-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

October 2, 1997

                    Choosing an Operating System 

We receive reports of incidents from sites that use a wide variety of
operating systems (OS). Because of operating-system-related difficulties these
sites have experienced, we are recommending some things to consider before
choosing an operating system.


In-House vs. Outside Tech Support

Consider these things:

  - Do you have in-house expertise to do necessary software maintenance if
    you're using freely available software?
  - Can you buy a product with vendor-supplied customer support? 
  - Do you need to pay a third party for customer support?


Freely-Available vs. Commercial Software

If you have knowledgeable staff, you may choose to use freely available OS
versions so that you can maintain or fine tune the product to meet specific
requirements. You might have more confidence in the modified OS because you
were responsible for making changes or closely involved in the implementation
of patches or workarounds. If you know about a vulnerability and understand
the problem, you may want to apply fixes immediately to the source code rather
than wait for an upgrade or patch to be released through other channels.

If you select freely available OS versions and don't have the resources to
maintain software in-house, it's important to know that you could be placing
your site at a high risk of compromise. This risk can exist because your site
will not be receiving security patches on a regular basis from a vendor (or
third party). In cases where intruders are exploiting a vulnerability,
operating system vendors may have analyzed the vulnerability and released
security patches for their operating systems. On the other hand, sites with
freely available OS versions but without the expertise to develop and install
patches may remain at risk from the vulnerability.

If you do not have the time or expertise to modify and maintain an operating
system in-house, you might choose a commercial vendor product. When you buy a
commercial operating system, you can purchase a service contract to provide
you with patches, upgrades, and other customer assistance. Alternatively, you
could buy third-party service or select products from vendors who implement
fixes and make patches publicly available.


Understand Your Needs

When choosing an operating system, there are many things you need to consider.
Among these are

  - Availability of source code vs. binaries 
  - Availability of technical expertise (internal and external)
  - Maintenance and/or customer support 
  - Customer requirements and usability 
  - Cost of software, hardware, and technical support staff

Regardless of the choice you make, you should first carefully review and
understand the needs of your organization or customer base in terms of
resources, cost, and security risk, as well as any site-specific constraints;
compare the available products and services to your needs; and then determine
what product best matches your needs.



- ------------------------------------------------------------------------------

Copyright 1996 Carnegie Mellon University. Conditions for use, disclaimers,
and sponsorship information can be found in
http://www.cert.org/legal_stuff.html and ftp://ftp.cert.org/pub/legal_stuff .
If you do not have FTP or web access, send mail to cert@cert.org with
"copyright" in the subject line.

CERT is registered in the U.S. Patent and Trademark Office.


-----BEGIN PGP SIGNATURE-----
Version: PGP for Personal Privacy 5.0
Charset: noconv

iQA/AwUBOBTCcFr9kb5qlZHQEQKDSwCfa9ooagh7oEBTsWWp4W3HSRNJLGQAn3ok
onVZPx0FIKuyAeHauYN651Cv
=+bZz
-----END PGP SIGNATURE-----