It’s no secret that the operating system you choose is a key determinant of your online security. After all, your operating system is the most critical software running on your computer: it manages your memory and processes, as well as all your software and hardware. The general consensus among experts is that Linux is a highly secure operating system, arguably the most secure operating system by design. This article will examine the key factors that contribute to robust Linux security and evaluate the level of protection against vulnerabilities and attacks that Linux offers administrators and users.
Secure by Design
When it comes to security, Linux users have a distinct advantage over their counterparts using Windows or Mac. Unlike proprietary operating systems, Linux in many ways has security built into its core design. The increasingly popular open source operating system is highly flexible, configurable and diverse. It also implements a strict user privilege model and offers a selection of security defenses built into the kernel to protect against vulnerabilities and attacks. The transparency of Linux source code means that vulnerabilities in it, which are inevitable to some extent in any operating system, are almost always short-lived. Let’s take a closer look at each of these factors and how it contributes to Linux’s advertised security.
Linux
source code
undergoes constant and thorough review by members of the vibrant global open source community and as a result of this scrutiny, Linux security vulnerabilities are usually identified and removed very quickly. In contrast, proprietary vendors like Microsoft and Apple employ a method known as “security by obscurity,” where source code is hidden from outsiders in an attempt to hide vulnerabilities from threat actors. However, this approach is generally ineffective at preventing modern exploits and actually undermines the security of “hidden” source code by preventing outsiders from identifying and reporting flaws before they are discovered by malicious actors. Let’s face it: when it comes to discovering security bugs, a small team of proprietary developers is no match for the worldwide community of Linux user-developers who are deeply committed to their work for both their own benefit and the benefit of the community.
Unlike
Windows, where “everyone is an administrator,” Linux heavily restricts root access through a strict user privilege model. On Linux, the superuser has all privileges, and normal users are only granted enough permissions to perform common tasks. Because Linux users have low automatic access rights and require additional permissions to open attachments, access files, or adjust kernel options, it is more difficult to spread malware and rootkits on a Linux system. Therefore, these inherent constraints serve as a key defense against attacks and system compromise.
The
Linux kernel
has a number of built-in security defenses including firewalls that use packet filters in the kernel, the UEFI Secure Boot firmware verification mechanism, the Linux Kernel Lockdown configuration option, and the SELinux or AppArmor Mandatory Access Control (MAC) security enhancement systems. By enabling these features and configuring them to provide the highest level of security in a practice known as Linux kernel self-protection, administrators can add an extra layer of security to their systems.
There is a high level of diversity possible within Linux environments as a result of the many Linux distributions (distributions) available and the different system architectures and components they present. This diversity not only helps meet individual user requirements, but also helps protect against attacks by making it difficult for malicious actors to efficiently craft exploits that can be used against a wide range of Linux systems. In contrast, Windows’ homogeneous “monoculture” makes Windows a relatively easy and efficient attack target.
In addition to the design diversity seen in Linux, certain secure Linux distributions differ in ways that specifically address the advanced security and privacy concerns shared among pentesters, reverse engineers, and security researchers.
There are
many
more configuration and control options available to Linux administrators than to Windows users, many of which can be used to enhance security. For example, Linux system administrators have the ability to use SELinux or AppArmor to lock down their system with security policies that offer granular access controls, providing an additional critical layer of security throughout the system. Administrators can also use the Linux Kernel Lockdown configuration option to strengthen the divide between user processes and kernel code, and they can harden the sysctl.conf file, the main configuration point of kernel parameters for a Linux system, to give their system a more secure foundation.
Linux: An increasingly popular target among
cybercriminals
Linux powers most of the world’s high-value devices and supercomputers and the operating system’s user base is growing steadily, and cybercriminals have taken note of these trends. Malware authors and operators are increasingly targeting Linux systems in their malicious campaigns. The last few years have been plagued by emerging strains of Linux malware: Cloud Snooper, EvilGnome, HiddenWasp, QNAPCrypt, GonnaCry, FBOT, and Tycoon are among the most notorious. That said, Linux is still a relatively small target, with 83% of malware targeting Windows systems in 2020. Also, the recent increase in Linux malware attacks is not a reflection of Linux security. Most attacks on Linux systems can be attributed to misconfigurations and poor administration, highlighting a widespread failure among Linux system administrators to prioritize security.
Fortunately, as Linux malware
continues to become more prevalent and problematic, Linux has built-in protection against malware attacks through its strict user privilege model and design diversity, and there is a selection of excellent tools, toolkits, and malware scanning and reverse engineering utilities, including REMnux, Chkrootkit, Rkhunter, Lynis and Linux Malware Detect (LMD) available to help administrators detect and analyze malware on their systems.
The
security of
the operating system you implement is a key determinant of your online security, but it is by no means a secure protection against malware, rootkits, and other attacks. Effective security depends on defense-in-depth, and other factors, including implementing security best practices and smart online behavior, play a central role in your digital security posture. That said, choosing a secure operating system is of utmost importance, as the operating system is the most critical piece of software running on your computer, and Linux is an excellent choice, as it has the potential to be highly secure, possibly more so than its proprietary counterparts, due to its open-source, strict user privilege model, diversity and relatively small user base.
However, Linux is not a “silver bullet” when it comes to digital security: the operating system must be properly and securely configured and system administrators must practice safe and responsible administration to prevent attacks. In addition, it is crucial to note that security is all about trade-offs, both between security and usability and between security and ease of use. LinuxSecurity founder Dave Wreski explains, “The most secure system is one that’s turned off, covered in cement, and located on the ocean floor, but this system obviously isn’t very usable. Administrators should configure their systems to be as secure as practical within their environment. When it comes to convenience, Linux has a bit of a learning curve, but it offers significant security advantages over Windows or MacOS. It’s a worthwhile compensation if you ask me.”
We want to hear your thoughts! Connect with us on social media:
Twitter | Facebook
