President and COO of Sun Federal Bill Vass' Weblog

Friday Jul 25, 2008

I want to be sure to recognize the Solaris & TX engineering team and some key members of the field organization
(especially Steve Gaul, John Totah, John Weeks + others) for their tireless efforts, in guiding Solaris TX through this certification process. Special thanks to Kathy Jenks' team and Jane Medefesser for all their hard work on TX and support in moving this forward...this is just the beginning for TX!

Also, thanks to Matt Hatley, who correctly pointed out to me that my statement: "Evaluation Assurance Level (EAL) 4+, the highest recognized global security certification." is not correct. See the table and information he provided below:

Common Criteria and EAL - Terms, CC Evaluation Assurance Levels (EAL)

EAL1 Functionally Tested
EAL2 Structurally Tested
EAL3 Methodically Tested and Verified
EAL4 Methodically Designed, Tested and Verified
EAL5 Semi-formally Designed and Tested
EAL6 Semi-formally Verified Design and Tested
EAL7 Formally Verified Design and Tested

More info on Common Criteria is available here...
http://www.niap-ccevs.org/cc-scheme http://www.commoncriteriaportal.org

However, I believe that the protection profile used to get this level of certification was the strongest and most aggressive of any other operating system achieving this level of certification.

It's always important to look at the protection profile that was used to achieve a level of certification, and not just the number of the level. For example, some operating systems say they have achieved (EAL) 4+, but when you look at the detail of the protection profile, they achieved it WITHOUT being connected to a network. It's pretty simple to have an OS be secure when it's not connected to a network :-)

So what I should have said was "Achieved (EAL) 4+ with the strongest protection profile of any operating system given a rating of level 4.

Wednesday Jul 23, 2008

We’ve talked about the rigorous certification process that Solaris 10 Trusted Extensions has been undergoing for nearly a year now. Well, the end is here and I’m glad to say that Solaris 10 Trusted Extensions has achieved Common Criteria Certification for the Labeled Security Protection Profile (LSPP) at Evaluation Assurance Level (EAL) 4+, the highest recognized global security certification.

That is a mouthful, so for the non-techies out there, here is the translation: Solaris 10 Trusted Extensions can be used for Top Secret, Secret and all other program caveats in between. Solaris 10 now can be deployed by customers requiring Multi-Level Security (MLS) protection and independent validation of an OS security model - such as financial, healthcare and government institutions.

This news is quite an honor and further proves that enhanced security can be achieved through open source software development.