Opinion: Linux, Windows and the Common Criteria Security Evaluation

The documentation of Linux security took a step forward last week. IBM helped push SuSE Linux Enterprise Server 8 through the Common Criteria process to earn Evaluation Assurance Level 2+ certification, also known as EAL2+.

This is a criteria for some government purchasing, especially in the U.S. Department of Defense and other government agencies worldwide with serious and legitimate concerns about software security. For the rest of the IT community, the stringent Common Criteria evaluations serve as bragging rights -- a sort of stamp of approval by some of the most paranoid users on the planet.

In IBM's view, the step to certify a version of Linux "challenges the view of many skeptics that open source systems could not withstand such testing due to the difficulty of establishing process in an open-source environment." Actually, establishing process will be more challenging in EAL3+, which IBM has vowed will be the next step to achieve for SuSE Linux, as well. But IBM knows what it's getting into. The moves with SuSE Linux are only one step in Big Blue's existing effort to offer Common Criteria evaluated operating systems across its eServer line.

Should you find yourself in an argument about the relative security of Windows 2000 versus Linux and have this new Linux security rating thrown at you -- two quick points. First, Windows 2000 achieved in late 2002 the EAL4+ rating, which is more stringent than even the EAL3+ rating that IBM is eyeing next for SuSE Linux. Second, this certification involved SuSE Linux Enterprise Server 8 only -- it says nothing about the security of Red Hat or any other distribution of Linux.

In the end, this is a great move by IBM and SuSE. The more software that get puts through an independent testing process and has accessible documentation for repeating the lockdown, the better for users. So far, the list of operating systems to achieve EAL4+ include Windows 2000 Professional, Server and Advanced Server and IBM AIX 5L. HP-UX 11i and Sun Solaris 8 are rated EAL4, and SGI IRIX/CMW is rated EAL3.

Let's hope we see more announcements like this soon -- from Microsoft for Windows XP, Windows Server 2003 and SQL Server, and from Red Hat and other Linux vendors.

About the Author

Scott Bekker is editor in chief of Redmond Channel Partner magazine.


  • Microsoft Starting To Roll Out New Excel Connected Data Types

    Microsoft on Thursday announced some Excel and Power BI enhancements that add "connected data types" on top of the standard strings and numbers options.

  • Windows 10 Users Getting New Process for Finding Optional Driver Updates

    Accessing Windows 10 drivers classified as "optional updates" will be more of a manual seek-and-install type of experience, starting on Nov. 5, 2020, Microsoft explained in a Wednesday announcement.

  • Microsoft Changes Privacy Platform Name to SmartNoise

    Microsoft Research has changed the name of its "differential privacy" platform from "WhiteNoise" to "SmartNoise," according to a Wednesday announcement.

  • Why Restarting a Failed SCVMM Job Might Be a Bad Idea

    Occasionally, restarting a failed System Center Virtual Machine Manager job can leave your virtualization infrastructure in an unknown state. Here's how to avoid that.

comments powered by Disqus