Red Hat Pushes For CC Certification By Year's End

Ridgelift writes "This article indicates Red Hat Linux is about to receive certification under the Common Criteria (CC) Scheme worldwide. This has been a long road for Red Hat, and 'once successfully certified in the UK, Red Hat products will be recognised as certified and approved by information security agencies from all 19 countries participating in the Common Criteria program.' This means Red Hat will sit alongside Sun Solaris, HP-UX and IBM's AIX."

Comments

Windows 2000 is certified as well

[Punchinello]

This means Red Hat will sit alongside Sun Solaris, HP-UX and IBM's AIX

Red Hat will also sit along side Windows 2000 which also has the Common Criteria certification. See the press release:

http://www.microsoft.com/presspass/press/2002/oct0 2/10-29CommonCriteriaPR.asp

Re:Windows 2000 is certified as well

[EmbeddedJanitor]

Damn, just when I thought the certification had some value!

Re:Windows 2000 is certified as well

[tarquin_fim_bim]

You have to be a little sceptical as to its value in that case. Does anyone have any links as what the Criteria actually are?

Re:Windows 2000 is certified as well

[calebtucker]

Yeah, I kinda scratched my head when I saw a microsoft O/S at EAL4+. I think the CC is more about validating the core of the operating system. As you add more software to a system, it's going to become more vulnerable (*cough* IE, outlook, IIS *cough*).

Re:Windows 2000 is certified as well

[Jeremiah Cornelius]

CC is restricted to VERY specific implementations.

No deviation is allowed from the exact hardware, software and network configuration that is the certification target. Yes, this includes additional security patches. That would constitute a new platform for certification - at an additional expense of may hundreds of thousands USD.

I suppose that it makes a decent benchmark of sorts. Still, its mainly a diligence measure for getting into Govt purchasing schedules, and has little to do with a practical or useful evaluation of the actual security of an OS.

Re:Windows 2000 is certified as well

[Anonymous Coward]

Yah, but it wasnt a full Win 2000 that was certified, it was a stripped down version which was tailored specifically to pass at the level it did. Besides which, passing at the level it did isnt very hard at all.

Re:Windows 2000 is certified as well

[houseofmore]

Ya, 'cept they wont go near XP with a dirty stick.

Re:Windows 2000 is certified as well

[r00zky]

w2000...
Why waste money in a certificate of security that is sooo useless?
Money better spent elsewere for sure.

Re:Windows 2000 is certified as well

[tonyr60]

Common Criteria is about validating that the OS/Firewall/etc. etc. does what the VENDOR says it will do. Just because a bunch of products have Common Criteria Certifications does not mean that they are equally secure. HP-UX, Solaris, Win2K and soon Redhat will have achieved Common Criteria certification but it does NOT mean that they are equally secure.

Re:Windows 2000 is certified as well

[Jeremiah Cornelius]

Yeah. Most CC implementations are on private segments - no WAN or Internet links.

Easy enough to fly your OS in those restrictions...

Remember the Orange Book C2 security for Windows NT? That was only for a standalone box - no net, no modem.

The Rainbow Books were a forerunner to the CC - which represented a harmonizing of the Red/Orange Books with Canadian Govt InfoSec standards.

Re:Windows 2000 is certified as well

[calebtucker]

Basically, the CC is a standard for evaluating a product's security. I think the US government requires a certain level of certification for any computer that handle sensitive data (EAL2 maybe? can't remember).

Soooo, I see the CC simply as a way to get government contracts for your product/software if you have enough money to front on the certification ($200k to $millions). So basically, a product evaluated at some EAL doesn't mean a whole lot IMHO.

Re:Windows 2000 is certified as well

[duffbeer703]

Exactly. Try putting an unpatched Solaris or HP-UX box on the public internet!

Re:Windows 2000 is certified as well

[john82]

"Still, its mainly a diligence measure for getting into Govt purchasing schedules, and has little to do with a practical or useful evaluation of the actual security of an OS."

Sure, doesn't have a thing to do with the actual security of an OS. Next time, why not take the time to read about the spec for Common Criteria certification before making such an idiotic suggestion.

Re:Windows 2000 is certified as well

[Storm]

Its pretty well common knowledge in the security community that Microsoft paid for that certification.

While I can't remember if it was specifically Windows 2000 with the Common Criteria or Windows NT with the Orange Book Cert, I do remember that the system configuration which won them the cert was with no network connection, no floppy drives, and no CDROM drives on the box that was tested. In essence, no non-keyboard input methods. (They couldn't guarantee the OS would stay clean long enough to get the cert.)

Basically, the certification was useless as soon as you configured the box to do any useful processing on the machine. Then again, many would say that is the same of Windows itself.

Re:Windows 2000 is certified as well

[Jeremiah Cornelius]

Johnboy,

I'm pretty familiar with the NIST publications on the subject. I use the NIST standrds as testing guidelines on a near daily basis. I readily attest to the value of these.

CC testing of implementations are not portable to diferent environments, and unless you duplicate the testing platform and environment as spec'ed, you are not running a certified platform.

No one is likely to ever run the spec'ed platform/environment.

It is a benchmark - like any other. Good for selling to the Government markets that have established CC.

Re:Windows 2000 is certified as well

[Jeremiah Cornelius]

You are talking about Orange Book C2. This is the standard config for this certification.

It is a step above C1 - no attempt made to secure the platform!

C2 does have fairly strigent requirements regarding the separation of roles and audit history by role/principal.

All of which are guaranteed in a standalone config.

Re:Windows 2000 is certified as well

[Iorek]

The Common Criteria are composed of two types of requirements: security functional and security assurance. The requirements are different for each evaluation, so you need to read what's called a security target to find out which ones are relevant to the specific evaluation.

For example, Windows 2000 was evaluated against all the security assurance requirements in the EAL4 package (plus a few). There were also a ton of security functional requirements based on what Windows 2000 provides (e.g., identification, authentication, audit, etc.). For details, read the Target of Evaluation Description section of the ST at http://niap.nist.gov/cc-scheme/CCEVS_VID402-ST.pdf

Red Hat's Enterprise Linux will have their own ST.

Re:Windows 2000 is certified as well

[D iz a n k Meister]

I thought that EAL4 wasn't very secure at all anyway.

Re:Windows 2000 is certified as well

[c1ay]

How does a system where new security holes are discovered daily get this certification? Can it be revoked? Me thinks Windows Security is the world's second most rated oxymoron behind Microsoft Works!!!

Re:Windows 2000 is certified as well

[Iorek]

The CC functional requirements are very specific. If two products claim to satisfy an identification requirement (for example) and both pass evaluation, then you have some assurance that they've both correctly implemented it. That assurance is based on the evaluation assurance level. That doesn't mean they're equal, but it sets the lower bound.

Incidentally, any security product can be evaluated under the CC; there are many functional requirements that wouldn't immediately come to mind (e.g., anonymity requirements in the privacy family FPR). Not only that, the CC allows for extensions, so if you can think up the requirements, products can be evaluated against them (although the ST evaluation may fail if your requirements are poorly written).

Re:Windows 2000 is certified as well

[b17bmbr]

then how bad does something have t be to not make it?

i hear WindowsME just missed CC by a whisker.

Re:Windows 2000 is certified as well

[EmbeddedJanitor]

So it's a bit like ISO9000.... you can put ISO9000 labels on concrete lifejackets - so long as you build them according to your inhouse procedures.

Re:Windows 2000 is certified as well

[Mr. Slippery]

It is a step above C1 - no attempt made to secure the platform!

That's D. (Actually, D is reserved for systems that fail evaluation.)

C1 (about equivalent to CC's EAL 2) does describe some very minimal security requirements, but the system doesn't need to distinguish individual users. C2 (~= EAL 3) adds a little more, including the requirement to identify individual users. The C levels require Discressionary Access Controls (basically, ACLs).

The B levels (B1, B2, and B3, roughly corresponding to EALs 4, 5, 6) add Mandatory Access Control - basically, the ability to label something at a sensitivity level and to have users have clearances to only read things at at or below a certain level, and write things at or ablove a certain level (can't have a Top Secret user writing unclassified files). A level (EAL 7) requires a formal mathematical validation of the system.

Re:Windows 2000 is certified as well

[fireman sam]

The only secure Windows box is the one that I planted my flowers in. No, wait, that fell off and fell two stories onto the footpath (sidewalk for the en_US folks)

Re:Windows 2000 is certified as well

[EmbeddedJanitor]

It didn't need to. From what some people say it would seem that it only needs to achieve the vendor specified level. Scenario:

Microsoft: This is WinME, we claim it is shit.

CC Official:sniff, sniff. Yep, sure is. Stamp!

Re:Windows 2000 is certified as well

[Iorek]

There's a difference, though. The security target evaluation (at the beginning of the evaluation - it really scopes the evaluation) is a sanity check. The evaluator would certainly fail the ASE components of a concrete lifejacket evaluation. The evaluator is making sure the functional requirements are mutually supportive, that the security problem they're solving is well defined, that the requirements themselves can solve that problem... It's far more than a "This is what I do... See, I'm doing what I say I do."

Re:Windows 2000 is certified as well

[Guppy06]

"Common Criteria is about validating that the OS/Firewall/etc. etc. does what the VENDOR says it will do."

Microsoft: "This operating system has numerous vulnerability exploits and poor compatability with old drivers and applications."

CC board: "Well, whaddaya know, so it does!"

Re:Windows 2000 is certified as well

[c1ay]

No deviation is allowed from the exact hardware, software and network configuration that is the certification target.

So as fast as today's hardware evolves and changes these certs must expire pretty quick?

Re:Windows 2000 is certified as well

[Jeremiah Cornelius]

Ask anbody who paid through the nose to get DITSCAP certification!

Re:Windows 2000 is certified as well

[JK Master-Slave]

Oh yeah.

Because having been on Slashdot since it was a chummy little group means something in the larger scope of things.

Re:Windows 2000 is certified as well

[Anonymous Coward]

...said Mr. UID 727990...

Re:Windows 2000 is certified as well

[maelstrom]

You ruined my dream :(

Re:Windows 2000 is certified as well

[kir]

Hey... I've got a three digit UID, and while I've been around a while (4 or 5 years I think), I'm not sure it really has anything to do with how long one has been a /. weenie. Maybe it does? But I've not seen anything that says so.

Re:Windows 2000 is certified as well

[Anonymous Coward]

...said an AC...

Re:Windows 2000 is certified as well

[JK Master-Slave]

Hay, I've been on this site since early '99. It's just that handles need to be replaced from time to time. Every account that I've ditched has had the +1 bonus before I ditched it, btw. You get to feeling after awhile like a 'personality' or whatever, so you ditch and replace.

This particular account is less than three days old, I'll grant you. It'll have +1 privledges within a month.

Re:Windows 2000 is certified as well

[mentin]

Remember, this is slashdot. So EAL 4 could be not secure at all when Microsoft certifies Windows for it. But EAL 2 (lower level) could be very secure once Red Had is in the game.

In reality, EALs does not certifies the security, it certifies functionality of security-related applications. So EAL certification does not say "this product does not have security vulnerabilities" (no certification can), it sais "this product implements such methods of access control, such authentication procedures, etc".

Re:Windows 2000 is certified as well

[mentin]

From what some people say it would seem that it only needs to achieve the vendor specified level.

Crap. OS or application has to achieve standard-specified level of security functionality.

Re:Windows 2000 is certified as well

[Anonymous Coward]

Red Hat will also sit alongside UnitedLinux which got the certificate last August.

Re:Windows 2000 is certified as well

[Anonymous Coward]

yeah your right, I can't understand how any version of linux could have gotten certified with the numereous vulernabilites that are found daily. :-)

Re:Windows 2000 is certified as well

[Anonymous Coward]

*STAMP* PASSED

Re:Windows 2000 is certified as well

[Anonymous Coward]

Making EAL4+ gettable without any Quality Control makes these experts look real bad - Lots of things since SP3 prove they missed things. QC activities focus on finding defects in specific deliverables - e.g., are the defined requirements the right requirements. In this instance, giving EAL4+ out to the maker of concrete life jackets, proves the CC process needs an overhaul, and should have a minimum mandatory QC component.

The CC people considered this, then rejected it, because they thought no one would spend all this money without some certainity - leaving the boffins with no jobs. What a farce.

So this PHB concludes standards ARE dropping, with the security people quite daggy.

Re:Windows 2000 is certified as well

[JediTrainer]

(sidewalk for the en_US folks)

I'm en_CA you insensitive clod! (and we use 'sidewalk' too)

Re:Windows 2000 is certified as well

[hwyguy2]

Sigh.

It would be useful if folks took some time to learn whereof what they speak.

As has been noted in other comments, a statement of an EAL with respect to an evaluation, in isolation, is MEANINGLESS. EAL4 refer to a particular level of confident that the claimed functions are implemented correctly. ONLY those claimed functions.

How are those claimed functions determined? Look at CC Part 1. They are based either on a specific set of organizational policies (such as the DoD) or determined in response to specific threats. There is also a specific set of assumptions. You must read these to determine what your actual security is; they are contained in the Security Target.

In the case of Windows 2000, a claim was made against the Controlled Access Protection Profile. This is roughly C2 functionality, but what is more important: it is for a BEGIGN environment. Thus, there wasn't extensive penetration testing done. This is great for many DoD applications, as the systems are used in a close environment, with trusted people, and no internet connections.

However, most people deal with hostile environments -- the internet. The evaluation didn't occur against that threat; thus, there were no functions added (nor the requisite assurance) against that threat. I'm sure there is something similar for Red Hat.

Folks, don't take the easy approach of looking at a rating. It is as useless as looking at Thumbs Up or Thumbs Down to see a movie. Take a time, read the specification, and read the reviews.

Daniel

Re:Windows 2000 is certified as well

[hwyguy2]

Its pretty well common knowledge in the security community that Microsoft paid for that certification.

Actually, in todays model, ALL VENDORS pay for their certification. All the government provides is oversight to the commercial labs that do the actual evaluation.

It is the vendor's responsibility to (a) pick a scheme (i.e., in which country will evaluations be done: US, UK, France, Germany, etc.) -- differing countries have different forms of oversight, but supposedly the same level of rigour; (b) pick an evaluation facility in that country (for the US, you can see the list by visiting the CCEVS webpage). The vendor also gets to develop the claim of what security features are present (i.e., the security target).

This is VERY different from the older "Orange Book" evaluation paradigm, where the government wrote the criteria (TCSEC), and the government evaluated against the criteria (TPEP).

Daniel

Re:Windows 2000 is certified as well

[mikefocke]

Anyone who wants a product certified/evaluated according to the Common Criteria rules has to pay the lab that does the evidence evaluation. Those are just the CC rules. MS is just doing things the way the CC set them up to be done.

Now you could quibble about the Protection Profile that was used or the Security Target and how much functionality they contained. You could also ask how rigorous the examination of evidence by the lab was. You could ask why they couldn't achieve a higher EAL level.

But to compain because MS paid the lab is unfair because there are no options. In some countries, you also have to pay the government body who is overseeing the lab for their labor!

(said as one who is also paying a lab a lot of $ to evaluate a OS ... see http://www.digitalnet.com/solutions/info_sec_sol/x ts400_trusted_sys.htm).

Re:Windows 2000 is certified as well

[4of12]

The Common Criteria seems to be at least as much about money as security.

If I were concerned about security, I'd start looking at OpenBSD first, FreeBSD next.

But those OS's don't seem to be on the CCEVS list.

It's ridiculous that a monetary hurdle will arbitrarily exclude excellent secure OS's from consideration while including less secure OS's that do little more than buy certification.

IMHO an impartial standards body like NIST ought to periodically evaluate OS's for security, performance and reliability for different "real world" functionality (desktop/web browser/email/document authoring), (web/db server), etc.

This would be something useful to the public at large and would be a beneficial result of using government funding: a more economically efficient and secure computing environment. But I realize that such a brutal cruel evaluation might conflict with the honorable free-market tradition of "may the biggest advertising budget win". For that reason, that it might run counter to the advertised claims, we'll never see such a rundown except in an expensive whitepaper that you'll need to pay $2500 to see.

I would expect to see trade-offs between security and performance ( or correlation between security and reliability), but there might be some interesting bargains in OS choice depending on your application mix.

A pity

[meridian]

we will never see Debian get this

Re:A pity

[calebtucker]

Probably not.. if I understand correctly, EAL 2 costs about $200-300k, and EAL 4 can cost around $1mil

Re:A pity

[Anonymous Coward]

why?

Re:A pity

[77Punker]

So this cert is basically just a bunch of bribing shit? Just buy their little logo to put on your website?

Re:A pity

[MonkeyINAbaG]

I guess thats one way to keep the good linux distros out.....

Re:A pity

[Anonymous Coward]

Hell no, they can't even keep THEIR OWN servers from getting cracked like a government should really entrust anything IMPORTANT to an os made by amateurs?

Ya I want to trust national security to Joe Bob Weekend Hacker, Uh oh, Joe Bob had a calculus exam this weekend I guess we'll have to wait to patch the nuclear reactor after the semester is over!

Re:A pity

[Anonymous Coward]

That and your distros servers can't be broken into for at least six months...

Re:A pity

[nakhla]

No, you just have to hire companies with experience in CC certification to do the evaluation itself. Hence the high cost.

Re:A pity

[Anonymous Coward]

Ya I want to trust national security to Joe Bob Weekend Hacker, Uh oh, Joe Bob had a calculus exam this weekend I guess we'll have to wait to patch the nuclear reactor after the semester is over!

LOL! True, very true. At least with Microsoft we can be assured of timely secure patches being released when a vulnerability crops up. Without corporations there would be chaos!

Re:A pity

[Anonymous Coward]

Actually microsoft is reasonably fast with security patches...

In the future use APPLE to highlight your point since we all know Apple will just ignore a vulnerability until they can charge you for a fix in a new "update".

Re:A pity

[marderj]

Not really. I'm not bashing Debian here, but it's not likely any government agency or fortune 500 company is going to be adopting a community-supported distribution for widespread use any time soon. Government agencies and fortune 500 companies typically (read usually, not always) don't like software that doesn't come with a support agreement, even if it is arguably a better product. In any case though, this shouldn't change anyone's opinion of Debian. A certification should not be confused with quality.

Re:A pity

[Afrosheen]

No, actually, I bet SusEvell is going to be next in line for this type of certification.

Re:A pity

[hwyguy2]

So this cert is basically just a bunch of bribing shit? Just buy their little logo to put on your website?

There is no bribing; that I can assuredly say (at least for the US, where I'm involved with the process). I don't believe it is happening elsewhere either.

The evaluation labs do an honest evaluation of the product, and there is scheme oversight to ensure that they do. Schemes monitor themselves to ensure that there is consistency across the schemes.

So, don't go blaming evaluation labs or oversight. The usual problem is a bad security target, or people reading the certifications without reading the targets.

Daniel

Re:A pity

[mens]

Usually, that's not because they don't trust the product, but because they don't trust their techs. If they use a distro which has a support contract, they have a place to go to - and a company to blaim - when the problem cannot be solved internally. Without the support contract, they think they're helpless in times of trouble.

SuSE?

[santiag0]

Does anyone know if SuSE/Novell is pursuing this same certification?

Re:SuSE?

[santiag0]

I guess so, duh, shoulda googled first:
SuSE

Re:SuSE?

[Zenophran]

Not that I've heard so far, but it will make things a lot nicer where I'm at if they do...

At last...

[Zenophran]

We're looking to use it in some places, but wasn't able to think of it until we found out it was going through certification.

It mightn't mean much to some places, but for government organisations, it's a big step to getting it in more places than just using it for "development toys".

One small step

[Anonymous Coward]

This is another way of legitimizing Linux in the corporate world. Despite Red Hats recent business decisions over all this is a very strong/smart move for all Linux users.

Since the article didn't mention it...

[sczimme]

you can read about the Common Criteria here.

Unfortunately, the other site has been shut down.

Re:Since the article didn't mention it...

[eer]

Why did they discontinue the portal? It seemed like a good idea to provide a centralized list of evaluated profiles and products. With evaluations coming from all over the world, finding reports for competitive evaluation and profiles for product requirements is important to vendors. Has another site taken up the task?

Re:Since the article didn't mention it...

[bogeysw]

The following website Common Criteria Evaluation Validation Scheme (CCEVS) contains much of the information listed at commoncriteria.org, but is far from a complete replacement. It contains validated products and protection profiles as well as the same in evaluation.

http://niap.nist.gov/cc-scheme/index.html

Re:Since the article didn't mention it...

[hwyguy2]

Why did they discontinue the portal? It seemed like a good idea to provide a centralized list of evaluated profiles and products.

While the site had its share of problems, I agree that discontinuing it was bad, especially with no notice.

I have my guesses as to why it was discontinued, the primary one being funding for the CC Project as its own entity.

Daniel

About certs

[segment]

I know I ramble on about a lot of things here so here is another rant. Is it me or are certs like so blown out of proportion it's not even funny? Don't get me wrong, I think they have their place somewhere, but as for counting on someone certified to actually have a clue is an altogether different case.

For those on mailing lists (I'm on isp-lists*, sec*focus*, nanog, sunmanagers, etc), how many times do you see someone with a sig with all their grewvy certs asking dumb assed questions that any good sysadmin/secadmin/network admin could answer? Come on I know I'm not the only one. I've seen plenty of people in the industry with certs galore who didn't know squat, I've read about CCIE's who didn't even know the command line syntax to null route.

Maybe I should pick up the books and just take my certs for the hell of it, but I see no need to. I make money, and haven't had problems with anything. If I need something done and I don't know, then I'm learning it for my own sake immediately. I've never felt the need to get a cert, so am I rambling on... Or... Are certs like soooooo yesterday?

Re:About certs

[Ricin]

You're right, it's not funny, it's sad.

Re:About certs

[Anonymous Coward]

Yeah, so like, I was skimming /. and I like saw your post and realized like, "This dude didn't even like read the article" and then I realized that "he didn't even read the post either".
So I'm thinking "this dude complains alot", you know. Like, I figure that people who complain alot about how stoopid everyone is, especially about like, you know, other people who have qualifications they don't have, are seriously jealous cause like, deep down they think "How can those stoopid bozos be successful and a genious like me can't get nowhere??"

Re:About certs

[silas_moeckel]

OK I'm a bit biased as a CCIE but your confusing certs with experience certs have become just a test to make sure your somewhat compotent. A good hiring manager takes them for what they are just a test that shows you have a minimal ammout of education.

Now the CCIE tract is more for thery and for me it was exposure to old school antiquated techs like IPX, frame relay and RIP to name a few. Many a CCIE spends there days working out thery and big broad strokes of a Network Arch not plunking away at a keyboard (we get flunkies for that, what did you thinkt he CCNA and CCNE's were for :) thats why your average shop dosent have any CCIE's on staff but calls them in when they make big changes.

Re:About certs

[bersl2]

I would say that any kind of complex certification is highly overrated. CC, MSCE, RHCE, all it means is that you learned about a system in abstract. Whoop-de-doo!

Now CPR certification, that's an important one.

SuSE Linux

[Anonymous Coward]

This means Red Hat will sit alongside Sun Solaris, HP-UX and IBM's AIX.

... and SuSE Linux.

anything changed?

[Anonymous Coward]

at least linux-inclined sysadmins working for companies (who require too much of a product) will be able to select a linux variant without too-much-persuading their bosses. that is a biggie, i think, for a considerable number.

Yeah right...

[DeepEyes78]

Red Hat couldn't have pulled this off without technology stolen from SCO. It's a known fact that SCO owns IP on everything that makes linux useful.

drip...drip...

Excuse me, I've got sarcasm dripping from my chin...

Re:Yeah right...

[Lord Kano]

Excuse me, I've got sarcasm dripping from my chin...

Maybe you should ask Darl to warn you further in advance next time.

Re:Yeah right...

[Anonymous Coward]

It's a known fact that mentioning SCO will get you modded "Funny."

Re:Yeah right...

[Anonymous Coward]

ZIP! that ain't sarcasm sweetheart.

Playing the corporate game

[Ricin]

One more useless qualification-paid-for-sign-dotted-line.

People should really get it through their skulls that this is not going to help and that talent may not be in their brokerage system already when looking for it (and so they miss out).

One more example of commodifying the _wrong_ thing. Can pay in the short term but ughugh the longer term....

When something happens, formalizing it usually means restricting it from "just" happening further. Mkay ;-)

Validating the Kernel Development Model

[oo_waratah]

From the original February discussion. This has even more relevance now. ...

"The Common Criteria, ..., grades products based not only on their security and reliability, but also on the development and support processes that ensure quick responses to problems."
Does that mean that the US Gov. will be officially saying that the Kernel development model is OK ?

Re:Validating the Kernel Development Model

[burns210]

it isn't 'the Kernel development model' rather, the open source development model that they would be giving the ok for.

The level matters; most CC certs are useless

[Wesley Felter]

RHEL is getting certified at EAL2, which is really weak.

Even the Windows 2000 EAL4 certification only protects against "inadvertent or casual attempts to breach the system security." No real security here. For more info, read Jonathan Shapiro's article.

Re:The level matters; most CC certs are useless

[Anonymous Coward]

Even the Windows 2000 EAL4 certification only protects against "inadvertent or casual attempts to breach the system security." No real security here.

EAL4 is the highest Windows, or any other commercial off-the-shelf application will ever get. Anything higher requires design verification from the planning stages and is intended for custom built applications for specific purposes.

Re:The level matters; most CC certs are useless

[reub2000]

So basicly, all you have to do to get eal4 is to have a root or admin password, and propt you before using a tool that could be dangerous?

KungFUnix certification

[segment]

KungFUnix proudly introduces CUP, Certified Unix Pimp certification. Now you too can study and memorize 50 common criteria books we select and get kickbacks from in order to achieve your goal of adding the word CUP to your signature.

NO EXPERIENCE NEEDED!
That's right act now and send us 2,000.00 (US), and we'll gladly present you with information on obtaining this new and exciting certification. So what can you do with a CUP certification:

• Impress your clueless CTO
• Impress friends
• Add the word CUP to CCNA, MCSE, or CISSP
• Use the cert for a dustrag
• Smoke a doob with the cert

shrugs Certs who needs em.

Re:KungFUnix certification

[johnnyb]

I wouldn't put the acronym, I'd spell it out.

"Yes sir. I am the most qualified for this job. In fact, I am an officially certified UNIX Pimp!"

If someone said that to me, I'd hire them on the spot :)

Re:KungFUnix certification

[SpaceLifeForm]

Yes sir. I am the most qualified for this job.
In fact, I am an officially certified *NIX Pimp!

When do I start?

Re:KungFUnix certification

[Anonymous Coward]

shrugs Certs who needs em.

People that want a job? Having a bachelor's degree is pretty useless these days when there is a huge pool of people out there with the same degree. You need to distinguish yourself somehow.

Other Distributions?

[Storm]

I was just wondering whether or not other distributions can use the work that RH is doing to get a "common Common Criteria" effect. After all, they are all using the same Ring 0 piece, being the Linux kernel. After that, it should just become a matter of configuration verification...

And with the support that Linux has gotten from the NSA, through SE-Linux, I would think a lot of the in-depth work on Linux has been covered.

Ok I'll throw one in: RedHat is dying :-)

[Ricin]

Since the discussion so far was so boring let's instead wonder why RH is so eager to wlk the "established commerce" path.

I'll tell you what their problem is: they're the first. The first always loses. They get to fight the hardest their own community, they get all the surprises boomeranged back to them, they just get everything first. Even if they don't really innovate. And _that_ is going to kill them. They don't know how to react any more (heck no one does) and so they jump back into corporate logic... which they were seen as being a counter to.

I don't know I don't have much love for them but neither do I have any hate towards them. But I feel that the 5th or so is going to be the one that matters 5 years from now. Heck it may be a BeOS clone or a BSD even so. IMHO, we're now at a point where armies die, believe it or not.

Footnotes are recorded right now.

Re:Ok I'll throw one in: RedHat is dying :-)

[Rosco P. Coltrane]

I'll tell you what their problem is: they're the first. The first always loses.

Know thy Linux distro history : RedHat is not the first anything. Their distro is *not* the first Linux distro (Caldera's was), and RH isn't even the first Linux distro maker to shaft its users and antagonize everybody in the community (again, Caldera-now-SCO is).

This said, you're right : the first always lose, as Caldera/SCO has proven for years and will brilliantly prove again very soon thanks to IBM.

Re:Ok I'll throw one in: RedHat is dying :-)

[Ricin]

OK, it's the first with this mindshare. Caldera could have been. Easily. If they had kept their heads str8. I never liked them too much but at OL 2.2'ish they had one nice product.

(they were a fork of redhat though but they could have be the center of Linux today yes)

As far as the thing with IBM, well I'm enjoying the soap and I feel it's a lot of FUD but we'll see. I wonder if they will ever challenge BSD. Once they do so, sell your stock :-)

Re:Ok I'll throw one in: RedHat is dying :-)

[Ricin]

Actually Slack was the first distro

Re:Ok I'll throw one in: RedHat is dying :-)

[Anonymous Coward]

Actually wasn't Yggdrasil the first distro?

Also there was some other early one like Jack Somebodies Linux Distro or something but he stopped making it once more people started making them.

Re:Ok I'll throw one in: RedHat is dying :-)

[Ricin]

It's very lame to mod me down just for not agreeing with the general hoopla.

At least respond then. Controversy and debate are good things at least in my world they are.

Re:Ok I'll throw one in: RedHat is dying :-)

[Anonymous Coward]

Bull. Slackware was based off of SLS, and even SLS wasn't the first distro!

Re:Ok I'll throw one in: RedHat is dying :-)

[Anonymous Coward]

Wasn't there MCC (manchester computing centre) too? Amazingly, it stopped being updated when Microsoft donated a few million to the university of manchester....

Re:Ok I'll throw one in: RedHat is dying :-)

[JK Master-Slave]

SLS was the first distro.

Yggdrasil was the first Linux vendor to have a commercial CD-ROM distribution. Fall of '93.

There's an InfoMagic 'UNIX' CD that had a kernal 0.99.10 on it from July of '93.

Some of us were there.

Re:Ok I'll throw one in: RedHat is dying :-)

[egregious]

Actually Slack was the first distro

No it wasn't. SLS was the first linux distro.

Re:Ok I'll throw one in: RedHat is dying :-)

[Rex Code]

No it wasn't. SLS was the first linux distro.

Not even close. The first Linux distribution was H.J. Lu's boot/root floppy combo, and I think even MCC+ came before SLS.

PARENT IS OFFTOPIC, THIS ISNT THAT KIND OF CERT

[Anonymous Coward]

Why are all these moronic offtopic cert bashing posts getting modded up?

The CC cert has nothing to do with CCIE, MCSE OR ANY OTHER OF THOSE!

Mod those tards OFFTOPIC. GET A GOD DAMN CLUE.

Yes, the MCSE is a joke and we're all so much smarter than those MCSE losers blah blah usual slashshit crapfest...EXCEPT ITS ALL OFFTOPIC.

EAL4...so what

[solli]

The CC evaluation comes in two parts:
A profile for the evaluation, and the assurance level to which you achieve that profile.

So if your profile is essentially "can boot" you can probably achieve that with a high level of confidence. All this talk of EAL4 is pointless unless you are told what the profile is.

In the best case, this only means that RH (and Windows, for that matter) could be used in a system carrying information classified at a single level, say, "secret".

In no (normal) circumstance would either RH or Windows be used to handle information classified at two different levels, such as secret and unclassified. If you want to do that, you need to use Trusted Solaris or some other evaluated "Trusted" operating system. Getting a evaluation for a system that can label information and keep different types of information apart (B1 or B2 in DOD Orange Book parlance) is a whole different ball of wax than what RH and Windows received (C2).

Re:EAL4...so what

[burns210]

with Apple trying to get serious in the Unix / server world... i wonder if they would move darwin into a position of a old-school unix... trying to go on par and beat out redhat/suse, and even go for irix/hp-ux/win2k pro. They have the money, and it is only going to give them more leverage in the business world.

SuSE already have it, next Debian?

[ciaran_o_riordan]

SuSE already have it.

Next question, will someone fund a community owned distro to get this certification?
(i.e. Debian etc.)

Re:SuSE already have it, next Debian?

[Anonymous Coward]

Only on IBM S390 platform.

Meh

[avageek]

Speaking as someone who works for the government and knows exactly what a Common Criteria Certification is worth, why the hell do the Red Hat people think they're going to be major players by getting certified to EAL-2? I mean, seriously, *anyone* can get EAL-1, so they put just a tiny bit more effort (and dough) into it to get EAL-2, when competing operating systems like Windows and Solaris are EAL-4. No one is going to take them seriously with just an EAL-2. And that explains why it'll be done by the end of the year. And by the way, the CCC is a bunch of BS that tells you absolutely nothing about how secure a system is. For the government, it just dictates what you can and can't buy.

Re:Meh

[Iorek]

"Speaking as someone who works for the government"

Well, speaking as someone who works for a government's CC certification scheme, EAL2 actually does give you some assurance, and I've personally seen companies stumble in getting it. At that level, you're taking a closer look at the developer's design, configuration management and testing; you're making sure they conduct a proper vulnerability analysis, and devising your own penetration tests. It's a significant jump from EAL1.

Re:Meh

[avageek]

I didn't say it gave you no assurance. I just said it wasn't enough when competing with the likes of Microsoft and Sun. Hmm, let's do the math, EAL-4 is greater than EAL-2, and EAL-2 is just not that great, even if some companies do screw up in trying to get it. Trusted Solaris has a great reputation as far as secure operating systems go, is EAL-4, and a lot of security software is based on it. Who is going to win that battle? It ain't gonna be Red Hat or SuSE. It may let them get their foot in the door a little bit, but not enough to play with the big boys. And even worse for them, the NSA has their own Secure Linux distribution. I'd rather try to bring in something that has a snowball's chance in hell of being accredited than an EAL-2 product... getting a CCC is just the first step towards getting a product purchased. You still have to accredit the product and that can take years. Which will have a better shot, something that's EAL-2, or something the NSA put out? It doesn't take a genius to figure out that one.

Re:Meh

[eer]

it just dictates what you can and can't buy.

As a vendor, that's quite enough!

But you're right...the TCSEC C2 and it's equivalent Controlled Access Protection Profile (and even the Medium Robust OS profiles) all recommend against running systems in environments where you don't trust the users to fully cooperate with security policy. In other words - they're supposed to be adequate to protect against accidental violations of security policy, but not determined attack.

Bottom line, none of us should be using commercial operating systems on the Internet, right? Where's MULTICS when we need it?

Re:Climb up the ladder, you leave the bottom rungs

[PakProtector]

If you're talking about 'Longhorn,' then it's Windows 2007(/+).

...

I think I should add a 'You insensitive Clod!' here for the sake of 'fitting in.'

Solaris, HP-UX and AIX...

[RLiegh]

Now that's distinquished company.

the main distinguishing charactaristic being that almost no-one uses them any more...

NOT "alongside", but "a long way behind"

[menscher]

RHEL is to be tested for EAL2, which is rather different from EAL3 OSes (IRIX and Trusted IRIX/CMW) and EAL4 OSes (AIX5, HP-UX 11, Solaris8 and Trusted Solaris8, and Win2k Pro). In fact, the *only* OS RHEL will be "alongside" is SuSE. See this site for details.

Note that EAL2 is something that provides essentially no assurance of security. You can find details of this in Google's cache (www.commoncriteria.org is no longer alive).

RH Linux EAL: 2 MS Windows 2000 EAL: 4

[Drestin]

And this is almost 4 years after Windows 2000 did it with ease. Of course, Windows XP/2003 are even more secure so...

What gets me is, if it's so expensive and time consuming to do this, why not go straight for level 4 certification? Unless it was unachievable... Vendors know ahead of time if they'll pass or not, all the criteria is there for the public to review. You don't submit until you are already sure you'll pass. Obviously Linux is not EAL 4 ready. Windows 2000 is not only EAL 4 but also augmented with ALC FLR 3.

Who is going to notice an effortless to achieve EAL 2?

Re: Actually wasn't Yggdrasil the first distro?

[Ricin]

No that was only released on punchcards and not updated after. It doesn't count anymore.

I'm going to kill your whole family

[Anonymous Coward]

just kidding

Re:ur right man

[Anonymous Coward]

Look, for the love of all that is holy, it's spelled HOBBYIST. Jesus Christ!

OH MY GOD OH MY GOD ALERT THE AUTHORITIES

[Anonymous Coward]

remember,it's yellow in the front, brown in the back.

dupe

[Anonymous Coward]

dupe of this.

Hey, RMS, read this!

[Anonymous Coward]

>> EAL 2 costs about $200-300k, and EAL 4 can cost around $1mil

Is this your next frontier? It certainly does not look very freedom-free to me...

quick, change the history books.

[ciaran_o_riordan]

> it isn't 'the Kernel development model' rather, the open
> source development model that they would be giving the ok for.

Actually, it's the "open development model". The term "OpenSource" was created in 1998. Before this, many Free Software projects used the open development model. Linux was the first big one and it's use of this model really took off in 1992.

(and anyway, they're not certifying a development model, they're certifying a specific box set.)

RH grows up

[inode_buddha]

... and it has *very little* to do with their stock price. It has a lot to do with credibility when making a sale.

Think of it this way: lots of tech people get certifications such as CCNA, MCSE, etc. in order to get through the hiring process. The actual certifications may be meaningless in any number of ways, but the hiring people insist on them.

Now, think of this: RH, as a fictitious person (a corporation) needs to get this cert so it can get that cool job. They want to get hired for that big enterprise thing, since they've been saying, "Enterprise" a lot lately. The hiring manager(s) want to see that cert on their CV.

My conclusion? This is a very smart move for RH, and they should pursue similar avenues as the market dictates.

Re:RH Linux EAL: 2 MS Windows 2000 EAL: 4

[Anonymous Coward]

XP / 2003 are even more secure?

ha ha ha.

Re:RH Linux EAL: 2 MS Windows 2000 EAL: 4

[Anonymous Coward]

effortless? As I recall, ms struggled for years to get some sort of certification, and though they did manage to buy the cert, it really means nothing, as anyone who is plagued by the endless parade of microsoft worms & virii can attest.

and xp "even more secure" - that's hilarious - have you been living under a rock? I guess to be a good microsoft fanboy, you must ignore the nonstop microsoft security disasters that plague us all, and focus on the assurances of the ms pr campaign.

Good lord, where do they find these idiots?

Re:RH Linux EAL: 2 MS Windows 2000 EAL: 4

[krbvroc1]

What gets me is, if it's so expensive and time consuming to do this, why not go straight for level 4 certification?

It costs time and money to do this and what for? All the 'trusted OS' systems have to be rigorously certified on specific hardware and with a specific version of driver, etc. This limits their usefullness. They lag the technology curve by a considerable amount of time. (for example, certification occurs on a 2.4.21 kernel--but if your newest network card requires 2.4.23 too bad)

NSA has worked on securing linux, but it is not to the trusted OS level. My personal opinion is that the only way to have a trusted network is to not connect it to other stuff - dont rely on 'trusted OS's' etc.

Another thing to consider is that a lot of these certification requirements by groups like the 'EU' are really just forms of protectionism. They raise the bar to competition. In many instances these organizations exempt themselves from the standards. Take ISO-9000 for example.

Gah

[inode_buddha]

will someone please *off* the AC troll that's going on about the cert types? Yes, I *know* the diff, without even RTFA, and I *own* an original Orange Book. FWIW, the anti-troll ammo is on me for the next 12 Z

Its form testing is useless for security

[Skapare]

Security cannot be determined from simply doing a suite of tests, and determining that it must be secure if the tester was unable to break in. The biggest variable that affects security is the administration of the machines ... and this applies to all systems, BSD, Linux, Solaris ... and yes, even MS Windows. Even OpenBSD clearly states their history of security (note, they never claim that is is secure, only that it has been to a certain degree) is based on the default install. Change it in any way, and all bets are off.

Security is not a thing you can just buy. Likewise it cannot be an attribute or property of a thing you can buy (or download). Security is in how you go about every aspect of the way you work, and not just in computers and networks. Social engineering is still a very workable way to access what you are not authorized to access. Poor passwords are incredibly common, for example (spammers are now using password guessing successfully to log into SMTP AUTH and MSA mail ports to submit their garbage ... they already have your userid). People are the weak link.

So ... IMHO ... the Common Criteria Scheme is nothing more than a bunch of feel-good paperwork for PHBs. Unfortunately, it's what PHBs want to see, so vendors like Red Hat do need to play into this BS just to get some sales. But it doesn't tell you squat about real security.

Re:Its form testing is useless for security

[Tom]

Security cannot be determined...

The CC have nothing to do with security in the sense you are talking about.
They are all about trust and assurance, and about evaluation of security procedures. For example, documentation takes a central role, as does version management during the development process.

It's got nothing to do with stuff like default configurations, open ports, buffer overflows or what have you. It just tackles the problem on an entirely different level.

Get the specs...

[inode_buddha]

...here, look at the column under "Criteria". Be careful not to slashdot it - note the .mil domain ;)

I'm going to rape your 9 year old daughter

[Anonymous Coward]

fo shizzle

Now I know for sure Red Hat is Successful.

[Anonymous Coward]

Now I have finally realized this. Red Hat is successful. How do I know this? Any company that gets bashed by Militant Nerds are successful in my book :)

Re:Now I know for sure Red Hat is Successful.

[reub2000]

That's because the only reason they are succsesful is because they have a bigger adverising bdget than an r&d budget. The majority have consumers have heard their name, so they buy it. Dell and aol are perfect examples. Crappy products that sell well.

going straight for level 4?

[Anonymous Coward]

i'm guessing that you can't. many certs and classifications the government doles out must be met in sequence. kind of like the SEI levels. this is only a guess, though.

for example, MS may have had EAL 1, 2, 3 on other systems and as such "qualified" to attempt a level 4 compliance.

What do you mean?

[pr0ntab]

The CC label is REQUIRED for some government computer work for which linux is perfectly suited, but until recently had to be passed up. We could use Trusted Solaris (yawn) or Win2K (barf). Then came SuSe, but we liked RedHat better. Now we will be able to have RedHat in the mix, which should keep things interesting.

It's not so much that the people who actually check the security care what OS it is... it's the people who approve the classification of information systems, etc. you know, pencil pushers, that give a shit about the Common Criteria cert on XYZ software.

I'm glad RedHat finally scrounged up some money from under the couch to remove this roadblock.

Winning and keeping score

[Anonymous Coward]

When you go to a football game or a tennis match do you consider the scoring to be a "useless piece of paperwork"? Not many folks would show up for a match with no scoring. You know, actually there are some politically correct kindergartens where they don't score the games. In these feel-good romper rooms, "everybody wins".

In the real world we keep score. Benchmarks are a way of keeping score. Market share is a way of keeping score. And CC certification is a way of keeping score. It helps separate the winners from the losers. That is the way things are. Always has been that way, and always will. Except of couse in PC kindergarten.

CC certification is a good thing.

footnote: see Aesop's fable of the fox and the grapes for further insight.

Re:Winning and keeping score

[Skapare]

Scores are what we expect to get when the game is about the score. Football is about what the score is. Pittsburgh just about won the game today when they made a touchdown that put them ahead near the end of the game. But then Cincinnati turned around and scored a last minute touchdown. The score is what counts.

Those who think that the score is what counts in computer security are part of the problem. The score is nothing more than a lead. Track record counts for more in actuality, but even that doesn't matter. Bad administration can make any system totally insecure. Really good administration can push a system to exceed its default capabilities.

So if you want a score, then play the game and see who gets cracked and who doesn't. There's your real score. What PHBs are trying to do is get the score finalized before the game (actually running the system and keeping the crackers and other unauthorized intruders out) even begins.

Just RH's implementation

[hughk]

The implementation of Linux submitted for evaluation came from RedHat as do the support services. Therefore it is only RH's implementation of Linux plus support that has been accepted.

OTOH, I guess it would not be a major problem for another vendor to go down this same path with Linux, as long as they can demonstrate a similar implementation process.

Drawback

[Anonymous Coward]

The biggest drawback is that they're getting certified in the UK! Even if they were to change and go for an EAL3 or better it would be illegal to use in the US for classified processing until it is tested by a US sponsored evaluator. Talk about your Catch-22's.

Why are you coughing?

[Anonymous Coward]

Are you some kind of retard?

Re:RH Linux EAL: 2 MS Windows 2000 EAL: 4

[Anonymous Coward]

as anyone who is plagued by the endless parade of microsoft worms & virii can attest

I want to lodge a complaint with Microsoft. I've used Windows XP since it went to release candidate and I've never had an endless parade of Microsoft worms and virii, and frankly, I'm pissed about it. I love parades! Especially when the virii get dressed up as cartoon characters. But all I got was one shitty worm that didn't even bother painting its face. Ripped off!

If you've been plagued by the "Microsoft" virii going around then I've got a hint for you: don't execute those files called "SomethingInteresting.doc.exe" that RonaldMcDonald55832@yahoo.coxlkkk sends you. That bastard is so dishonest!

Do you even work on servers?

[t0ny]

Who the hell worries about putting IE or even OUTLOOK of all things on a server? Who puts IIS on anything but a web server?

You dont really work on servers, do you?

Re:Do you even work on servers?

[goonerw]

It's not like you have a choice in installing IE or not.

Re:Do you even work on servers?

[Kumochisonan]

Hell, I wouldn't even put IIS on a webserver...

I did however hear a rumour that IIS is bundled with every installation of Win 2003 Server and is an activated service by default.

Re:Do you even work on servers?

[Anonymous Coward]

and i heard a rumor that your mother sleeps with homeless drifters

KDE...

[grokster]

The KDE.org folks can leverage this to get Kommon Kriteria certification...

How relevant is a Cert of this nature to Linux ?

[kbsingh]

For an OS like Linux, thats always changing and evolving, how relevant is a Cert of this nature ? In an OS like Windoze where there are very little ( or far and few ) feature updates, between fairly long drawn out release cycles one can understand that each version being certified can mean something.

Re:RH Linux EAL: 2 MS Windows 2000 EAL: 4

[Tom]

It is extremely time consuming. The main problem for Linux will be the requirements of documentation and development.

For example, EAL4 requires a "Developer defined life-cycle model". That just doesn't merge well with Linus approach of "when it's done".

Very good point often missed!

[Oestergaard]

You hit the nail on the head there - unfortunately it seems no media has even attempted to understand the basics of CC, when reporting on this...

A CC certification consists of two parts:
An "assurance level", and either a "security target" or a "protection profile".

A protection profile is a sort of a "standardized security target". A description of a number of requirements that you evaluate your system against. Whereas, a "security target" is something you yourself write, if you do not want to certify your system against an existing protection profile.

NSA has submitted protection profiles that are roughly equivalent to TCSEC C2 and TCSEC B2; the CAPP and LSPP protection profiles, respectively.

SuSE got an EAL-2 certification against some security target that they themselves wrote. This means, they are "fairly" sure that their system does roughly what's in the security target (that they wrote). Had they gotten an EAL-7, it would only mean that they were "very confident" that their system did what was in their security target. It would say nothing about the completeness or even relevance of their security target.

Some newer versions of windows got an EAL-4 against the CAPP. This can be seen roughly as equivalent of the old C2 certification.

Trusted Solaris also has an EAL-4. However, they have an EAL-4 against the LSPP, which means something roughly equivalent to the TCSEC B2 certification.

People, there is a world of difference between those two EAL-4 certifications!

One should note though, that NSA writes in the LSPP that it is not intended for systems that should be used in 'hostile' environments or even with malicious users. The internet, for example, can hardly be classified as a 'friendly' environment.

This is interesting, as virtually no systems that are connected to the internet today have anything even remotely resembling the functionalities mandated by the LSPP, not to speak about assurance levels...

Will Debian be CC certified? Not probable

[javifs]

Certification is not a question of technical merit, it's also based on a lot of paperwork as well as a lot of money that needs to be "given" to a certification laboratory that validates all that paperwork

I've been pushing for a Debian CC certification myself, but it's not probable that this will come to pass unless it's sponsored.

You do have a Debian-derived product that is currently CC certified EAL4: Stonesoft's Stonegate (security target available at NIST's NIAP, the Common Criteria site seems to have been discontinued unfortunately). It is certified versus a firewall-specific Protection Profile, though, so it should not be used as a comparison metric against others that are certified against an operating system PP.

CC must die

[jeremycec]

A few reasons why the Common Criteria will not last nearly as long as the TCSEC/Orange Book:

1. Too confusing/difficult to use. I attended a week-long course on how to write Protection Profiles. I have now written a couple and still feel like I don't know what I'm doing. I'm not an idiot--I have 13 years in the INFOSEC field and teach courses on INFOSEC. The problem is in the interpretation of the requirements. There is so much room for extension/customization/modification, that the whole thing is sort of worthless.
2. Who is using it? I work with people in the federal government (NIST/NSA) who don't know anything about the CC or PPs or STs, and they authored the @#!&$ thing. My military clients know nothing about it either. It hasn't caught on in five years or however long it's been out.
3. No good tools. I used an automated (Java-based) PP/ST generation tool, and it was a total kludge. AFAIK, there is no good tool available for mapping Threats, Assumptions, and Policies to Objectives, which in turn map to Functional and Assurance Requirements. And once you do the mapping, there's no good tool to update future revisions of your PP/ST.

Re:CC must die

[hwyguy2]

# Who is using it? I work with people in the federal government (NIST/NSA) who don't know anything about the CC or PPs or STs, and they authored the @#!&$ thing. My military clients know nothing about it either. It hasn't caught on in five years or however long it's been out.

Just because they aren't using it now doesn't mean they won't be. The latest DoD Security Policies (DoD 8500.1/8500.2), as well as the emerging DIACAP, will require its use.

Daniel

Re:How relevant is a Cert of this nature to Linux

[hwyguy2]

It is actually very relevant, if Linus is to achieve penetration into the DoD market. New govt policies (8500.1/8500.2) mandate the use of evaluated products if they exist in a category. In order to use Linux, an evaluated product is required (not to mention other hoops, such as JTA).

Daniel

MS Troll Alert!!!!!

[Slashamatic]

I don't put IE or Outlook on a server - because I have eliminated MS server class machines!!!!!

Anyway if you wern't totally ignornt, you would know that it is very painful to install any edition of Windows that currently ships without bug infested IE. You obviously failed even your Minesweeper Consultant and Solitaire Expert exam.