OpenVMS Security merits etc.

[Brian Reiter]

Hi Folks,

Just a quick request for help and information. Like many companies we're trying to persuade our clients to remain with OpenVMS rather than a migration to Windows. We've tried migrations in the past and as a rule it takes too long, the only benefits tend to be that the hardware is cheaper (but fails more frequently).

Anyway, security of the systems has again raised its head, and I'm just wondering if anybody has come across articles detailing the security/management aspects of the follows OSes. (I've been asked to produce a quick report on the OSes currently in use and I don't have the time at the mo' for a full scale internet browsing session)

OpenVMS (I know about this bit)
AIX Unix
LINUS
Windows (XP/Server)

I know I may get a slightly biased view :) from this forum but any links to articles/papers would be appreciated.

thanks for your help

Brian

[Antoniov.]

Brian,
I remember another thread about this argoument http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=555089

Perhaps can help you ?

Antonio Vigliotti

[Brian Reiter]

More interested in security info on all 4 platforms. I've just read John Wisniewski's security for OpenVMS presentation (well worth it), which covers most of what I wanted to know for VMS.

cheers

Brian

[Ian Miller.]

See also
http://h71000.www7.hp.com/openvms/whitepapers/TCS_2004.pdf

and
http://itmanagement.earthweb.com/erp/article.php/3380341
and
http://www.computerweekly.com/articles/article.asp?liArticleID=131808

[Keith Cayemberg]

Here are a few more articles with statements concerning the security of Operating Systems other than OpenVMS.


Lead Windows developer bugged by security
http://www.nwfusion.com/news/2002/0905valen.html
Linux is favourite hacker target: Study - Globetechnology
http://www.globetechnology.com/servlet/story/RTGAM.20030911.gtlinuxsep11/BNStory/Technology/
Microsoft cerebrates fifteen years of poor security
http://www.theinquirer.net/?article=11108
Microsoft software 'riddled with vulnerabilities', trade body claims
http://www.theinquirer.net/?article=11249
MS: Secure computing is still a decade away
http://reviews-zdnet.com.com/4520-7297_16-4207833.html
Next-Generation Win32 exploits: fundamental API flaws
http://security.tombom.co.uk/shatter.html
Nimda Worm Shows You Can't Always Patch Fast Enough
http://www.gartner.com/DisplayDocument?doc_cd=101034
Reliance On Microsoft Danger To National Security
http://www.techweb.com/wire/story/TWB20030924S0008
Software vulnerabilities still dog operating systems
http://www.theinquirer.net/?article=13420
Would the real insecure OS please stand up?
http://arstechnica.com/news/posts/20021127-882.html

The discourse "Next-Generation Win32 exploits: fundamental API flaws" also known as The Shatter Exploit Paper is especially damning of Windows. Essentially, it states that the Win32 API has an inherently flawed design with regard to security, and this design can't be corrected without making all Win32 API based applications incompatible and obsolete.

Cheers!

Keith Cayemberg

[Martin P.J. Zinser]

Hi Brian,

if security also encompasses "How often do I have to patch the system" the new TCO study comparing VMS and AIX might be of interest.

It is over at

http://h71000.www7.hp.com/news/tco.html

Greetings, Martin

[Brian Reiter]

Hi Folks,

Thanks for your help. At least now we can give some very good reasons for not wanting to migrate important and vital system to a Windows platform. It may still happen but at least we aren't rolling over and agreeing with the client (and their possee of consultants).


regards

Brian

[Ian Miller.]

See also
http://groups.google.com/groups?selm=3a65a5c8.0401091542.1df169b%40posting.google.com
and
http://www.google.com/groups?hl=en&lr=&ie=UTF-8&threadm=40fec85a%240%2419744%249b4e6d93%40newsread2.arcor-online.net&rnum=1&prev=/groups%3Fq%3Dgroup:comp.os.vms%2Binsubject:OpenVMS%2Binsubject:security%2Bauthor:Keith%2Bauthor:Cayemberg%26hl%3Den%26lr%3D%26ie%3DUTF-8%26as_drrb%3Db%26as_mind%3D21%26as_minm%3D7%26as_miny%3D2004%26as_maxd%3D23%26as_maxm%3D7%26as_maxy%3D2004%26selm%3D40fec85a%25240%252...

[Robert Gezelter]

Brian,

The whitepapers already mentioned are a good start.

Another point would be my presentation at HPWORLD 2004 on managing user environments at
http://www.rlgsc.com/hpworld/2004/n227.html.

See the reports written by the late John Wisniewski of the (unsuccessful) DEFCON 9 cracking attempts against OpenVMS.

Also, see some of my published articles on OpenVMS.org.

I hope that the above is useful.

- Bob Gezelter, http://www.rlgsc.com