The Truth About OS X Security
By Daniel Miessler on February 11th, 2006: Tagged as Apple | Information Security | OS X | Security | Windows
Many are debating the question of how vulnerable Apple’s OS X operating system is relative to Windows. You essentially have two sides — one saying that it’s inherently more secure (and hence less successfully attacked), and the other side saying that it’s only because of marketshare that there haven’t been more issues.
A Model
Well, I think I have a model for explaining the interaction between these two theories. Essentially, OS X has issues just like FreeBSD, Linux, Windows, or any other OS does; the issues just haven’t surfaced yet because of the lack of interest in exploiting such a small userbase. Where people go wrong, however, is assuming that it’s going to get as bad as Windows has been. It’s not.
Conceptualize this as if there are two ratings — one is the potential for attack, and the second is the degree to which the potential has been actualized.
Well, let us say that Windows has a 90% potential with an 80% actualized. In other words it’s highly vulnerable and has been and is being exploited nearly to that potential. OS X, on the other hand, has a much lower potential — say in the 50% range — but it’s seen virtually no exposure due to the lack of interest from attackers (due to limited marketshare). I’d say it’s actualized rating is around 5%.
The Future
What this means is that over the next year or so you’re going to see a massive increase in the flaws found in OS X due to the exponential increase in its popularity. Notice that using my model and numbers this means that OS X has 45% of its vulnerability potential untapped, whereas Windows only has 10%.
This doesn’t mean it’s more vulnerable — only that more of its vulnerability is yet undiscovered and unexploited.
So, all the Mac zealots who think their platform is invulnerable are in for a violent awakening. On the flip side, all the Microsoft disciples who think OS X is about to be rocked the same degree that Windows has been are equally off track.
As with most debates, the extremes seem to have major issues with their arguments. The truth always ends up incorporating elements from both sides and falling somewhere in the middle.