Opinion: Linux, Windows and the Common Criteria Security Evaluation -- Redmondmag.com

Opinion: Linux, Windows and the Common Criteria Security Evaluation

By Scott Bekker
08/11/2003

The documentation of Linux security took a step forward last week. IBM helped push SuSE Linux Enterprise Server 8 through the Common Criteria process to earn Evaluation Assurance Level 2+ certification, also known as EAL2+.

This is a criteria for some government purchasing, especially in the U.S. Department of Defense and other government agencies worldwide with serious and legitimate concerns about software security. For the rest of the IT community, the stringent Common Criteria evaluations serve as bragging rights -- a sort of stamp of approval by some of the most paranoid users on the planet.

In IBM's view, the step to certify a version of Linux "challenges the view of many skeptics that open source systems could not withstand such testing due to the difficulty of establishing process in an open-source environment." Actually, establishing process will be more challenging in EAL3+, which IBM has vowed will be the next step to achieve for SuSE Linux, as well. But IBM knows what it's getting into. The moves with SuSE Linux are only one step in Big Blue's existing effort to offer Common Criteria evaluated operating systems across its eServer line.

Should you find yourself in an argument about the relative security of Windows 2000 versus Linux and have this new Linux security rating thrown at you -- two quick points. First, Windows 2000 achieved in late 2002 the EAL4+ rating, which is more stringent than even the EAL3+ rating that IBM is eyeing next for SuSE Linux. Second, this certification involved SuSE Linux Enterprise Server 8 only -- it says nothing about the security of Red Hat or any other distribution of Linux.

In the end, this is a great move by IBM and SuSE. The more software that get puts through an independent testing process and has accessible documentation for repeating the lockdown, the better for users. So far, the list of operating systems to achieve EAL4+ include Windows 2000 Professional, Server and Advanced Server and IBM AIX 5L. HP-UX 11i and Sun Solaris 8 are rated EAL4, and SGI IRIX/CMW is rated EAL3.

Let's hope we see more announcements like this soon -- from Microsoft for Windows XP, Windows Server 2003 and SQL Server, and from Red Hat and other Linux vendors.

About the Author

Scott Bekker is editor in chief of Redmond Channel Partner magazine.

Featured

Microsoft and OpenAI Continue Global AI Expansions

Microsoft and OpenAI each continued their global expansion this month, with the announcements of new infrastructure investments and service rollouts in new regions, like Asia and the Middle East.
Cisco Warns of Brute Force Attacks Targeting VPNs and Firewalls

Cisco has revealed that a global increase in brute force attacks targeting Virtual Private Networks (VPNs) and other devices is currently taking place.
What's Inside Microsoft 365's Security Toolbox?

Microsoft provides plenty of native tools to secure Microsoft 365. IT pros just have to know where to look.
Microsoft Kills 30-Day Data Retention Policy for Copilot in Fabric

Microsoft this week announced several usability improvements coming to Copilot in Fabric in preparation of its general availability release later this year.
Using Microsoft Office to Build a Network Diagram 2

Now that we've set up our process, let's dig in with the actual execution.