Linux vs. Windows: Analysts question assumptions about security, TCO

According to leading analysts, Linux is a legitimate player for corporate servers, but it has yet to make any perceptible impact in the desktop market. In the past, the main reasons for migrating from Windows to Linux servers were to lower the total cost of ownership (TCO) and to improve security. However, recent analyst commentary is questioning this reasoning.

Market statistics

Sageza Group recently reported that market share and revenue for Linux installations continues to rise. Sageza reports that Linux has shown "revenue growth and unit growth both above 50%, with revenue topping $1 billion for the fifth consecutive quarter -- at nearly $1.6 billion for the last quarter alone." However, Sageza goes on to point out that "while Linux revenue is growing much faster than that of Windows-based servers, the Microsoft product still holds a commanding 4-to-1 revenue edge in 2004 figures."

Yankee Group reports that "Linux now accounts for 20% of the worldwide installed base of server operating systems, and its share of the North American market is approximately 15%."

However, Info-Tech Research Group reports that "Most mid-sized enterprises are simply not interested in Linux. A tiny 10% of mid-sized enterprises plan to evaluate Linux within the next three years and only a portion of these will actually adopt it." Frank Koelsch, executive vice president of Info-Tech states, "Just 27% of mid-sized companies currently have Linux installed and almost half of the respondents said they have no interest in Linux. The Linux advance into this market has stalled. Microsoft still dominates this market and is the clear leader for mid-sized companies. Linux was initially hot, but interest has substantially declined. Companies are past the hype and taking a much more cautious approach towards Linux." Info-Tech claims that the reason for this decline is that "smaller organizations already have a trained Windows-based support staff, and adding Linux to the mix can add headcount, complexity and create havoc."

What about TCO?

Yankee Group recently released the results of a survey that compared the TCO of Linux and Windows. Its findings should surprise those Microsoft-haters who believe that Windows is a lost cause and that Linux is the future. According to the study, "An overwhelming 88% of corporations report that Microsoft's Windows Server 2003 operating system provides performance and reliability that are equal to or better than Linux in comparable usage scenarios." This represents a 12% increase over Yankee's 2004 survey results.

The study says, "There is no universal clear-cut TCO basis to compel the corporate masses to do a wholesale switch from Windows to Linux as there is for a migration from Unix to Linux. And there is no indication that users are replacing Windows with Linux. The majority of wholesale Linux defections continue to come at the expense of mid-range Unix installations, although many organizations are installing Linux as a complementary OS to existing Windows servers. The survey found that from 2004 to 2005, Linux maintained -- but did not expand -- its healthy 15% market share compared to the 73% market share for various versions of Windows servers."

This is not to say that Windows servers are the solution for all server needs in a company. Yankee Group believes that Windows and Linux each have their own specific "strengths, weaknesses, opportunities and threats that can affect a corporation's TCO and ROI, positively or negatively." Yankee cautions that "to achieve optimum results and avoid undue deployment problems and expenses, corporations must perform a thorough cost, performance and risk analysis to determine the right technology option. Any business that does not know or cannot determine the key costs associated with its software infrastructure risks making the wrong technology decision. Such a mistake may adversely affect the TCO of its respective environment for years."

IDC also voices concerns about the perceived value of Linux and other open source software (OSS) as alternatives to Windows: "As perceptions of software price-value imbalance, vendor lock-in and security risks build around proprietary software, end-user organizations are pressed to seek alternatives. The reality, though, is that both Linux and OSS can cost more, can create a situation of lock-in and may not be more secure."

What about security?

Microsoft's focus on correcting security concerns seems to be yielding results. The Yankee Group survey found that:

• "Users rated the security of Linux and Windows servers nearly equal."
• "Windows servers recover 30% faster from security attacks than Linux servers."
• "Patch management woes lessen for Windows, but are on the rise for Linux."
• "Microsoft clearly and convincingly corrected its most severe technical customer concerns. It must now maintain that vigilance."

Several firms also have pointed out that as Linux servers become more numerous, hackers have begun developing viruses and other threats to Linux. Although the number of Linux hacks is still small, the numbers are rising (Sources: Yankee Group, The Sageza Group).

Conclusions

Both Linux and Windows are here to stay. The decision to deploy a Linux or a Windows server should be based on a careful evaluation of both technical and business needs. For smaller companies with in-house Windows skills, moving to Linux or implementing Linux alongside Windows could cause more headaches and staff issues than value. For larger companies with sufficient staff and training budgets, implementing Linux-based servers may prove cost-effective in the long-term.

An important consideration for any Linux implementation is the availability of support, documentation, and third-party conversion and interoperability tools. Without these, firms face increased costs and exposure to increased downtime as staff struggle to find fixes and solutions. It is also important to remember that creating a more secure Linux environment will probably involve the purchase of third-party security products to augment Linux's security features. And if Linux is being installed with existing Windows servers, third-party integration tools also may be required.

• Learn more about securing Linux and Unix in our resource center.
• Read news, tips and expert advice on hardening Windows-based servers.