IBM Clinches Security Certification for Linux 373
Nimey writes "IBM has gotten Linux certified under the Common Criteria specification. " What this means is that government can consider Linux when making purchasing decisions. Linux got the highest rating possible.
Alright...? (Score:1, Interesting)
So what the hell was going on before?
Just wondering.. (Score:5, Interesting)
What are the ratings and how does other common OS's score? Anybody know?
Cool ;-) IBM forked over the few milllion.... (Score:3, Interesting)
It REALLY beats closed source OS'es (for govt's) as even our own MS of America wont let us see the code because it's "dangerous". However showing the Chinese is A-OK.
Gotta makes you think: what would our gov't choose if they didnt have their hand in MS'es pocket?
Red Hat / Oracle (Score:5, Interesting)
What about BSD? (Score:2, Interesting)
Ignoring the fact that IBM markets Linux and not BSD, why haven't corporations made genuine efforts to get it accepted in environments such as the government. The article doesn't make it clear whether or not they're talking about serving or usability.
It seems to me that if they're talking about security and such, there's still a bit to be left desired. Additionally, SuSE is by no means the most standard (IMO, it's the most backward) distribution of Linux.
I'd be interested in learning why more companies don't take a look into BSD environments. The security is there. The license is TOTALLY unrestrictive. It's stable, secure, well documented and well accepted (except on
It must really be secure then... (Score:5, Interesting)
Linux in Government (Score:5, Interesting)
Safe for medical storage info ? (Score:1, Interesting)
Re:Thank you IBM (Score:4, Interesting)
Did you seriously think that they would? If so you need to share some of the dope you've been smoking. As has been said numerous times on this board: to IBM, SCO is nothing more than an annoying mosquito. They might be carrying West Nile, but they are still just a mosquito, and can be crushed or captured almost any time.
The cool part about this whole article is that with the security cert, the government could begin switching some of their offices over. It also means that organizations like hospitals (who need to be concerned with privacy due to HIPAA) can be sold on the fact that it is secure and they don't have to worry as much about some hacker stealing confidential information.
Think about it.Playing D.A. here.... (Score:2, Interesting)
At least with proprietary technology there is the promise of accoutability [*] in the product.
[*] Yes I know this would mean Microsoft. DA damnit!
Tom
Re:Can vs. Will (Score:5, Interesting)
You have big corps like IBM, HP and Dell saying, "it's ok."
You have many countries saying "It's ok, see?"
You have the US (via certification) saying "it's ok."
Seems more unreasonable to say it will never happen every other day.
Won't they need to re-cert constantly ?? (Score:2, Interesting)
CmdrTaco's real name is Jayson Blair (Score:1, Interesting)
As someone else mentioned, IBM probrably went for the cheapest testing first.
But that does not change the fact that you deliberately told an untruth.
Re:Can vs. Will (Score:5, Interesting)
Are there any secure Os's out there? (Score:3, Interesting)
Re:Can vs. Will (Score:4, Interesting)
Just because the government can consider buying Linux, doesn't mean it will.
Correct. And it's true that no one ever got fired for buying Microsoft.
But much of the Linux deployment in government up to this point has been precisely because it can be had for no official government expenditure. It's always harder to get money for projects than it is to get money to keep your existing people. Those people have been doing some testing of Linux.
Shoestring Linux projects have proven themselves to be not only cost-effective, but generally reliable and useful.
Given that prototype testing already in place, authorizing incremental purchases to add on to that base of Linux functionality is an easier decision than if were made cold, without any evidence to support.
Re:simple question for someone in the know... (Score:2, Interesting)
What, you thought government certifications mean something?
It's just beurocracy. If it means anything, it means the OS exists. Keeps them from buying too much vaporware.
Re:Can vs. Will (Score:3, Interesting)
No one gets fired, true. The powers that be simply move in a Unix admin and eliminate the Windows guy's position.
I speak from experience, on the good end of the shotgun. Unix guys can do Windows, and oh so much more.
Re:In your face! (Score:2, Interesting)
Highest Rating Possible is misleading! (Score:3, Interesting)
Windows 2K received an EAL4+, according to NIAP's evaluated product list [nist.gov]; which is *supposed* to show it was "methodically designed, tested, and reviewed". This is probably about on par with the old Orange Book (TCSEC) C3 it used to have. EAL4 does "not require substantial specialist knowledge" and is the "highest level in which it is likely to be economically feasible to retrofit in an existing product line." It's intended that an EAL4 system shows "low-level design for the Target of Evaluation (ToE)"; with testing that supports "independent search for obvious vulnerabilities."
That being said, having an EAL2 or EAL4 will probably not get you into a job that involves holding classified data.
All of this is accessible from , the CC website [commoncriteria.org].
Re:Just wondering.. (Score:4, Interesting)
Re:The obligatory flamebait defending the facts (Score:3, Interesting)
This is good news allaround no matter wich OS you fancy. It levels the playing field. For the end consumers competition is always good, the price fighting between airlines means that the ticket prices drop and that more choice is available (super cheap vs service)
Now MS can't simply rely on getting the big contracts hopefully, as we have seen in munich this can force MS to offer huge pricecuts. For goverments the less they spend on software the less taxes you have to pay. Good news no?
Re:Thank you IBM (Score:3, Interesting)
IBM probably started the process years ago. Note that it's only the IBM/SuSE distro that's certified (I'm guessing). Other companies should probably look into it. The article doesn't say how much it cost IBM, but I bet it wasn't cheap!
Government requiring LSB distribution too! (Score:4, Interesting)
Better still the Defense Information Systems Agency is recommending that any Linux purchase support the LSB [gcn.com] and that apps be written to the LSB.
So, not only is it now easier for government agencies to support Linux deployments, but they are going to force any Linux distributor doing business with the government into interoperability.
The problem with Linux and Common Criteria (Score:2, Interesting)
Re:Can vs. Will (Score:4, Interesting)
Nope. [google.com]
Re:What about BSD? (Score:2, Interesting)
Using your updated command, I see that on a testing machine, there are about 14,000 packages available. For this little test to be fair, we need a BSD person to do something similar. I still believe the notion of my original post is correct though. The amount of available software is the biggest factor in most choices these days.
Cheers!
This is incorrect maybe (Score:3, Interesting)
In a article [cnn.com] on CNN it is reported that the Common Criteria organization, an international technology standards body, certified Linux for the first time on "mission critical" computers, including those in America's top-secret spy agencies and those used to deliver ammunition, food and fuel to soldiers.
While only certified for Low to Moderate security Linux is still under testing for higher security ratings. IBM says this is good since it gives them a footing in a area that has been dominated by Windows sales. Of note is the fact that IBM paid over $500,000 for testing and was also supported and jointly by SuSE
Re:Alright...? (Score:2, Interesting)
Windows 2000 has a "CAPP/EAL4" certification, not "EAL4". The CAPP part means that the OS provides "a level of protection which is appropriate for an assumed non-hostile and well-managed user community requiring protection against threats of inadvertent or casual attempts to breach the system security". That means the certification becomes meaningless the moment you connect a W2K box to the Internet. It is not certified at all while connected to the net.
By contrast, Linux is non-CAPP "EAL2+" certified, even when connected to the Internet.
You need to know the CC to know what this means. (Score:3, Interesting)
The biggest thing to remember about the CC is that the level rating is relatively meaningless without considering the protection profile. The problem is vendors don't readily tell you the protection profile they use.