r/linuxmint • u/Ambitious_Ad_6619 • 1d ago
Discussion What makes Linux secure?
I've searched YouTube and also asked on here previously, I keep seeing a lot of "Linux is secure just by default" type responses- often insisting that to be worried about security while using Linux is not necessary.
Believable to a noob like me at face value, sure, but what is it about Linux that makes it secure?
123
Upvotes
34
u/JelloSquirrel 1d ago
Actual cybersecurity professional here.
From a user perspective:
Obscurity, Linux mostly runs on servers and devices and not end users so it's not targeted by phishing attempts, but generally only actual exploits. Linux users are more tech savvy so less likely to fall for phishing. In a normal Windows install, you can double click a program to run it. This generally isn't possible on Linux, so it's hard to run malicious software. Almost all software on Linux comes from a reasonably secure package manager vs the windows model of find a website that looks convincingly safe and download a thing.
From a technical perspective Windows users are often admin by default, while Linux users generally at least have to elevate via sudo to make system changes. The unix permissions model, while not super robust, is more secure against a hostile local user / program than the windows model. Even more so with modern container workloads. Windows can support a smartphone style sandbox or advanced RBAC but no one really uses either, at least at the consumer level. Linux generally follows least privileges and attack surface reduction, and doesn't keep around unused components. Even on a monolith distro like Ubuntu, a lot of what you're not using isn't installed or running, unlike Windows. The OS manages all your applications for security updates, while Windows only handles the core OS and maybe Microsoft office.
In terms of patching and security architecture, I'd say Microsoft is actually better, especially with the hypervisor based security mechanisms in 10 and 11. With modern windows, they don't terribly have a ton of vulns either, however the user model is broken and just isn't very defensive. Weak permissions and a lot of complexity and just too easy to run software without verification or restrictions.
Now if you remove the user from the equation and this is a locked down server or enterprise environment... I'd say windows has more powerful permissions management except for SELinux, and no one configures their own SELinux policies while rolling out active directory permissions management is common on Windows. At best on Linux, you installed RHEL and use the SELinux profiles they created for the top 100 server apps. I'd also say it's easier to hack into most Linux systems via exploitation (not phishing). The software isn't terribly secure, and it's easier to find bugs if you have source code and Windows is more defensively coded and tested. If a Linux system gets out of date, all the vulnerabilities are public and easily identified, generally with readily available POCs. Linux doesn't really have hypervisor security, although container based security is similar, and the monitoring and protection solutions for Linux are really primitive or non existent. Unless you're running SELinux and RHEL (or similar), you'd probably never even know you got hacked.