It is important to notice that NCSC does not certify an operating system alone. Rather NCSC certifies a complete software and hardware configuration. Novell Netware meets the standard of C2 Security (Red Book), which means that Netware is secure as a network operating system. On the other hand, Windows NT 3.5 meets the standard of C2 Security (Orange book), which means that a NT system is secure as a standalone computer without any network connection. Windows NT 4.0 has not been certified by NCSC yet.
However, after Netware is turned away from IPX/SPX to pure Internet Protocol (IP), Netware may be more vulnerable to hackers. Some common hacking activities such as flooding and denial-of-services attack are IP-based.
A lot of security breach reports pinpoint Windows NT and Windows 2000. The results of security breach are costly. For example, in 2001 a subsidiary of Amazon.com admitted that crackers stole the company's customer records, including their credit card information. In the same year, a group of Eastern European hackers hacked 40 IIS sites in America and stole more than one million credit card numbers. Near the end of the same year, worms and viruses such as Code Red and Nimda attacked a lot of IIS servers. In response to the crisis, Gartner Group advised administrators to replace IIS with Apache and other Web servers.
It is debatable whether the Windows system is inherently insecure. Al Decker, managing principal of the global security and privacy services group at IBM, argued that NT is no more vulnerable than any other operating system. However, Mark Sims, the CEO of Netrex, a company specializing in computer security, held a different view. Sims argued that NT is harder to configure for security. And Microsoft's Internet Information Server is even worse. Even with all security patches installed, there are still some vulnerabilities that there are no solutions for.
This controversy recurs in Windows 2000 and 2003. After the release of Windows 2003, Michael Otley, a columnist in Windows & .NET Magazine, criticized Windows' security by saying, "In spite of its rhetoric and impressive-sounding initiatives, Microsoft doesn't really seem to get what enterprise security is all about...Microsoft's much-ballyhooed Trustworthy Computing initiative and Palladium both fall into security-by-marketing category. Neither initiative addresses the pressing needs of current customers."
Regarding Web security, the Mac has achieved a high standard. In late 1990s a group in Sweden set out a "Crack-A-Mac" contest in an attempt to test Mac security. Although the Mac Web server was hacked after more than six months, it was due to a hole in an improperly configured third-party software application.
In 2004, mi2g, a group London-based security experts, considered Apple's Mac OS X one of the world's safest operating systems by analysing digital attacks against servers and networks. They found that Linux suffered 13,654 breaches, Windows had 2,005 breaches but Mac OS X had only 555 breaches worldwide in January 2004. Nonetheles, this conclusion is disputed by many other computer experts because there are much fewer Mac OSX servers than Windows and Linux servers in the market.
In 1999, after a US Army website had been hacked, the Army moved its web sites from the Windows NT platform to the Mac platform, running WebStar Web Server. The website administrator explained that the rationale of the migration is based upon the recommendation of the World Wide Web (W3) Consortium. According to W3, the Mac platform is more secure than its counterparts for a number of reasons. For instance, Macintosh does not have a command shell and it does not allow remote logins. W3 also said it found no specific security problems in either the software or the server.
