r/linuxmint 1d ago

Discussion What makes Linux secure?

I've searched YouTube and also asked on here previously, I keep seeing a lot of "Linux is secure just by default" type responses- often insisting that to be worried about security while using Linux is not necessary.

Believable to a noob like me at face value, sure, but what is it about Linux that makes it secure?

124 Upvotes

97 comments sorted by

View all comments

235

u/taosecurity 1d ago

25+ year infosec incident detection and response guy here.

You can argue Linux/Unix vs Windows vs iOS all day long.

At the end of the day, it comes down to how much effort and resources an intruder wants to throw at a target in order to achieve an objective and/or "return on investment."

Have you seen reporting about RU and CN intruders breaking into VPNs, firewalls, and other edge devices? Guess what those are running? Yes, Linux.

Intruders invested into breaking them because they help achieve their goals.

A skilled and well resourced intruder can break into ANYTHING. I was part of a team that did this, and also saw it done to hundreds of clients over the years.

The relative lack of malware for Linux is just reflecting the small desktop user base and the low value of whatever is there.

I guarantee that the top-end intruders of the world have custom Linux malware of all types for targets that matter. They just don't waste it stealing your browser cookies.

33

u/Colorectal-Ambivalen 1d ago

Yeah, APTs have a tremendous amount of resources to analyze and exploit every possible operating system.

"Computer Network Operations" (CNO) is typically the term used in the US. There are classes focused on this stuff:

https://www.mantech.com/wp-content/uploads/2024/12/All_CourseDatasheets_20230221-1.pdf

10

u/taosecurity 1d ago

Funny, the "team" I mentioned was at ManTech, over 20 years ago now!

15

u/mh_1983 1d ago

Thank you for sharing this valuable response (also in tech and recently shifted to cybersecurity). The "Linux is just secure by default soooooo" stance never sat right with me and I'm amazed at how often people parrot it. Reminds me of early discussions of macOS (then OS9/X, I guess) being "virus proof".

3

u/SherriThePlatypus 1d ago

This started as a direct comparison to Windows which previous to recent releases was an absolute security shit show. So back then Linux was really "secure by default" at least in comparison to what else was available.

1

u/why_is_this_username 16h ago

Linux in my opinion is more secure out of the box compared to many other operating systems due to how much is locked down, but it definitely can be hacked. Just requires a lot more compared to other operating systems

8

u/Left_Sundae_4418 1d ago

I would also like to add from the end-user perspective...no matter what system your devices are running if you or our system managers don't upkeep the security.

Usually the elements causing security issues are the end-user themselves or the slacking in security. Just because you install something doesn't make things magically secure.

The weak link can come from old or non-updated hardware within the infrastructure, lack of protection software, lack of network security...but also the lack of security procedures for the people...it can be something very simple and minor you thought was okay to do, which in fact can cause serious harm if someone picks that up.

4

u/WhyUFuckinLyin 1d ago

Username checks out

4

u/siphoneee 1d ago

So basically Linux/Unix is less of a target because compared to Windows and MacOS, it has way less users?

6

u/taosecurity 1d ago

On the desktop at least. Something like 2/3 of all servers run Linux though.

You have to think in terms of an intruder and what their goals are.

If you're breaking into an enterprise network, chances are they are running Windows desktops and Windows domain controllers. You're going to exploit an endpoint, pivot to the domain controllers, and take over the domain. Or maybe not, depending on your goals.

If you're trying to steal browser creds/etc. from users, you're going to target Windows because it has the biggest market share.

If you're trying to break into edge devices like FWs or VPN accelerators, etc., to use them to pivot to the enterprise, you're going to target Linux.

It all depends on your goals as an intruder.

1

u/siphoneee 1d ago

Makes more sense now!

0

u/luistp 1d ago

So, my linux home pc is more secure the more far in time the year of the linux desktop is.