure server than a more standard machine? Or does the security of a server depend entirely on the software it's running? (Please ignore physical security aspects like cases, locks etc.)

One thing I'm worried about, is that operating systems (in general) might be less thoroughly tested on obscure hardware. Is that a valid concern? (Sorry if that's too general; I'm not sure if I'm on the right track here.)

share|improve this question
    
FWIW, I'm weighing up running a (Debian) server on a Raspberry Pi versus something more conventional like a Mac Mini. Obviously, the Pi is much cheaper, but I'm not sure how security should factor into this decision, if at all. –  norcoo Mar 5 '12 at 3:01
1  
IMHO, I think a Mac Mini is a lot more obscure than a R-Pi –  Lucas Kauffman Mar 5 '12 at 10:08
    
What do you mean? By obscure, I meant roughly, 'used by fewer people, made by a small company'. –  norcoo Mar 6 '12 at 2:09
    
In security obscurity means it's undisclosed what it actually contains. See it as closed source code. You can probably find every single detail about the R-pi, whereas Apple is a lot more protective about disclosing some details about their hardware. –  Lucas Kauffman Mar 6 '12 at 7:36
    
Ah, okay. Fair point. –  norcoo Mar 7 '12 at 4:09
add comment

2 Answers

up vote 6 down vote accepted

I don't think the hardware should make a tangible difference in terms of security if you're comparing Raspberry Pi with a standard 32/64bit platform (i386, amd64 etc). Unless you consider physical security (which you don't), or perhaps from availability perspective, which is also an important part of security, but I'm guessing this is not what you're after.

From what I see about the Raspberry Pi, it's simply an ARM platform, typically used in many devices like smart-phones, routers, voip gateways etc. ARM is a very widely deployed platform, so in that respect it's still a good choice. It's definitely not obscure.

Whilst there might be some marginal differences in terms of what security features the platform can offer. For example whether or not it uses the NX bit, I would say that your primary concern is not the hardware but rather the software that you're running, and the way you expose your server to the outside world. Software itself might be vulnerable on either platforms and this is more likely to be your "weakest link". This includes the software you choose (OS, web stack, services, listeners etc) or your own application if you develop it.

share|improve this answer
1  
Thanks. Also, I didn't know about NX bit; something to read about. –  norcoo Mar 6 '12 at 2:30
    
Wouldn't the BIOS version make a difference? I mean, I know that's firmware, but since it's heavily tied to the hardware... –  root Apr 3 '13 at 19:43
add comment

The hardware platform doesn't make much difference to security.

A 64-bit (x86-64) platform will offer some slight improvements in security over a 32-bit platform, because it provides better support for ASLR and for the NX bit. (ASLR is much weaker on 32-bit platforms.) Also, a modern server-class CPU will provide support for hardware-accelerated virtualization, which may slightly reduce the performance overhead of virtualization (though it won't make much noticeable difference to security apart from that). However, these are very modest differences.

Bottom line: for security against remote attacks, focus your time and energy on the software and system configuration/administration. That will make the biggest difference to security.

share|improve this answer
    
Thanks, I will focus more on the software etc. And ASLR will give me something else to read about. –  norcoo Mar 6 '12 at 2:38
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.