Software // Enterprise Applications
News
3/31/2008
04:12 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Apple's Security Patch Process Gets Worse While Microsoft's Gets Better

Swiss researchers suggest that the revived popularity of Apple's products may have left the company unable to keep up with security risks.

Apple has been getting worse at dealing with security vulnerabilities while Microsoft has been getting better, according to a research paper published by Swiss security researchers.

In "0-Day Patch Exposing Vendors (In)security Performance," presented last week at the Black Hat conference in Amsterdam, Stefan Frei, Bernhard Tellenbach, and Bernhard Plattner of the Computer Engineering and Networks Laboratory at the Swiss Federal Institute of Technology analyzed Apple's and Microsoft's security practices over the past six years and found that Microsoft has been getting better at responding to security issues while Apple has been getting worse.

During the period studied, between 2002 and 2007, Microsoft had 658 high- and medium-risk vulnerabilities, compared with 738 for Apple, the paper says.

The revived popularity of Apple's products, the researchers suggest, may have left Apple unable to keep up. "Comparing the number of unpatched vulnerabilities per vendor for the period since January 2002 we observe a striking difference between Microsoft and Apple," the report says. "On average, Microsoft succeeds to keep the average number of unpatched vulnerabilities below 20 at a steady number. On the opposite, Apple seems unable to stabilize the number of unpatched vulnerabilities in recent years. We observe a steady increase in recent years for Apple. It seams [sic] that Apple's security processes and resources cannot cope with the side-effects of the increased popularity of their products."

Indeed, some Apple partisans have suggested that the successful hacking of a MacBook Air in the "PWN to OWN" contest at the CanSecWest security conference in Vancouver, British Columbia, last week was a deliberate attempt by security researchers to win Apple's sleek subnotebook for themselves and a rejection of the Sony Vaio and Fujitsu U810 computers that winning contestants could also have walked away with.

It should be noted that the researchers are analyzing Apple's patch process rather than the overall security of its products. The fact that antivirus software is still optional on Macs and all but necessary on Windows PCs demonstrates where the risk of malware is actually present.

Macs continue to benefit from security through obscurity, but that advantage is eroding as Mac market share continues to rise. Mac users may not welcome this, but computer security vendors surely will.

Comment  | 
Print  | 
More Insights
Building A Mobile Business Mindset
Building A Mobile Business Mindset
Among 688 respondents, 46% have deployed mobile apps, with an additional 24% planning to in the next year. Soon all apps will look like mobile apps and it's past time for those with no plans to get cracking.
Register for InformationWeek Newsletters
White Papers
Current Issue
InformationWeek Government Tech Digest Oct. 27, 2014
To meet obligations -- and avoid accusations of cover-up and incompetence -- federal agencies must get serious about digitizing records.
Video
Slideshows
Twitter Feed
InformationWeek Radio
Archived InformationWeek Radio
A roundup of the top stories and community news at InformationWeek.com.
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.