SuSE to announce Linux security certification

TalkBack 8 of 9:: Next »; « Previous

Thread View
Flat View

Let ME get this straight...: First, EAL levels 1-4 is more about documentation of audit features and processes. There is no physical inspection or testing of the actual machine. So neither certification amounts to much other than an attention to security has been thought out.

These certifications are confusing to the general corporate population to say the least. It is hard enough for governments. Any certification of this sort is mainly for work in secure or controlled locations (governments, healthcare and other companies with these needs). Many companies never use the auditing properties and would only feel unjustly ?warm and fuzzy? over such a certification. What they do not know is that they are completely useless unless you implement the features and institute other security provisions. In this case (SuSE announcement) as with many others; it is a status and selling point. But it is important to announce this at this venue since Linux news that is what it this conference is all about.

And let?s not pat ourselves on our backs for this. It is only a small, but necessary step toward a secure system. And another thing, Windows 2000 is only certified at service pack 3. The question is how many times it failed before achieving the EAL4 level (remember it is only documentation of the auditing and security process in a system). I don?t know. But more important, I don?t care. As long as it does what I ask of it at the time I ask, I really don?t care what it took to get there. Just give me the best tool for the job (now, and in the foreseeable future). But that?s just me.; Posted by: MG_z Posted on: 01/21/04 You are currently: a Guest | Members login | Terms of Use