Diversity in Computers Prevents Major Attacks?
Posted: Fri Feb 21, 2003 5:10 pm
I read an interesting passage in the book "The Cuckoo's Egg," by Clifford Stoll, that I thought was provocative and worth noting. (By the way, for those who don't know, Stoll was an astronomer-turned-sysop at Berkeley who helped catch a gang of German intel guys who were breaking into US computers for the KGB during the 1980s.) It seems so obvious now, but I'd never really thought of it before. A lot of people knock the Macintosh OS, and say everyone should just use Windows--and I won't even go into the tiny percentage of people who use Linux/Unix, and other operating systems. But Mr. Stoll notes how it might indeed be a good thing we have so many different systems, even though it results in the lack of a true standard in computing. Consider this:
I find that to be a rather profound statement, especially the final sentence. Imagine if every computer in the world was the same, and one attack could take out entire sections of a network in one stroke, or even an entire network. (Think about the recent outage that was due to a flaw in Microsoft's software.) I think Mr. Stoll's passage is definitely something to chew on. I suppose many people might find this pointless, but I am interested in computer security, and I just thought this was an interesting topic and passage to post.from The Cuckoo's Egg by Clifford Stoll, p. 48 wrote:Wayne had a good point. The hacker's Trojan horse attack had failed because the operating system wasn't exactly what he was accustomed to. If everyone used the same version of the same operating system, a single security hole would let hackers into all the computers. Instead, there's a multitude of operating systems: Berkeley Unix, AT&T Unix, DEC'S VMS, IBM's TSO, VM, DOS, even Macintoshes and Ataris. This variety of software meant that no single attack could succeed against all systems. Just like genetic diversity, which prevents an epidemic from wiping out a whole species at once, diversity in software is a good thing.