Larry Dignan from ZDNet compared the vulnerabilities of Mac OS X with Windows XP and Windows Vista in 2007. The results are devastating for Apple. According to Dignan, Mac OS X had five times more vulnerabilities than Windows (XP+Vista). It is even more surprising that OS X had 234 highly critical vulnerabilities whereas Windows had only 23. So, does this mean that Windows is five times as secure as Mac OS X? I’d say no.

Here are the numbers:

Windows XP, Vista, and Mac OS X vulnerability stats for 2007
  XP Vista XP + Vista Mac OS X
Total extremely critical 3 1 4 0
Total highly critical 19 12 23 234
Total moderately critical 2 1 3 2
Total less critical 3 1 4 7
Total flaws 34 20 44 243
Average flaws per month 2.83 1.67 3.67 20.25

I am not referring to the fact that Windows had 4 extremely critical flaws and Mac OS X had none in this category. In my opinion such statistics do not say much about security. There were similar statistics about Internet Explorer 6 some time ago. Every week or so, a new serious vulnerability was found. People usually inferred that using IE6 is highly insecure. However, the number of vulnerabilities and their severity are only a couple of the many factors when it comes to security.

If you want to know something about security, you have to calculate the probability of a security breach. Of course, this probability gets higher if there are more vulnerabilities. However, far more important is how many bad guys are out there who are capable and willing to writing an exploit. Another important factor is how many hackers and script kiddies can get their hands on the exploit. And the most important factor is the number of machines where this exploit will actually work. Think of a worm that spreads from one computer to another. The more food this worm finds, the bigger it will get and so will its threat.

Thus there is no doubt that Windows is still less secure than Mac OS X. However, there is one thing that this statistics really shows. Microsoft is doing a much better job than Apple regarding security recently. And if you want to know which company is more evil, then you might want to look at this post.

Leave a Comment | Subscribe RSS | Newsletter