2

Microsoft claims in their official site that “SQL Server is the least vulnerable database for six years running in the NIST vulnerabilities database”, I reviewed the NIST web site, but I can’t find a proof for their claims!

Do they summarize multiple reports from NIST? What are these reports?

closed as primarily opinion-based by André Borie, Dmitry Grigoryev, Matthew, Purefan, S.L. Barth Jan 24 '17 at 12:31

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Anecdotally, yes, SQL Server is the least vulnerable database. At least, among full-feature databases. You could argue that SQLite is more secure, but it's not a direct comparison. I don't have figures to back this up, just personal experience. – paj28 Jan 24 '17 at 11:01
  • 3
    I don't think that verifying advertisement claims fits very well into the scope of this site. – Dmitry Grigoryev Jan 24 '17 at 11:11
  • 2
    Perhaps your better question is: how can one use the NIST database in order to claim that one software is more/less secure than another? But once you phrase it like that, then the flaws in the logic become obvious. For instance, what metric allows you to conclude 'secure'? Number of entries? Severity of entries? Unpatched flaws? Some sort of weighted calculation of all 3? – schroeder Jan 24 '17 at 11:32
  • I think in this case, why not just ask Microsoft? They probably won't mind being more specific about this claim, if not already published on their website somewhere anyway. – user81147 Jan 24 '17 at 13:20
  • @SamehDeabes you should make it an actual comment, and not part of the question. Besides, your comment was unnecessary because you were just repeating what you already change in your title. – schroeder Feb 5 '17 at 11:20
6

When they say that, they are probably referring to the number of published exploits and vulnerabilities for their product. If true, this is a very, very bad idea.

I'm actually surprised it says that. Published exploits are not an indicator of a product's security. They only indicate how much and many people are looking for exploits. In the worst case, these exploits might've been sold to a 0day broker and might still remain unknown.

Don't use this as a metric to choose a DB server. Seriously - it's a terrible idea.

  • People are actively researching SQL server. -1 for "shame on you Microsoft" – paj28 Jan 24 '17 at 10:58
  • 2
    Actually concur with this answer entirely +1. To a large extent, he is right that a lack of discovered vulnerabilities is no evidence as to how many there actually are. There will, undoubtedly, be systems that are of more interest to security researchers than others. – user81147 Jan 24 '17 at 11:33
  • 1
    @JᴀʏMᴇᴇ - I should probably also say - sometimes some systems are more valuable than others - the money in the 0day market is huge. The less exploits publicly available in a system, and the more it is hardened, the higher the price tag on an exploit. Which is why it's a bad idea to use them as indicators of security. – thel3l Jan 24 '17 at 11:39
  • 1
    @thel3l - also, severity should probably be taken into consideration when talking about the security of a system with vulnerabilities. – user81147 Jan 24 '17 at 13:19
  • 4
    Microsoft also has a habit of counting their vulns once and other people's vulns for each platform they're publicized on - MySQL on Red Hat, MySQL on Solaris, MySQL on Debian equals 3 in their math. Since they're a monoculture, they come out ahead in that game. – gowenfawr Jan 24 '17 at 15:27

Not the answer you're looking for? Browse other questions tagged or ask your own question.