A ZDNet Multiplexer Blog What's this?

Security considerations for Enterprise Linux

To maintain an application infrastructure that meets continually expanding business demands, organizations need more than a maintenance and support contract. Organizations need a proven, scalable, reliable, and secure enterprise platform.

Given the importance of IT for day-to-day operations, organizations cannot afford to use lacklustre security, especially given that the total number of detected security incidents across the globe increased 48 percent from 2013, according to the 2015 Global State of Information Security Survey. With this critical need in mind, modern IT systems must rely on capable security infrastructure and processes, especially in enterprise environments.

This need for end-to-end security is why enterprise-grade product like Red Hat Enterprise Linux is used by organizations throughout the Asia Pacific and across the globe, with adoption on the rise, according to this Linux Foundation Enterprise End User report.

Here, we'll take a look at enterprise Linux security and how Red Hat approaches vulnerabilities, as well as the community approach to open source development.

Red Hat and vulnerabilities

While one myth about open source is that is is less secure than closed platforms, this is couldn't be more untrue. Thanks to its open nature and the fact that the code is constantly poked and prodded by community developers, security flaws are identified and corrected early on - something that cannot be said for a closed platform.

The Red Hat Security Team focuses on vulnerabilities across the entire suite of Red Hat products, including Red Hat Enterprise Linux, and tracks potential vulnerabilities and exploits in an open manner througha measurement page, which hosts tools and data to help ongoing security measurement. Coupling this team's watchful eyes with comprehensive tracking (to follow possible security issues back to the source), security problems are often patched or resolved well before they can develop into larger problems.

"We don't just sit back and wait for others to find flaws for us to fix, we actively look for issues ourselves and these are found by engineering, quality assurance, as well as our security teams," said Mark Cox, senior director, product security at Red Hat.

The role of quality assurance

Quality engineering (QE) processes are a key aspect of why customers choose Red Hat enterprise subscriptions over 'free' open source, as the dedicated QE teams provide another layer of security against potential threats. These teams test, on a daily basis, the Red Hat Enterprise Linux kernel, KVM as part of Red Hat Enterprise Virtualization and OpenShift, following stringent QE processes to ensure a better product is provided and that any potential breaches or exploits are discovered, logged and rectified before they impact customers. Beyond security, QE teams also test against new builds, file bugs, and work on feature enhancement.

How communities contribute

Open source is little without the backing of a dedicated and enthusiastic community, and this is especially true when it comes to solving security issues.

Open source is little without the backing of a dedicated and enthusiastic community, and this is especially true when it comes to solving security issues. By having individuals constantly contributing to the development of open source platforms, solutions to problems are located in a more timely manner, and useful features can be implemented and tested quickly.

A traditional proprietary product may only ever be tested by staff or teams within the organization, whereas an open source alternative is redistributed to a wider audience. This commonly means greater numbers of qualified professionals willing to further enhance a particular product. In turn, this makes open source platforms suitable for enterprises, given the constant need for the highest levels of security.

Secure alternatives

As attackers become more adept at infiltrating IT systems, companies are seeking more secure alternatives to traditional, proprietary systems and technology, particularly at the operating system level. Red Hat Enterprise Linux is one of the most capable options for organizations, and deserves consideration given the improvements of not only open source technology over closed source infrastructure but also Red Hat's stringent and ever-present security and quality assurance efforts. Certainly, organizations cannot overstate the value of a platform that is constantly pushing ahead with operational and security improvements.

As IT security concerns only continue to grow for companies across the globe, Red Hat Enterprise Linux has emerged as a leading platform for customers wanting to bring military-grade security to their datacenters.

Download this whitepaper where research firm IDC looks at the transition of today's datacenters and how Linux systems factor into modernization efforts.