Slashdot Mirror
Red Hat, Oracle to get Gov't Certification for Linux
Mark writes "As this news.com article states, 'Red Hat and Oracle plan to announce on Thursday that the companies have teamed to get Linux evaluated under the Common Criteria, a certification that could open doors for the broader use of open-source software by government agencies.' It looks like this will be an important step in getting Linux to be more widely adopted in governments around the world."
It's good to know the US Government is catching up technologically with the Germans...again...
In SOVIET RUSSIA... erm...NSA AMERICA, the Internet logs onto YOU!
Having 2 companies presenting a working solution like this. Not only do we know Linux is a good workable system, but this is a way to present it in its best
Having a working solution already in place works for business. You can say "we have system X already go, and can set it up for you". It shows you are on the ball.
Working for a certification like this is similar. Best solutions combine the strengths. What other pre-made solutions do users see as a good thing? perhaps systems such as linux plus apache. That's another well known one
note: slashdot user 'danamania' is a transsexual. guy's watch out if you are talking to him
Thanks for being frank. This should be a wake-up call for all slashdot users.
--sex
Very popular slashdot journal for adul
The companies plan to first push Red Hat Linux Advanced Server for a modest level of certification: Evaluation Assurance Level (EAL) 2.
Sheesh... How much pushing does RHAS need? Show me a TCO study where RHAS at $800/server/year beats any free Linux distro. Simply plugging in a $800/server/year cost into most of the TCO studies I've seen makes Windows look like a bargain.
"We are going to use Unix and Linux as the evaluation platforms for our products in the future, and not Windows, because the customer demand for Windows is not there," she said. "Frankly, there is a fair amount of disenchantment with Microsoft products because of security problems." ... said Mary-Ann Davidson, chief security officer for Oracle.
Wow. I knew Larry hated Bill and MS, but I sure wouldn't have expected this! Or is he just conceding the Windows server database market to Bill and trying to grow the Linux market on the low end + the UNIX market at the higher end?
Hmm...
the no
And the world can see what the DoD are using. I'd love to submit patches to the armed forces.
http://pcblues.com - Digits and Wood
It is good to see that the requests for the certifications arn't coming from a vendor or the developers but the end users who will be deploying the product. You really can't get a better advertisment than that.
Having Oracle on side will help as well, as the article mentions they have tones of experience getting their product (and thus the OS) certified. It is massivly in Oracle's interest to do so - less $'s on the OS means the purchaser can spend more on the hardware / DB.
I think Slashdot just got certified by the Department of Redundancy Department.
Isn't this the same thing we criticised when Microsoft was certified and said that if they made it through, it must be hopelessly inadequate certification process? Now the Linux is involved, it's suddenly a good thing?
A bit of MS bashing is fine, but this is taking it a bit far for me.
Read reviews of shopping cart software
Sometimes it takes something that has a drastic economic impact to for people to seriously look at alternatives. Linux is gather momentum at just the right time, I believe. Everyone has financial problems, and is looking for cheaper alternatives. Linux packages are hitting that point which say "We're professional software." These sort of certifications which add reinforce to that reputation.
Linux has a bright future ahead.
They are working together to convince a potential customer that their collective product is worth buying.
Getting the US Government to start buying Linux based solutions gives them more potential customers. I would guess that is a given that if it is certified for government use at the federal level, that it becomes a legitimate product for the state governments as well.
Besides, how is this different from say, IBM and Sun working together to promote Java?
END COMMUNICATION
The story from the other day was that the DoD had certified Red Hat for their purposes. This is Red Hat and Oracle attempting to gain a more general federal certification which would allow many agencies to consider linux for deployment. Federal law currently requires many agencies to only use "certified" software and operating systems.
If religous zealots don't believe in Evolution, then why are they so worried about bird flu?
This is not a dupe. The story from yesterday is about how the DoD has certified RedHat server as a common operating environment. This story talks about how IBM and Oracle are attempting to get Linux certified on a wider federal level so that agencies can be permitted to use it. They are two different certifications and two different issues and hence two different stories.
I'm always amazed by the number of clarivoyant slashdot users we have around here who don't need to read a story before posting...
If religous zealots don't believe in Evolution, then why are they so worried about bird flu?
drm is an important technology that will save the world from Communism and crackers. The DOD needs security and according to world software maker Microsoft, drm is needed to provide better multimedia and security.
Someone please think about our children.
Yesterday's article was about RH 8 AS getting DISA (Defense Information Systems Agency) DII (Defense Information Infrastructure) COE (Common Operating Environment) certification. Todays' certification article-o-the-day is about RH 8 AS getting Common Criteria EAL (Evaluation Assurance Level) 2.
Yeah, to the uninformed, it looks the same. But (A) DII COE is specifically a US DoD certification, whereas CC EAL is an international certification (administered in the US by NIST--National Institute of Standards and Technology); and (B) The article about RH's EAL certification also extensively yatters on about Oracle 9i, whereas the RH COE article doesn't.
So in conclusion, this is an erroneous dupe sighting. Nothing to see here, move along.
Welcome to the Panopticon. Used to be a prison, now it's your home.
Red Hat and Oracle plan to announce on Thursday that the companies have teamed to get Linux evaluated under the Common Criteria, a certification that could open doors for the broader use of open-source software by government agencies.
The effort is expected to take nine to 10 months and cost up to $1 million. But if successful, it could pay off handsomely for Red Hat and Oracle, as well as for Linux.
"The government has been deploying Linux in smaller settings quite broadly, but it's still done by exception, by and large," said Mark De Visser, vice president of marketing for Red Hat. "What happens with these certifications is that they will push Linux into the mainstream."
The United States government is among 14 nations that recognize the Common Criteria evaluation. A certification from one country is recognized in the others. With countries from Germany to Peru considering using open-source software, having a certified version of Linux will help break down barriers.
The companies plan to first push Red Hat Linux Advanced Server for a modest level of certification: Evaluation Assurance Level (EAL) 2. In total, there are seven levels of certification attesting to varying grades of security, reliability and developmental process control. The highest level that a commercial software laboratory can certify is EAL 4, which Microsoft received for Windows 2000 last fall.
The EAL level needed by a government customer depends largely on the agency and the application in which the software will be used. On Tuesday, the Department of Defense (DOD) gave Red Hat a Common Operating Environment certification, which attests to a certain level of interoperability with other operating systems.
Oracle 9i has already been certified at EAL 4 on both Windows NT and Solaris, but has to be recertified for each operating system on which it runs. And Oracle thinks that there is a large market among government customers for the company's database running on Linux. In fact, some government clients have been clamoring for Linux, said Mary-Ann Davidson, chief security officer for Oracle.
"One of our large DOD customers asked us if we could foster a Linux evaluation," she said. "The customers truly care about getting Linux evaluated and want Oracle running on it."
There hasn't been much interest in running Oracle on Microsoft's Windows platform because of past security problems with Microsoft products, despite the company's major security push, Davidson said.
"We are going to use Unix and Linux as the evaluation platforms for our products in the future, and not Windows, because the customer demand for Windows is not there," she said. "Frankly, there is a fair amount of disenchantment with Microsoft products because of security problems."
After Red Hat earns the EAL 2 certification, Oracle plans to work toward getting its Oracle 9i Release 2 database running on the evaluated Red Hat Linux Advanced Server certified at the highest commercial rating, EAL 4. Oracle currently ships Oracle 9i Release 2 on Red Hat Linux Advanced Server as part of its Unbreakable campaign.
The final goal for both companies is to have both Red Hat's software and Oracle's software certified under the Common Criteria at EAL 4.
Oracle has tackled the process 15 times on a variety of operating systems.
The Common Criteria, an international standard administered by the National Institute of Standards and Technology in the United States, grades products based not only on their security and reliability, but also on the development and support processes that ensure quick responses to problems.
Other nations that have signed the Arrangement on the Mutual Recognition of Common Criteria Certificates in the Field of IT Security are Canada, France, Germany, the United Kingdom, Australia, New Zealand, Italy, Spain, the Netherlands, Norway, Finland, Greece and Israel.
The benefits of Common Criteria certification for Red Hat's Linux products should trickled down to the rest of the Linux community as well, said Dave Dargo, vice president of Oracle's Linux program office.
"The benefits of this evaluation extend beyond Red Hat in the long term," Dargo said, adding that the enterprise-level changes Red Hat and Oracle have made to the Linux kernel have made their way into Linux 2.5, the newest version of the kernel under development.
Moreover, the evaluation process, while expensive, should result in a more secure version of Linux being generally available, added Davidson.
"Fixing a major security hole costs a lot," she said. "And while certification won't prevent those holes, it helps to have a stricter development process. Finding one security hole that you otherwise would have missed, easily pays for evaluation."
$DEITY bless $NATION
If Outlook, SQL Server, IIS or any other Microsoft product which has been riddled with holes have been certified, I'd say this isn't much of an endorsement. If Microsoft hasn't achieved any such ceritification, for products listed above, than you have a point about it opening doors.
For good and for bad (for Microsoft in particular) they are the benchmark for software as a commodity. Expect some writhing in the vicinity of Redmond.
A feeling of having made the same mistake before: Deja Foobar
The article is very short on details, though. Starting small (EAL 2) is probably a good idea - especially since I know of no open source software / Free Software that's gone through a full, normal Common Criteria evaluation (so it would be a first test case). EAL 4 only measures the evaluation effort - it doesn't specify what security functions will be evaluated (nor what threats, assumptions, organizational security policies, configuration, etc. will be used). Hopefully Oracle and Red Hat will include security functions based on a widely-accepted "Protection Profile" (a document that specifies what the users want, including the threats to be countered and the security functions that need to be provided). Currently, the U.S. DoD strongly encourages only purchasing products that have been evaluated to meet not just an EAL level, but meet a "government-approved" PP.
Evaluations are specific to a particular configuration, so this would mean that those who need the evaluated version would need to get the Red Hat distribution named here - not the inexpensive version used by many. That's a side-effect worth noting.
- David A. Wheeler (see my Secure Programming HOWTO)
um, the NSA has already modified linux (the kernel) so that it will meet their standards. redhat is named as a tested distro...see this for details. The biggest problem is that the US government seems to think that they must rely on M$ software (in the unclassified environment at least) for things like exchange and ease of use for the "typical" user.
this is simple posturing at it's finest. of course...the government's high performance systems (read clusters) aren't running windows anyway. this won't change anything.
-frozen
I'm not always the brightest pixel in the stream
in 1918, and they've hardly bothered us since then. - Tom Lehrer
KFG
This is a good thing as the US DoD uses ADA95 for most everything AFAIK and the GNAT compiler works just dandy with Linux. This is what DoD needs, an inexpensive, yet totally robust system which they can put unleash the military programmers on.
A good example is BRL-Cad which is available for free download by US Citizens. This is a nice OpenGL capable solid modeler, somewhat clunky, but probably better than any other free CAD program available for Linux right now.
I'm a veteran of the US Military, and I think that Linux is a great choice for them, since they have the capability to provide cheap, effective, and efficient training about their computer systems to all the members of the armed forces. The US Military could easily train several million service personnel to be effective Linux programmers in a quite short period of time.
And of course, as a taxpaying citizen, I want my armed forces buying the best weaponry, not lining some 2-bit computer software vendor's pockets, especially when those vendors undermine the rights of the citizens by channeling that money back into lobbying for laws like the DMCA.
This is where RedHat shines. I use Debian myself, but Debian is too chaotic to apply for these certifications; however, RedHat could make a killing by supplying the US Government their software, and since Linux is Linux is Linux, this gives my government the state of the art software: it is secure, it is robust, it is inexpensive, and it is the best development environment in the world!
Clickety Click
Many questions, no answers.
Less is more !