Re: Fw: [ISN] IBM earns Linux certification

[Tom <tom@lemuria.org>]

On Thu, Aug 07, 2003 at 11:29:08AM -0700, David Eaves wrote:
> Yes it's true the the door got a little wider for Linux. But first of all,
> EAL2, and EAL3 are barely adequate for e-commerce in general, and not for a
> level of threat posed to military systems in time of war, by a highly

In real life, however, most e-commerce systems wouldn't even get
EAL1 if they tried.


> EAL4 is required even for relatively ordinary protection between information
> enclaves. The CC system goes up to EAL7, which requires formal proofs of
> linkage between security targets, protection profiles, and the design and
> implementation of the products in question. The outlook even for SE-linux is

EAL7 is very much a pipe dream. I don't see how any system could ever
reach it. Definitely no existing system, you'd have to start from
scratch, with EAL7 as your main target.


> that nobody will be able to access it who is not supposed to. The Windows
> product lines already have EAL4+ (what the plus means I don't know) versus

The plus usually means they also satisfy one or more requirements of
the higher level.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.