5

What is worth keeping in mind (security-wise) when choosing a set of hardware?

For example, might a cheap (or obscure) setup like a Raspberry Pi make for a less secure server than a more standard machine? Or does the security of a server depend entirely on the software it's running? (Please ignore physical security aspects like cases, locks etc.)

One thing I'm worried about, is that operating systems (in general) might be less thoroughly tested on obscure hardware. Is that a valid concern? (Sorry if that's too general; I'm not sure if I'm on the right track here.)

Improve this question
4
  • FWIW, I'm weighing up running a (Debian) server on a Raspberry Pi versus something more conventional like a Mac Mini. Obviously, the Pi is much cheaper, but I'm not sure how security should factor into this decision, if at all.
    – user6369
    Mar 5, 2012 at 3:01
  • 2
    IMHO, I think a Mac Mini is a lot more obscure than a R-Pi
    – Lucas Kauffman
    Mar 5, 2012 at 10:08
  • What do you mean? By obscure, I meant roughly, 'used by fewer people, made by a small company'.
    – user6369
    Mar 6, 2012 at 2:09
  • 1
    In security obscurity means it's undisclosed what it actually contains. See it as closed source code. You can probably find every single detail about the R-pi, whereas Apple is a lot more protective about disclosing some details about their hardware.
    – Lucas Kauffman
    Mar 6, 2012 at 7:36

2 Answers 2

Reset to default
5

I don't think the hardware should make a tangible difference in terms of security if you're comparing Raspberry Pi with a standard 32/64bit platform (i386, amd64 etc). Unless you consider physical security (which you don't), or perhaps from availability perspective, which is also an important part of security, but I'm guessing this is not what you're after.

From what I see about the Raspberry Pi, it's simply an ARM platform, typically used in many devices like smart-phones, routers, voip gateways etc. ARM is a very widely deployed platform, so in that respect it's still a good choice. It's definitely not obscure.

Whilst there might be some marginal differences in terms of what security features the platform can offer. For example whether or not it uses the NX bit, I would say that your primary concern is not the hardware but rather the software that you're running, and the way you expose your server to the outside world. Software itself might be vulnerable on either platforms and this is more likely to be your "weakest link". This includes the software you choose (OS, web stack, services, listeners etc) or your own application if you develop it.

Improve this answer
1
  • Wouldn't the BIOS version make a difference? I mean, I know that's firmware, but since it's heavily tied to the hardware...
    – root
    Apr 3, 2013 at 19:43
0

The hardware platform doesn't make much difference to security.

A 64-bit (x86-64) platform will offer some slight improvements in security over a 32-bit platform, because it provides better support for ASLR and for the NX bit. (ASLR is much weaker on 32-bit platforms.) Also, a modern server-class CPU will provide support for hardware-accelerated virtualization, which may slightly reduce the performance overhead of virtualization (though it won't make much noticeable difference to security apart from that). However, these are very modest differences.

Bottom line: for security against remote attacks, focus your time and energy on the software and system configuration/administration. That will make the biggest difference to security.

Improve this answer
0

You must log in to answer this question.