Why does military and government not use special operating systems? I mean, if they do not use generic operating system based on Windows, Linux and Mac and create their own operating system, they will be much secure.. Or am I mistaken?
They use desktop virtualization, hence they are comfortable running osx, windows and linux at once.– Andrew SmithJul 10, 2012 at 8:21
As I understand it, around 1992, Pres. Bush issued an Executive Order requiring the US Gov to standardize on the Win OS platform, Microsoft Word processor and the Adobe PDF. Not sure if that is still in effect, but probably is. It was much needed at the time but is probably bad now.– user115674Jun 26, 2016 at 20:22
Even if this is true, and relevant, it would apply only to the United States, not to any other country in the world (and last I heard, there were a few of them).– userJun 26, 2016 at 20:31
What makes you think that would help at all? "Why doesn't the government/military not use special locks? Wouldn't it be more secure?"– noɥʇʎԀʎzɐɹƆJun 26, 2016 at 20:38
3Something that most people here hadn't taken into account, is that the weakest link in security is still mostly about people, not the software. A well trained people using a secure enough OS will always beat the most secure OS that nobody knows how to work with. Familiarity with the software means recruiting and training is much easier and faster than with custom software.– Lie RyanJun 27, 2016 at 1:28
There are a number of reasons why building their "own OS" is not a viable option.
1. Research Cost
To built a new OS, from ground up without the use of any existing code would require significant research. Even today, there are only four or five popularly used kernels like Unix , Linux kernel, BSD, XNU and Windows NT.
2. Security through obscurity
It's a proven concept that security through obscurity rarely helps. Yes, it's a new OS so no "hacker" knows how it works, but it is a fact that overtime information about it will be revealed through ex or disgruntled employees. Maybe even through the researchers themselves.
Being a "custom" OS, it will have security issues of their own and no one apart from the original researchers would be able to identify or fix them.
3. COST, COST and COST
Even if such a OS was made, to patch various issues a dedicated maintenance team would have to be kept. You'd additionally need to tailor defensive software, etc to work perfectly on that machine. Any vulnerabilities in that software if emulated would just pass on. In order to make custom software, the OS specifications would have be disclosed, thus we'd need to make custom office software, mail clients, etc.
Ultimately, it's just not viable to make an OS system and use it solely for defense. As I've said earlier security through obstructed rarely helps security, it just makes it more "time-consuming-ly" difficult, but at the end of the day, the cost outweighs the benefits largely.
2Your answer is right on, but the US government has made custom OSes for security purposes in the past: See (Multix)[multicians.org/protection.html] There have been other attempts as well, but none so visible. Jul 10, 2012 at 5:39
email@example.com The paper you link to is from 1971. Back then, both computers and OSes were considerably less complex (note that I'm not saying easier to build) than they are today, and computer buyers were generally much more willing to invest not just in hardware but in purpose-written software as well. Another point is that since the average user tended much more toward the engineer end of the scale than today, they probably were more willing to put up with rough edges in software. These days, people expect to be able to run the off-the-shelf software that they are accustomed to.– userJul 10, 2012 at 8:25
@this.josh, maybe I'm missing something, but Multics was a general purpose OS, as that article says. Jul 10, 2012 at 18:34
@MatthewFlaschen "General purpose OS" is extremely vague -- I'd interpret that as meaning "it can run programs". Don't make the mistake of thinking that means it has all of the features of modern operating systems (thousands of drivers, virtual memory, multi-processor support, POSIX support, modern network protocols, modern encryption, 2D and 3D graphics API's, etc.) Jul 10, 2012 at 21:18
1This has been a really productive discussion. I guess we can understand that even if the Government made their own OS for any reason, public disclosure would not be the first thing they do. And assuming they did, it would have its own faults and vulnerabilities which the entire world would be hunting for, and they'd only have a single department of people or so to fix it. More productive to get those guys to help secure Linux, open source ftw. Jul 11, 2012 at 3:07
GreenHills Software is a company that specializes on creating OSes for military embedded systems. Their INTEGRITY system uses a microkernel (less code with less bugs) that has been formally verified (even less bugs).
Such special-purpose domains, where only the most basic software components can be re-used, are probably the only area where it is manageable to deploy a custom OS. Virtually everywhere else, the requirements for interfacing with the outside world, with regular users and with new hardware every few years will completely eat up all your development resources.
Moreover, to my knowledge it is still not well understood how to manage very large software projects. If you have the money and the people to build a new OS in a few years, chances are it will be much more expensive, take much longer, and completely borked.
Finally, there are not a lot of things where a new custom development could improve. After accommodating all the user's and policy enforcer's requirements, you will probably notice that your specialized OS becomes pretty darn similar to existing solutions. For example, its cool to imagine your minimal OS with a few thousand lines of code. Lets say you have that secured. Now you want a web browser with SSL/X509. The most simple implementation of those will likely be multiple times the size of your kernel. And if you don't use existing libraries it will be riddled with compatibility and security bugs.
The main area where OS design could be improved today is - maybe - to move towards a microkernel OS. A design as it was proposed in the Perseus and Nizza architecture could allow you to run security-critical applications with high isolation assurance next to your regular commodity OS, and let the commodity applications refer to the secure applications for tasks like signing documents, establishing session keys etc. More recent examples of this are Genode, TrustVisor and Qubes OS. However, to make such design scalable to many applications in many highly isolated compartments, you need a modern microkernel. So Qubes and TrustVisor are already out the door.
Addon: Just noticed that everyone is focusing on US and making kernels, so maybe some side note: The US, the German, the French and probably also most other governments have been and still are looking into hardened OS for certain purposes. The German government is using the SINA box, which is a hardened Linux plus smartcard that implements a VPN gateway for not-quite-so-critical tasks. Makes you wonder what they use for critical VPNs. They have funded research in alternate OS design. Today they are funding virtualization for Android, so you can run a isolated compartment on an otherwise mostly standard Android phone. SELinux by the US is well-known and the french government has a similar system. The NSA is now also trying to get SELinux into Android. The fact that several millions are spend this way bascially confirms aforementioned problems.
1I think INTEGRITY has only been semi-formally verified. It is EAL6.– guestNov 19, 2017 at 4:07
A few data points. The large cost of deploying and using a secure OS comes much more from implementation and continuing assurance than from research. Many research projects had good ideas about security and advanced the state of the art since Multics, but few of these systems did more than demonstrate a proof of concept. There is a secure OS available. Google "AESEC." This verifiably secure A1-class operating system is a descendant of Multics that runs on Intel architecture.
Multics was not a custom system: it was a standard product from Honeywell, sold to government, industry, and education;
it failed to succeed because not enough customers would pay extra for security.
Multics provided a rich feature set for its day, but it depended on hardware features that were not provided when microcomputers became popular in the 1980s. Customers chose to buy a lot of little insecure computers rather than a single big secure system. Multics security did not depend on obscurity, but rather on architecture, design, disciplined implementation, and continued assurance. When Multics was being sold, it was "modern" and had features comparable or better than other contemporary systems. Multics pioneered virtual memory, multi-processor support, encryption, graphics APIs, and networking. (It didn't have "thousands of drivers," but device drivers in Multics couldn't undo security.)
(How I know this: I worked on Multics for 16 years, and OS security for industry and government for many more than that.)
The problem I see with that research is that it often exists in a rather isolated world. Its easy to abstractly design an OS that isolates apps. Then once built you notice major problems with the abstraction: Your hardware leaks information on what was done in the "isolated" compartments, or the all-so-secure user installs a trojan horse. I'm aware of CapDesk or a recent extension on IEEE/Oakland, "User-driven access control", but fundamentally these problems are still difficult to solve. I would appreciate if you have some comment/ressources on this.– pepeJul 13, 2012 at 9:36
@pepe It may or may not count, but Qubes OS looks quite interesting in that regard. It is designed as a hypervisor, to provide clear separation between code doing different things and allowing them to interact only via defined APIs (and possibly according to defined security policies; I'm not that familiar with it).– userJun 26, 2016 at 20:38
There's at least some evidence that they do use custom OSes. The last few Multics machines seemed to be NSA gateways to the Internet. I will grant that Multics is just this side of a "custom OS", and not precisely a custom OS. Fred Cohen's seminal 1984 paper, Computer Viruses - Theory and Experiments mentions a "Bell-LaPadula Based System" running on a Univac 1108 machine, in section 5, Experiments with Computer Viruses. The description of the system seems deliberately vague. It also sounds custom-built, and who but a government would care enough to do Bell-LaPadula?
2OS experimentation was pretty common back then. You could build a reasonable userspace in a few months. Today, that effort wouldn't suffice to write a single standard app like messenger, browser or office suite. I don't believe custom designs are used anywhere anymore, except for the most specialized systems. Behind the firewalls (logical or physical), people will be running hardened Windows/Linux again.– pepeJul 13, 2012 at 9:29
There's some use of special purpose oses. For example, there's STOP which has been around for a long time, and was svid (maybe posix these days?) compliant and generally targetted b3 compliance. There is multics, and there's a bunch of b1 systems.
I guess you guys haven't been looking very hard or you've been trying to think we are naive. The government still uses DARPA UNIX. Further, to protect its airborne and security communications the USAF invented and developed the hardened OS T.E.N.S. I'm not sure our government will be able to get through OSs that are highly compartmentalized like Kali, Cubes R4 or Tails, but the multiple encryptions and complications are so beyondo they're in the 'nose bleed' section of the stadium. All of them are horridly difficult, except for the Snowden level programmers and his ilk. The real geniuses like Joanna Roskoff are, it seems, away ahead of the game. Snowden approves Cubes R4, though I don't know if he uses it. For you adventurous ones just wanting to have geekie fun I'd give it or the others a try. Lots of tutorials.
1We expect more developed answer similar to the accepted one. Also, the first sentence is not exactly "nice" (check Be nice policy ).– AlexeiJul 18, 2018 at 6:32