Slashdot Mirror
Red Hat Pushes For CC Certification By Year's End
Ridgelift writes "This article indicates Red Hat Linux is about to receive certification under the Common Criteria (CC) Scheme worldwide. This has been a long road for Red Hat, and 'once successfully certified in the UK, Red Hat products will be recognised as certified and approved by information security agencies from all 19 countries participating in the Common Criteria program.' This means Red Hat will sit alongside Sun Solaris, HP-UX and IBM's AIX."
This means Red Hat will sit alongside Sun Solaris, HP-UX and IBM's AIX
Red Hat will also sit along side Windows 2000 which also has the Common Criteria certification. See the press release:
http://www.microsoft.com/presspass/press/2002/oct0 2/10-29CommonCriteriaPR.asp
Remember... ZG9uJ3QgZm9yZ2V0IHRvIGRyaW5rIHlvdXIgb3ZhbHRpbmU=
Probably not.. if I understand correctly, EAL 2 costs about $200-300k, and EAL 4 can cost around $1mil
My sig can beat up your sig.
you can read about the Common Criteria here.
Unfortunately, the other site has been shut down.
I want to drag this out as long as possible. Bring me my protractor.
A profile for the evaluation, and the assurance level to which you achieve that profile.
So if your profile is essentially "can boot" you can probably achieve that with a high level of confidence. All this talk of EAL4 is pointless unless you are told what the profile is.
In the best case, this only means that RH (and Windows, for that matter) could be used in a system carrying information classified at a single level, say, "secret".
In no (normal) circumstance would either RH or Windows be used to handle information classified at two different levels, such as secret and unclassified. If you want to do that, you need to use Trusted Solaris or some other evaluated "Trusted" operating system. Getting a evaluation for a system that can label information and keep different types of information apart (B1 or B2 in DOD Orange Book parlance) is a whole different ball of wax than what RH and Windows received (C2).
Speaking as someone who works for the government and knows exactly what a Common Criteria Certification is worth, why the hell do the Red Hat people think they're going to be major players by getting certified to EAL-2? I mean, seriously, *anyone* can get EAL-1, so they put just a tiny bit more effort (and dough) into it to get EAL-2, when competing operating systems like Windows and Solaris are EAL-4. No one is going to take them seriously with just an EAL-2. And that explains why it'll be done by the end of the year. And by the way, the CCC is a bunch of BS that tells you absolutely nothing about how secure a system is. For the government, it just dictates what you can and can't buy.
Note that EAL2 is something that provides essentially no assurance of security. You can find details of this in Google's cache (www.commoncriteria.org is no longer alive).
EAL4 is the highest Windows, or any other commercial off-the-shelf application will ever get. Anything higher requires design verification from the planning stages and is intended for custom built applications for specific purposes.
...here, look at the column under "Criteria". Be careful not to slashdot it - note the .mil domain ;)
C|N>K
SLS was the first distro.
Yggdrasil was the first Linux vendor to have a commercial CD-ROM distribution. Fall of '93.
There's an InfoMagic 'UNIX' CD that had a kernal 0.99.10 on it from July of '93.
Some of us were there.
Actually Slack was the first distro
No it wasn't. SLS was the first linux distro.
No it wasn't. SLS was the first linux distro.
Not even close. The first Linux distribution was H.J. Lu's boot/root floppy combo, and I think even MCC+ came before SLS.
The biggest drawback is that they're getting certified in the UK! Even if they were to change and go for an EAL3 or better it would be illegal to use in the US for classified processing until it is tested by a US sponsored evaluator. Talk about your Catch-22's.
You hit the nail on the head there - unfortunately it seems no media has even attempted to understand the basics of CC, when reporting on this...
A CC certification consists of two parts:
An "assurance level", and either a "security target" or a "protection profile".
A protection profile is a sort of a "standardized security target". A description of a number of requirements that you evaluate your system against. Whereas, a "security target" is something you yourself write, if you do not want to certify your system against an existing protection profile.
NSA has submitted protection profiles that are roughly equivalent to TCSEC C2 and TCSEC B2; the CAPP and LSPP protection profiles, respectively.
SuSE got an EAL-2 certification against some security target that they themselves wrote. This means, they are "fairly" sure that their system does roughly what's in the security target (that they wrote). Had they gotten an EAL-7, it would only mean that they were "very confident" that their system did what was in their security target. It would say nothing about the completeness or even relevance of their security target.
Some newer versions of windows got an EAL-4 against the CAPP. This can be seen roughly as equivalent of the old C2 certification.
Trusted Solaris also has an EAL-4. However, they have an EAL-4 against the LSPP, which means something roughly equivalent to the TCSEC B2 certification.
People, there is a world of difference between those two EAL-4 certifications!
One should note though, that NSA writes in the LSPP that it is not intended for systems that should be used in 'hostile' environments or even with malicious users. The internet, for example, can hardly be classified as a 'friendly' environment.
This is interesting, as virtually no systems that are connected to the internet today have anything even remotely resembling the functionalities mandated by the LSPP, not to speak about assurance levels...