45

If all the computers use the same operating system, attackers only need to focus on one operating system, would it be unsafe?

  • 10
    I removed the debatable comment that one OS is more secure from another, and the comment does not affect your question. – schroeder Jun 16 '17 at 10:37
  • 38
    Obviously multiple OSs have a larger attack surface, resulting in a higher chance for a viable exploit. But a successful attack wouldn't affect all systems, limiting the maximum damage. Your pick. – Peter - Reinstate Monica Jun 16 '17 at 13:31
  • 21
    If every house in your neighbourhood has a different manufacturer for their locks, are they more or less secure against burglary? How about poison gas attack? Say what attack you are concerned about when you ask a question about security. – Eric Lippert Jun 16 '17 at 16:48
  • 4
    Security is always about tradeoffs, and there isn't a one-size-fits-all answer to this question. The cascade failure, mono-culture argument is important and needs to be considered, but so does patch management and change control. A dedicated attacker will go for the least defended system, and with size it will become almost impossible to manage N different systems within the org, keeping them all secured to a common standard. Your own org has to weigh these risks against each other. It's part of our job. -Flagged question as too opinion based. – JesseM Jun 16 '17 at 17:48
  • 1
    From a limited resources standpoint, it's easier to maintain one type of OS than multiple types. A dedicated attacker is very different from a script kiddie and having 50 windows machines and an insecure linux box nobody knows how to secure is much worse in a dedicated attack scenario. It's also easier and thereby more reliable to deploy hotfixes, gpos, etc... – RandomUs1r Jun 16 '17 at 21:50

12 Answers 12

57

In 2003, Dan Geer from @Stake published a seminal paper on this very topic - CyberInsecurity: The Cost of Monopoly. Surprisingly (given that he was employed by Microsoft at the time) he comes squarely down into the camp claiming that diversity is vital to security (emphasis mine):

Regardless of the topic – computing versus electric power generation versus air defense – survivability is all about preparing for failure so as to survive it. Survivability, whether as a concept or as a measure, is built on two pillars: replicated provisioning and diversified risk....

...redundancy has little ability to protect against cascade failure; having more computers with the same vulnerabilities cannot help if an attack can reach them all. Protection from cascade failure is instead the province of risk diversification – that is, using more than one kind of computer or device, more than one brand of operating system, which in turns assures that attacks will be limited in their effectiveness. This fundamental principle assures that, like farmers who grow more than one crop, those of us who depend on computers will not see them all fail when the next blight hits. This sort of diversification is widely accepted in almost every sector of society from finance to agriculture to telecommunications.

(He went on to conclude that Microsoft was a threat insofar as it introduced a monoculture; which turned out to be a Career Limiting Move for him at Microsoft.)


In the comments, @Johnny suggests that this is a credentialist answer. While I've chosen to quote a respected professional's well-written paper here, I do so because it mirrors my 20+ years of experience in the computer and security industry. (Which, heck, almost seems like secondary credentialism. But I'm just saying that I'm referencing rather than parroting).

For example, the 3-tier (web/app/db) architecture became a widely accepted improvement in security terms a long time ago, because the separation between differing functions helped enforce security. In that vein, my experience has been that there is a tradeoff between the additional work setting up heterogenous systems (say, IIS with a MySQL-on-Linux backend) and the additional benefit of diversity when attacks (or patches!) introduce disruption into the stack. And that I've regretted having a larger problem more times than I regretted the extra work :)

Virgin field epidemics - either because you're not segmenting your networks, or because you're using the same passwords, or you've only got one [DNS/Hosting/Network] provider, or because you're using the same OS everywhere - all end badly.

  • 5
    Risk diversification includes the inherent acceptance that a portion of the risks will always be realised. If that is within your risk tolerance, that's ok, but you can't do it blindly. Cascade failures are easy to remedy, even though the impact might be bigger then smaller individual failures. – schroeder Jun 16 '17 at 13:13
  • 5
    @schroeder the only part of your comment I beg to differ with is "Cascade failures are easy to remedy." I have never found that to be the case. – gowenfawr Jun 16 '17 at 13:17
  • 9
    While a valid answer, this is more a credentialist argument than anything-- "someone important had this opinion, so it be true." It's not 2003 anymore; BYOD environments ("bring-your-malware-to-work") are now common and infinitely more difficult to secure compared to homogenous infrastructures where hardware and software are standardized. This is currently the top answer by popular vote but in practice this guy couldn't be more wrong. Defense in depth is one thing but diversity at the endpoint level isn't layering your defenses, it's scaling your attack vectors horizontally. – Ivan Jun 16 '17 at 14:48
  • 3
    I think this depends on the weights of your risk calculation. Risk is the likelihood times impact. Surface areas and multiple attack vectors will multiply the risk of a breach. But a diversified system of different operating systems will reduce the potential impact of such a breach. The amount of work it takes to maintain a system wasn't a part of the question. If your system is big, it probably makes sense to diversify. Indeed our military is quite large and diverse. Who knows more about security than them? – Justus Eapen Jun 16 '17 at 16:17
  • 2
    But it's not true that it depends on implementation, @Johnny? You can have 3 OS with the same info (multiplying security holes), but also you can have the info distributed thorugh 3 OS, so reaching only one does not provides you with useful info. – ESL Jun 16 '17 at 23:06
32

If all the systems are the same, then there is predictability of what could go wrong and how to fix and patch. It becomes a lot easier to mitigate problems that you know about. For instance, if the network is all Windows, admins only need to keep aware of Windows risks and deploy mitigations for a single system type.

If you mix the systems, then the admins need to secure that mix to the same level of protection. You introduce a lot of unknowns and a lot of uncertainty, which increases the risks. Yes, it is possible that some systems will be more secure than others, but from a holistic perspective, the more things are the same, the easier, cheaper, and more reliable protections can be.

  • 5
    however if there is one breach at system level, it's potentially everywhere, this is pretty much the only downside – Walfrat Jun 16 '17 at 10:47
  • 1
    @Walfrat exactly, but then you know where the problem resides and your response can be coordinated - predictability is key – schroeder Jun 16 '17 at 11:10
  • 5
    @Walfrat Exactly why we have genetic diversity ;p – Cruncher Jun 16 '17 at 12:17
  • 21
    The words "eggs" and "basket" come to mind. Just make sure it's a good basket and hold it really firmly and you will have a better experienc that having to watch a dozen different baskets. – xDaizu Jun 16 '17 at 12:24
  • @Walfrat That's not been my experience. What I've seen is not that breaches attack all the systems running the same software or OS, but that the compromised systems are the ones with the untrained users and/or missing patches and/or older version of anti-virus, etc. Every breach I've seen in 100% Windows environments has been limited to only some systems, and it's always the systems that were at home or offline or something when the latest update was installed on all the other systems. Occasionally it's the system of the phishing victim that is breached regardless of patch level. – Todd Wilcox Jun 17 '17 at 15:58
13

More diverse systems make it more difficult for an infection to spread.*

Less diverse systems make it more difficult for an infection to start.**

So if your failure scenario is all your systems being infected (e.g. if you need to guarantee uptime), using multiple operating systems can help (if done correctly). If your failure scenario is one of your systems being infected (e.g. if you're a law firm with sensitive documents), using multiple systems will harm.


* A single security flaw that's known to the attacker can potentially allow compromising many or most machines running the same OS.

**A single security flaw, on any of the OSes, that's known to the attacker will be enough to allow compromising one of the machines with that flaw.


This answer ignores the possibility of using different Operating Systems for machines with inherently different attack surfaces (e.g. Unix webserver, Cisco router, Windows workstation), because at that point the answer becomes way more complicated.

3

As schroeder points out, it would be a lot more work to manage the security of such a network.

But even if managing a diverse network wasn't an issue, humans are still the weakest link of every system. Social engineering is very effective these days, and someone on a Linux box can be tricked into giving up their login credentials just as easily as someone on a Windows box can.

And even if all of your users are savvy about security and never fall for any tricks, the network still wouldn't be practical to actually use. Most of the software that the users will be using to actually do their jobs is likely not available for multiple OSes.

And even if all of your software was cross-platform, you still wouldn't be more secure. The hackers would just start writing cross-platform malware.

It's doable, but it's just not worth it.

  • "And even if all of your software was cross-platform, you still wouldn't be more secure. The hackers would just start writing cross-platform malware." - but surely writing cross-platform malware is more effort than writing malware for a single platform? – fNek Jun 18 '17 at 19:52
  • @fNek Not if you just target an already available cross-platform framework. like Office's macro, Flash, Java, PDF – Martheen Jun 19 '17 at 5:21
1

Replication and diversification protect against different kinds of attacks.

Replication is the core of any strategy used to protect the business from power outages, fire, water, and other risks where a probability distribution for the occurrence of failures can be given. This knowledge is then used to determine distribution patterns to minimize the risk.

It is an entirely different concern to protect against intentional attacks. Replication can only save a business from intentional attacks if the replicated resources are entirely inaccessible to attackers. Once attackers find out how to compromise one instance of a system, it must be assumed that all identically configured instances can become compromised as well at any moment.

Diversity forces attackers to adapt their strategy to each target. Of course, if the differences are "trivial" to some degree (1), the adaptation might not take much effort. Since the term "trivial" depends on the capabilities of the attacker, putting too much faith into diversity as a safety measure is risky as well.

(1) Debian vs. Ubuntu can be considered to differ too little from each other.

1

It depends what you are trying to achieve.

Having a diverse set of operating systems in your network will make it harder for an attacker to compromise all computers in your network. But there are very few cases where that's the goal of an attacker.

Instead, attackers usually either try to sabotage your operations by disabling essential services, or try to steal information. In these cases, compromising a single operating system on a single computer might be enough, and having multiple different operating systems in your network means that an attacker is free to (and only has to) find a vulnerability in just one of these operating systems. So here, diversity actually makes the attack a lot easier (e.g. if important files are on a network share that's accessible from Windows, Linux and MacOS desktop computer users, comprising any one of these systems can allow the attacker to gain access to those files).

1

Like so many things, it comes down to your threat model.

A diverse ecosystem provides an attacker with more than one challenge and the exploit that got him in will not get him on all the other systems.

On the other hand, do you have the knowledge and ressources to keep a diversified network constantly up-to-date and secure?

If you have a bunch of really good windows experts, but no Linux people, then introducing some Linux systems just to get diversity is likely to reduce your overall security as you have no one to properly set up, harden and maintain those systems and they will become a liability.

You also have an easier time automating patch deployment and configuration management in a less diversified environment.

The general opinion, AFAIK, is that if you can run a diversified network, you should do it. But if you lack the expertise or ressources, don't do it just for doing it.

1

The operating system is at the top layer of the networking OSI model. Layer 7 is the Application Layer. Having a monopoly OS makes exploiting security vulnerabilities more efficient but it also allows patches and resolutions of security vulnerability more efficient.

By making lower level networking protocols and their devices more secure, ie routers, we can compensate for vulnerabilities of OS in application layer. Most intrusions can be prevented with a good firewall router that can handle security at the Session (Layer 5), Transport (Layer 4), and Network (Layer 3) layers of the OSI model before the OS even sees the packets.

  • 2
    The operating system has nothing to do with OSI. OSI defines how communication happens, not what communicates. Having firewalls is generally a good idea, but that has nothing to do with this question. – fNek Jun 18 '17 at 19:55
1

As an analogy, imagine if everyone had the same lock--anyone with the key could open every door.

In my job, we have two primary OS. Very many know one operating system but few know the other. The well-versed operating system seems more prone to hacking attempts than the lesser known one. The indication is that the more well known the system, the more likely the need for precaution.

As well, other arenas have shown that a monopoly breeds complacency rather that ingenuity. In the history of Ma Bell, price rather than capability was the driving force. Once it was broke up (albeit a pain), companies broke from the pack with innovation. I think the same is true of the OS of today.

Finally, certain operating systems only function in their markets. OS390/400 works great for fast mainframe "Transactions per second" but not so well for Grandma when she's searching her recipe collection. PC/DOS is great for enthusiasts but can't really do anything beyond nostalgia stirring. Though it is true that some operating systems are mimics of each other (especially in the game console world), each still has it's own playground.

Hope that helps.

Oh, I forgot to mention... a single OS across the business is easier to maintain with patches and so forth but risks all. (A virus could take all the systems out.) Whereas, multiple different OS are more difficult to maintain but also segregates or silos your risks. The adage of "all the eggs in one basket" applies.

In my job, I have to provide multiple levels of redundancy from minor failure to smoking hole resumptions. A good backup is a mirror of the current systems--replicated servers and applications. An even better backup is a mirror of the current systems that function exactly like the current systems but on different operating systems and infrastructure. The best feasible backup is the different operating systems and a third--cloud based--backup. This points to having diversity as a preference over having simplicity.

0

It's a matter of balancing things to best fit your situation.

There are advantages to 1 for all operating system: you can develop identical security measures, settings, patches and solutions. But the disadvantage is that if one is compromised, attackers can get the rest relatively easy. This is valid for vulnerabilities and not only.

If you have many different OSes, administrating, patching and maintaining overall compatibility may be more difficult, but if one of the systems is compromised, the other OSes will be way more safe compared to the first case.

In both cases, you do need security and patching.

It also matters what OS it is. If it's an easy to be targeted one, it's best if you use others too. If it's one considered safe enough, it's fine if it's only that one.

0

True.
This is similar to "single point of failure", the failure here is due to homogeneous environment.

But security level actually depends on many factors. Even homogeneous OS environment is not as homogeneous as you imagine, i.e. heterogeneous hardware, OS version, application version, etc.

So the mitigation is all about isolating threat. For example, an organization with many computers will use bridging or VLAN to isolate network according to business operation function.

0

It will certainly make a hacker's job harder to completely compromise a network once they gain access, if the computers all have different OSes. However, if they have already gained access to the network through one computer, their job has already been made easier. Its doubtful that all OSes will be equally hardened against an attack, so there will always be the weakest link that can be used to attack the entire network.

You also have to consider that compromising the entire network isn't necessarily a hacker's end goal. If all they are after is data, its more likely that the intrusion will go unnoticed, because IT will be spending more resources just maintaining security for all the different OSes.

  • If management doesn't hire professionals to harden both OS that is their fault not the OS. – cybernard Jun 16 '17 at 15:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.