Secure OS Gets Highest NSA Rating, Goes Commercial

ancientribe writes "A hardened operating system used in the B1B bomber and other military aircraft has now been released commercially, after receiving the highest security rating by a National Security Agency-run certification program. Green Hills Software's Integrity-178B operating system was certified as EAL6+, which means that it can defend against well-funded and sophisticated attackers." The company is not saying how much the OS would cost a potential customer: "The system and its associated integration and consulting services are custom solutions." Both Windows and Linux are EAL 4+ certified, which means they can defend against "inadvertent and casual" security breach attempts.

Comments

Two steps from the highest, actually

[moderatorrater]

EAL7+ means that it can defend against well-funded and sophisticated attacks and doesn't have an NSA backdoor built into it. EAL8 is exactly like EAL7+, only it can do it while getting slashdotted.

Re:Two steps from the highest, actually

[jbeaupre]

EAL9+ means it autonomously retaliates against the attacker's system.
EAL10+ means it autonomously retaliates against the attacker.

Re:Two steps from the highest, actually

[Sponge Bath]

My computer goes to EAL11!

The power of God blazes out of the box to melt the faces and explode the heads of intruders,
just like in Raiders of the Lost Mainframe.

Re:Two steps from the highest, actually

[Anarke_Incarnate]

EAL11+ means it goes to eleven. The others they go to 10, but this one goes to 11, so if you need that extra.....push off the cliff....

Worse than Dell with the Windows tax

[Anonymous Coward]

When you order a B1B, you pay for the Integrity-178B license even if you later install a copy of Linux For Strategic Bombers.

Re:Worse than Dell with the Windows tax

[rrohbeck]

When you order a B1B, you pay for the Integrity-178B license even if you later install a copy of Linux For Strategic Bombers.

Aah, I always wondered what LSB stands for.

lower that 4+

[internerdj]

Inadvertant and Casual attempts?
Oops. I tripped over my computer and hacked your system. Sorry.

Re:lower that 4+

[CorporateSuit]

"I hacked you? Sorry mate, I was just trying to play Solitaire"

Looks like we're lucky this time. Last kid that accidently played videogames with our system chose Global Thermonuclear War!

Re:Anonymous Coward

[CorporateSuit]

As much faith as I have in the NSA's security abilities, does anyone have any idea what criteria they were using exactly? Any in-depth results they've made public, preferably?

It's an aggregate result of how many social security numbers B1 bombers have lost over the last 10 years divided by how many B1 bombers, with the software installed, have been stolen out of government offices or left behind in taxi cabs.

Re:n/t

[the_other_chewey]

So basically it costs money to get EAL verified, and the farther up the scale you go, the more money it costs to run the testing.

Is Scientology somehow involved in this?

Re:n/t

[Anonymous Coward]

Don't I feel stoopid.

Especially so after you forgot to check 'Post Anonymously' the second time around...

example use

[hey]

ssh my-b1b
login: root
password: hellosss
last login Tue Nov 18 17:22:14 EST 2008 from nsa
# drop -4 bombs
# exit

Re:n/t

[ozbird]

Mathematicians are insane.

Fixed that for you.

Admittedly, mathematicians can formally prove they are more intelligent the CSers, but nobody except another mathematician could a) understand the proof, and b) give a shit.

Re:n/t

[Atario]

Higher levels require some sort of formal methods use in the design and testing. This is very unlikely to ever happen for Linux (it is virtually impossible to create a formal design retroactively; either it does not correspond to the system or it is just as complex as the system).

No problem.

1. Create black-box-style formal spec of Linux
2. Rebuild Linux from scratch using only the specs

Easy!