News

Opinion: Linux, Windows and the Common Criteria Security Evaluation

• By Scott Bekker
• 08/11/2003

This is a criteria for some government purchasing, especially in the U.S. Department of Defense and other government agencies worldwide with serious and legitimate concerns about software security. For the rest of the IT community, the stringent Common Criteria evaluations serve as bragging rights -- a sort of stamp of approval by some of the most paranoid users on the planet.

In IBM's view, the step to certify a version of Linux "challenges the view of many skeptics that open source systems could not withstand such testing due to the difficulty of establishing process in an open-source environment." Actually, establishing process will be more challenging in EAL3+, which IBM has vowed will be the next step to achieve for SuSE Linux, as well. But IBM knows what it's getting into. The moves with SuSE Linux are only one step in Big Blue's existing effort to offer Common Criteria evaluated operating systems across its eServer line.

Should you find yourself in an argument about the relative security of Windows 2000 versus Linux and have this new Linux security rating thrown at you -- two quick points. First, Windows 2000 achieved in late 2002 the EAL4+ rating, which is more stringent than even the EAL3+ rating that IBM is eyeing next for SuSE Linux. Second, this certification involved SuSE Linux Enterprise Server 8 only -- it says nothing about the security of Red Hat or any other distribution of Linux.

In the end, this is a great move by IBM and SuSE. The more software that get puts through an independent testing process and has accessible documentation for repeating the lockdown, the better for users. So far, the list of operating systems to achieve EAL4+ include Windows 2000 Professional, Server and Advanced Server and IBM AIX 5L. HP-UX 11i and Sun Solaris 8 are rated EAL4, and SGI IRIX/CMW is rated EAL3.

Let's hope we see more announcements like this soon -- from Microsoft for Windows XP, Windows Server 2003 and SQL Server, and from Red Hat and other Linux vendors.