Perimeter
2/10/2009
06:15 PM
Sara Peters
Sara Peters
Commentary
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Could Slimmer OSes Lead To Better Mobile Device Security?

Maybe I'm stretching a bit, but let's say that operating system developers slimmed down their standard OSes enough so that eventually they'd be skinny enough to have a career in fashion and, more important, run on mobile devices. And, if so, would this be a good thing for mobile device security?

Maybe I'm stretching a bit, but let's say that operating system developers slimmed down their standard OSes enough so that eventually they'd be skinny enough to have a career in fashion and, more important, run on mobile devices. And, if so, would this be a good thing for mobile device security?I pondered this today while reading Ephraim Schwartz's story on ComputerWorld, "The incredible shrinking operating system."

I've spoken before about how delightful it would be if Microsoft, Apple, and their colleagues would cool it with the window dressing and frenetic adding of new features, and, instead, take some time to make their current OSes slimmer. In fact, I was a bit giddy when Mac announced this was precisely its plan for Mac OS X "Snow Leopard." A trim OS moves more quickly than a massive, bloated OS. Plus, less code generally means more security.

Another compelling reason Schwartz mentioned for putting operating systems on a diet is because "a smaller OS can run on a greater variety of devices, and as netbooks, smartphones, and new devices like the iPod Touch gain traction, the benefit of a smaller OS becomes hard to ignore."

OK, so let's say your Apple comes out with the new, slim-and-sexy Mac OS X Snow Leopard, and it can run on your iPhone.

Good thing? Bad thing?

From an interoperability, ease-of-use standpoint, it sounds good. From a security standpoint--well, it could be good because the mobile platform would have gone through the same scrutiny as other operating systems. (Maybe Mac's a bad example, here, but you get my point.)

Similarly, the iPhone's Snow Leopard operating system could theoretically run the same well-scrutinized applications as an iMac's Snow Leopard. (Realistically, though, the applications, themselves, would have to lose a lot of tonnage if they want to dance with an iPhone's comparatively puny RAM.) If, for example, the security industry ever succeeds in developing a secure Web browser that actually works,, I'd love to see it work on my BlackBerry.

On the other hand, narrowing the number of OSes to pen test and exploit might make attackers' job easier.

I'm just beginning to ponder this. I'm eager to gain the benefit of your thoughts.

Sara Peters is senior editor at Computer Security Institute. Special to Dark Reading. Sara Peters is Senior Editor at Dark Reading and formerly the editor-in-chief of Enterprise Efficiency. Prior that she was senior editor for the Computer Security Institute, writing and speaking about virtualization, identity management, cybersecurity law, and a myriad ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-2086
Published: 2015-02-26
Cross-site scripting (XSS) vulnerability in the live preview in the Panopoly Magic module before 7.x-1.17 for Drupal allows remote authenticated users to inject arbitrary web script or HTML via a pane title.

CVE-2015-2087
Published: 2015-02-26
Unrestricted file upload vulnerability in the Avatar Uploader module before 6.x-1.3 for Drupal allows remote authenticated users to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via unspecified vectors.

CVE-2015-2088
Published: 2015-02-26
Cross-site scripting (XSS) vulnerability in unspecified administration pages in the Term Queue module before 6.x-1.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via unknown vectors.

CVE-2015-2089
Published: 2015-02-26
Multiple cross-site request forgery (CSRF) vulnerabilities in the CrossSlide jQuery (crossslide-jquery-plugin-for-wordpress) plugin 2.0.5 for WordPress allow remote attackers to hijack the authentication of administrators for requests that (1) change plugin settings or conduct cross-site scripting (...

CVE-2015-2090
Published: 2015-02-26
SQL injection vulnerability in the ajax_survey function in settings.php in the WordPress Survey and Poll plugin 1.1.7 for Wordpress allows remote attackers to execute arbitrary SQL commands via the survey_id parameter in an ajax_survey action to wp-admin/admin-ajax.php.

Dark Reading Radio
Archived Dark Reading Radio
How can security professionals better engage with their peers, both in person and online? In this Dark Reading Radio show, we will talk to leaders at some of the security industry’s professional organizations about how security pros can get more involved – with their colleagues in the same industry, with their peers in other industries, and with the IT security community as a whole.