Post Hoc Ergo Propter Hoc

Michael Gartenberg | October 09, 2003, 08:08 AM

Post Hoc Ergo Propter Hoc, it’s Latin for after it, therefore because of it. It means that if one thing follows another, one thing also causes another. A few weeks ago the CCIA published a report that says a monoculture computing environment is a bad idea, citing the security issues on the rise as a result of Windows popularity on the desktop. Some analysts agree and suggest diversifying desktop operating systems is a good idea for lowering security costs and issues. The problem is that the causal relationship is almost never true and diversity is not the answer.

Diversity to lower security costs or risk does not make sense. The fallacy is that diverse systems will not have security issues or holes. In point of fact that's not correct (the Computer Emergency Response Team (CERT) released data showing that 16 of the 29 security advisories it released last year involved Linux or open-source products.) Any popular OS will draw the attention of virus writers and hackers, and today’s interconnected systems are the real weak link. If alternative systems grow in popularity, it is likely they will become the target of attack as well. Monoculture has nothing to do with it. When Apple commanded double digit market share in the early 90s, Macintosh users were regularly plagued by virus issues. If businesses were to follow the advice of diversity at the desktop, the likely event is that they would bear the security costs and issues associated with multiple operating systems instead of one. (along with other penalties for diversity.)

Users are better off focusing on proactive measures and taking on the responsibility for their systems, deploying patches in a timely manner and using technology such as personal firewalls rather than seek potential savings through diversity. Diversity does makes sense when there is an ROI associated with functionality. For example, an organization that deploys Mac OS to meet certain business needs and as such the ROI benefit almost certainly cancels out any TCO overhead. (It’s hard to imagine how that could ever apply to today’s Linux desktop offerings.) If there is no functional ROI, diversity just raises operational costs and reduces productivity. The last thing IT shops need to deal with is affirmative action for minority operating systems.