Gartner Group: DO NOT USE IIS! (from Midrange-L)

[Jim Damato <jdamato@xxxxxxxxxxxxxxxxx>]

Gartner says-

"...enterprises hit by both Code Red and Nimda immediately investigate
alternatives to IIS, including moving Web applications to Web server
software from other vendors, such as iPlanet and Apache. Although these Web
servers have required some security patches, they have much better security
records than IIS and are not under active attack by the vast number of virus
and worm writers. "

They're saying both that other web servers are more secure and that IIS is
under greater scrutiny from virus creators.  What do you think?  It seems
like you can read this two ways:  IIS is a more risky web server
implementation because virus creators target it, or virus creators attack
IIS because it's an easy target -- making it a more risky web server
implementation.

There's such a huge install base for Apache.  I would have expected Apache
to have been a victim of viruses/worms on the same scale as NIMDA by now.
Do you think that Apache is significantly more secure than IIS by design?
Why else would IIS be a target for virus or work attacks?

-Jim

James P. Damato
Manager - Technical Administration
Dollar General Corporation
<mailto:jdamato@dollargeneral.com>