Slashdot Mirror
Red Hat Pushes For CC Certification By Year's End
Ridgelift writes "This article indicates Red Hat Linux is about to receive certification under the Common Criteria (CC) Scheme worldwide. This has been a long road for Red Hat, and 'once successfully certified in the UK, Red Hat products will be recognised as certified and approved by information security agencies from all 19 countries participating in the Common Criteria program.' This means Red Hat will sit alongside Sun Solaris, HP-UX and IBM's AIX."
This means Red Hat will sit alongside Sun Solaris, HP-UX and IBM's AIX
Red Hat will also sit along side Windows 2000 which also has the Common Criteria certification. See the press release:
http://www.microsoft.com/presspass/press/2002/oct0 2/10-29CommonCriteriaPR.asp
Remember... ZG9uJ3QgZm9yZ2V0IHRvIGRyaW5rIHlvdXIgb3ZhbHRpbmU=
Does anyone know if SuSE/Novell is pursuing this same certification?
Probably not.. if I understand correctly, EAL 2 costs about $200-300k, and EAL 4 can cost around $1mil
My sig can beat up your sig.
We're looking to use it in some places, but wasn't able to think of it until we found out it was going through certification.
It mightn't mean much to some places, but for government organisations, it's a big step to getting it in more places than just using it for "development toys".
This is another way of legitimizing Linux in the corporate world. Despite Red Hats recent business decisions over all this is a very strong/smart move for all Linux users.
you can read about the Common Criteria here.
Unfortunately, the other site has been shut down.
I want to drag this out as long as possible. Bring me my protractor.
Red Hat couldn't have pulled this off without technology stolen from SCO. It's a known fact that SCO owns IP on everything that makes linux useful.
drip...drip...
Excuse me, I've got sarcasm dripping from my chin...
One more useless qualification-paid-for-sign-dotted-line.
;-)
People should really get it through their skulls that this is not going to help and that talent may not be in their brokerage system already when looking for it (and so they miss out).
One more example of commodifying the _wrong_ thing. Can pay in the short term but ughugh the longer term....
When something happens, formalizing it usually means restricting it from "just" happening further. Mkay
From the original February discussion. This has even more relevance now. ...
..., grades products based not only on their security and reliability, but also on the development and support processes that ensure quick responses to problems."
"The Common Criteria,
Does that mean that the US Gov. will be officially saying that the Kernel development model is OK ?
RHEL is getting certified at EAL2, which is really weak.
Even the Windows 2000 EAL4 certification only protects against "inadvertent or casual attempts to breach the system security." No real security here. For more info, read Jonathan Shapiro's article.
KungFUnix proudly introduces CUP, Certified Unix Pimp certification. Now you too can study and memorize 50 common criteria books we select and get kickbacks from in order to achieve your goal of adding the word CUP to your signature.
NO EXPERIENCE NEEDED!
That's right act now and send us 2,000.00 (US), and we'll gladly present you with information on obtaining this new and exciting certification. So what can you do with a CUP certification:
- Impress your clueless CTO
- Impress friends
- Add the word CUP to CCNA, MCSE, or CISSP
- Use the cert for a dustrag
- Smoke a doob with the cert
shrugs Certs who needs em.MoFscker
I was just wondering whether or not other distributions can use the work that RH is doing to get a "common Common Criteria" effect. After all, they are all using the same Ring 0 piece, being the Linux kernel. After that, it should just become a matter of configuration verification...
And with the support that Linux has gotten from the NSA, through SE-Linux, I would think a lot of the in-depth work on Linux has been covered.
--Storm
A profile for the evaluation, and the assurance level to which you achieve that profile.
So if your profile is essentially "can boot" you can probably achieve that with a high level of confidence. All this talk of EAL4 is pointless unless you are told what the profile is.
In the best case, this only means that RH (and Windows, for that matter) could be used in a system carrying information classified at a single level, say, "secret".
In no (normal) circumstance would either RH or Windows be used to handle information classified at two different levels, such as secret and unclassified. If you want to do that, you need to use Trusted Solaris or some other evaluated "Trusted" operating system. Getting a evaluation for a system that can label information and keep different types of information apart (B1 or B2 in DOD Orange Book parlance) is a whole different ball of wax than what RH and Windows received (C2).
SuSE already have it.
Next question, will someone fund a community owned distro to get this certification?
(i.e. Debian etc.)
Expert in software patents or patent law? Contribute to the ESP wiki!
Speaking as someone who works for the government and knows exactly what a Common Criteria Certification is worth, why the hell do the Red Hat people think they're going to be major players by getting certified to EAL-2? I mean, seriously, *anyone* can get EAL-1, so they put just a tiny bit more effort (and dough) into it to get EAL-2, when competing operating systems like Windows and Solaris are EAL-4. No one is going to take them seriously with just an EAL-2. And that explains why it'll be done by the end of the year. And by the way, the CCC is a bunch of BS that tells you absolutely nothing about how secure a system is. For the government, it just dictates what you can and can't buy.
Note that EAL2 is something that provides essentially no assurance of security. You can find details of this in Google's cache (www.commoncriteria.org is no longer alive).
What gets me is, if it's so expensive and time consuming to do this, why not go straight for level 4 certification? Unless it was unachievable... Vendors know ahead of time if they'll pass or not, all the criteria is there for the public to review. You don't submit until you are already sure you'll pass. Obviously Linux is not EAL 4 ready. Windows 2000 is not only EAL 4 but also augmented with ALC FLR 3.
Who is going to notice an effortless to achieve EAL 2?
Security cannot be determined from simply doing a suite of tests, and determining that it must be secure if the tester was unable to break in. The biggest variable that affects security is the administration of the machines ... and this applies to all systems, BSD, Linux, Solaris ... and yes, even MS Windows. Even OpenBSD clearly states their history of security (note, they never claim that is is secure, only that it has been to a certain degree) is based on the default install. Change it in any way, and all bets are off.
Security is not a thing you can just buy. Likewise it cannot be an attribute or property of a thing you can buy (or download). Security is in how you go about every aspect of the way you work, and not just in computers and networks. Social engineering is still a very workable way to access what you are not authorized to access. Poor passwords are incredibly common, for example (spammers are now using password guessing successfully to log into SMTP AUTH and MSA mail ports to submit their garbage ... they already have your userid). People are the weak link.
So ... IMHO ... the Common Criteria Scheme is nothing more than a bunch of feel-good paperwork for PHBs. Unfortunately, it's what PHBs want to see, so vendors like Red Hat do need to play into this BS just to get some sales. But it doesn't tell you squat about real security.
now we need to go OSS in diesel cars
...here, look at the column under "Criteria". Be careful not to slashdot it - note the .mil domain ;)
C|N>K
The CC label is REQUIRED for some government computer work for which linux is perfectly suited, but until recently had to be passed up. We could use Trusted Solaris (yawn) or Win2K (barf). Then came SuSe, but we liked RedHat better. Now we will be able to have RedHat in the mix, which should keep things interesting.
It's not so much that the people who actually check the security care what OS it is... it's the people who approve the classification of information systems, etc. you know, pencil pushers, that give a shit about the Common Criteria cert on XYZ software.
I'm glad RedHat finally scrounged up some money from under the couch to remove this roadblock.
Fuck Beta. Fuck Dice
The KDE.org folks can leverage this to get Kommon Kriteria certification...