SUSE Linux Receives EAL3 Certification

prostoalex writes "Reporters from CNet News.com learned that SUSE Linux Enterprise Server received EAL3 certification, which allows it to compete with such certified operating systems as Windows (from Microsoft), Solaris (from Sun), HP-UX (from HP) and AIX (from IBM). Albeit all of the aforementioned OSs have EAL4 certification, Evaluation Assurance Level 3 allows SUSE Linux to be considered for a range of government and military tenders. Red Hat Linux is expected to receive EAL2 certification any time now."

Comments

Do security holes reduce EAL levels?

[G4from128k]

It would seem that documented flaws in an OS should automatically reduce the EAL rating of that OS. Otherwise the EAL process is just a paper-pushing exercise.

Re:Do security holes reduce EAL levels?

[tjansen]

Actually it is even funnier: you can not update/patch your installation without losing the certification. So if an exploit becomes known for your OS you have the choice between either running an uncertified OS or running an OS with known exploits until the patch has been certified (which can take many months).

So in reality certified OSes are less secure than an up-to-date system. But whatever, it's certified.

Re:Windows 2000 is EAL4, but...

[Otter]

Next service pack arrives it will need recertified.

And, of course, it has to be that way. quigonn, if a product had a certification that claims it's secure no matter what changes you subsequently make, how much faith would you have in that certification?