News

Opinion: Linux, Windows and the Common Criteria Security Evaluation

The documentation of Linux security took a step forward last week. IBM helped push SuSE Linux Enterprise Server 8 through the Common Criteria process to earn Evaluation Assurance Level 2+ certification, also known as EAL2+.

This is a criteria for some government purchasing, especially in the U.S. Department of Defense and other government agencies worldwide with serious and legitimate concerns about software security. For the rest of the IT community, the stringent Common Criteria evaluations serve as bragging rights -- a sort of stamp of approval by some of the most paranoid users on the planet.

In IBM's view, the step to certify a version of Linux "challenges the view of many skeptics that open source systems could not withstand such testing due to the difficulty of establishing process in an open-source environment." Actually, establishing process will be more challenging in EAL3+, which IBM has vowed will be the next step to achieve for SuSE Linux, as well. But IBM knows what it's getting into. The moves with SuSE Linux are only one step in Big Blue's existing effort to offer Common Criteria evaluated operating systems across its eServer line.

Should you find yourself in an argument about the relative security of Windows 2000 versus Linux and have this new Linux security rating thrown at you -- two quick points. First, Windows 2000 achieved in late 2002 the EAL4+ rating, which is more stringent than even the EAL3+ rating that IBM is eyeing next for SuSE Linux. Second, this certification involved SuSE Linux Enterprise Server 8 only -- it says nothing about the security of Red Hat or any other distribution of Linux.

In the end, this is a great move by IBM and SuSE. The more software that get puts through an independent testing process and has accessible documentation for repeating the lockdown, the better for users. So far, the list of operating systems to achieve EAL4+ include Windows 2000 Professional, Server and Advanced Server and IBM AIX 5L. HP-UX 11i and Sun Solaris 8 are rated EAL4, and SGI IRIX/CMW is rated EAL3.

Let's hope we see more announcements like this soon -- from Microsoft for Windows XP, Windows Server 2003 and SQL Server, and from Red Hat and other Linux vendors.

About the Author

Scott Bekker is editor in chief of Redmond Channel Partner magazine.

Featured

  • Broadcom Revamps VMware Partner Program Again

    Broadcom recently announced a significant update regarding its VMware Cloud Service Provider (VCSP) program, coinciding with the release of VMware Cloud Foundation (VCF) 9.0, a key component in Broadcom’s private cloud strategy.

  • Closeup of the new Copilot keyboard key

    Microsoft Updates Copilot To Add Context-Sensitive Agents to Teams, SharePoint

    Microsoft has rolled out a new public preview for collaborative "always on" agents in Microsoft 365 Copilot, bringing enhanced, context-aware tools into Teams channels, meetings, SharePoint sites, Planner workstreams and Viva Engage communities.

  • Windows 365 Cloud Apps Now Available for Public Preview

    Microsoft announced this week that Windows 365 Cloud Apps are now available for public preview. This aims to allow IT administrators to stream individual Windows applications from the cloud, removing the need to assign Cloud PCs to every user.

  • Report: Security Initiatives Can't Keep Pace with Cloud, AI Boom

    The increasingly fast adoption of hybrid, multicloud, and AI systems is easily outgrowing existing security measures, according to a recent global survey by the Cloud Security Alliance (CSA) and exposure management firm Tenable.