News

Opinion: Linux, Windows and the Common Criteria Security Evaluation

The documentation of Linux security took a step forward last week. IBM helped push SuSE Linux Enterprise Server 8 through the Common Criteria process to earn Evaluation Assurance Level 2+ certification, also known as EAL2+.

This is a criteria for some government purchasing, especially in the U.S. Department of Defense and other government agencies worldwide with serious and legitimate concerns about software security. For the rest of the IT community, the stringent Common Criteria evaluations serve as bragging rights -- a sort of stamp of approval by some of the most paranoid users on the planet.

In IBM's view, the step to certify a version of Linux "challenges the view of many skeptics that open source systems could not withstand such testing due to the difficulty of establishing process in an open-source environment." Actually, establishing process will be more challenging in EAL3+, which IBM has vowed will be the next step to achieve for SuSE Linux, as well. But IBM knows what it's getting into. The moves with SuSE Linux are only one step in Big Blue's existing effort to offer Common Criteria evaluated operating systems across its eServer line.

Should you find yourself in an argument about the relative security of Windows 2000 versus Linux and have this new Linux security rating thrown at you -- two quick points. First, Windows 2000 achieved in late 2002 the EAL4+ rating, which is more stringent than even the EAL3+ rating that IBM is eyeing next for SuSE Linux. Second, this certification involved SuSE Linux Enterprise Server 8 only -- it says nothing about the security of Red Hat or any other distribution of Linux.

In the end, this is a great move by IBM and SuSE. The more software that get puts through an independent testing process and has accessible documentation for repeating the lockdown, the better for users. So far, the list of operating systems to achieve EAL4+ include Windows 2000 Professional, Server and Advanced Server and IBM AIX 5L. HP-UX 11i and Sun Solaris 8 are rated EAL4, and SGI IRIX/CMW is rated EAL3.

Let's hope we see more announcements like this soon -- from Microsoft for Windows XP, Windows Server 2003 and SQL Server, and from Red Hat and other Linux vendors.

About the Author

Scott Bekker is editor in chief of Redmond Channel Partner magazine.

Featured

  • FTC Expands Microsoft Antitrust Investigation Under Trump Administration

    The Federal Trade Commission (FTC) is pressing ahead with a broad investigation into Microsoft's business practices, an inquiry that began in the final weeks of the Biden administration.

  • An image of planes flying around a globe

    2025 Microsoft Conference Calendar: For Partners, IT Pros and Developers

    Here's your guide to all the IT training sessions, partner meet-ups and annual Microsoft conferences you won't want to miss.

  • Microsoft to Shut Down Skype Services

    Microsoft will discontinue its Skype telecommunications and video calling services on May 5, 2025, marking the end of the platform's decades-long run.

  • Big Blue To Acquire Datastax in Enterprise AI Play

    In a bid to bolster its enterprise-aimed AI capabilities, IBM is planning to acquire Datastax, a leading AI and data solutions provider, for an undisclosed amount.

Most   Popular