Platform does matter. There are softwares where 0-days are more frequent. Stuxnet targeted windows platforms and used 4 different 0-days. It took two years for

Platform does matter. There are softwares where 0-days are more frequent. Stuxnet targeted windows platforms and used 4 different 0-days. It took two years for it to reach its target. Therefore, if the platform that ran the target was fixing its security flaws in, say, 6 months, stuxnet would have failed. Even on targeted attacks, you need the target to have a flaw to infect it, and this is not ideology to say that some software companies are longer to correct flaws than others. A machine where Acrobat Reader, Internet Explorer 6/7 or Adobe Flash Player are installed is more likely to be infected. These packages should be banned. In fact, on a part of a military infrastucture, I would expect to find only software that have been flagged as decently secured. Forbidding Windows may be a bit extreme, but I would expect the army to have strict security policies, especially regarding installable software. Any executable file not certified by the US army should not be executed on a sensitive computer. It should be enforced by a piece of software or hardware. The idea that any operator can bring a usb drive and execute a file on it seems like an incredible laxism.