First off.. The point of this article is not to hold Microsoft "financially responsible" for the patching efforts.. it's to make people realize that using MS software is going to make you more prone to attacks, and being prone to those attacks makes you patch more often, and finally, when you patch with the frequency that you "should patch" it's going to cost you money.. Money that is not included in Microsofts manufactured TCO. I'm not saying that Linux, BSD, or *NIX of any type is secure.. I'm saying that Microsoft has more patches out for their OS's than any other software provider, bar none.

The problem comes when people try to use Microsoft in "real companies" - IE, not a 20 PC shop run by someone who "knows computers" and got their favorite certification. In these "real companies" you can't roll a patch out the day after it comes out, even a week after it comes out. Where I work my group admins around 120 Windows 2000 servers, that can be shut down *maybe* once a month. The activity that happens then has to be tested, and re-tested, which can take quite a bit of time.. (recently, more time than it took for the blaster virus to infect us) - I guess people can say "oh, you didn't run out and install the fix when daddy said so!" Well, unfortunately we can't afford unscheduled downtime, and I refuse to down servers every other week, and work nights (to make sure everything went ok) just to insure security fixes are in place.

Who ever said a server needs a pretty point and clickety interface anyway :)

- G


[ reply ]

Link to this comment: http://www.securityfocus.com/comments/columns/185/22325#22325