Surprise! You're a target! But certainly you knew that already. I point out this bit of information because according to statistics recently published at Attrition.org, Windows NT is the most frequently defaced Web server on the planet, with Linux ranked second, and Windows 2000 coming in seventh behind other brands of UNIX. According to statistics, between August 1, 1999, and January 16, 2001, Attrition.org received reports about 4723 NT systems that had been defaced. During that same time period, only 1723 Linux systems were broken into.
Does this mean NT is any less of an OS than Linux? Certainly not. At a minimum, I think it means two things: intruders prefer NT as their target of choice for whatever reasons; and system administrators don't pay close enough attention to the security of their systems, again, for whatever reasons.
It's no secret that many hackers turn black hat and subsequently seek vengeance against Microsoft by cracking systems that run on its OSs. However, I fail to see how this discredits Microsoft—in most cases. After all, NT is certainly capable of being reasonably secured. Instead, I think these site defacements serve to discredit the site operators by pointing out their inability to keep their networks secure.
Security is an ongoing endeavor. Every good security book I've read preaches this concept over and over, and every good security administrator takes the concept to heart. Security is not simply a set-it-and-forget-it operation. You must be diligent about discovering new risks and understanding the nature of those risks, and you must be proactive about defending against what you've discovered.
I've elaborated and debated various philosophies behind diligent security practices in this column in the past, so I won't take up your time going over those points again. I can summarize by saying that you need to arrive at your own security processes and level of diligence based on your resources and needs. Regardless what your administrative tasks are, security should be the perspective from which you approach all of your work. With security in the forefront of your mind, you're less apt to unnecessarily expose aspects of your network environment. Be sure to review the statistics at Attrition.org, and until next time, have a great week!