Linux developer ready for scrutiny

Red Hat has submitted its upcoming release of Enterprise Linux for the Defense Department's Common Criteria Evaluation and Validation Scheme, seeking a government imprimatur that could strengthen the company's hold on the federal market.

IBM and Trusted Computer Solutions, two longtime Red Hat partners, are also involved. During the evaluation, the operating system will run on IBM servers using a variety of processors, and TCS has already released software that incorporates the enhancements to Red Hat's Enterprise Linux 5.

The operating system includes the Linux kernel and Security-Enhanced Linux, a version developed by the National Security Agency along with several companies and individuals in the Linux community.

The Common Criteria evaluation covers three protection profiles related to controlling access to information. A successful evaluation will mean that the operating system meets government security standards for assured information sharing within and across government agencies.

Red Hat announced in October 2004 that it was developing a trusted Linux in partnership with TCS. The designation applies to systems that have met certain standards and specifications. The Common Criteria certification at Evaluation Assurance Level 4 is part of that process.

Paul Smith, Red Hat's vice president of government sales operations, said the company is not planning a separate version of Linux — the security features will be a standard part of the next release.

"There have been a couple of runs at trusted operating systems in the past, but the difference between what's out there now and what we're announcing is that, in the Linux world, we'll have trusted capabilities in a standard distribution," he said. "It comes out of the box, the features are there, the [independent software vendor] support is there, and it runs on standard hardware and chip architectures."

The company is still in the early stages of the evaluation process, but Smith said he has no doubt the company will succeed.

"Common Criteria in government is one of the Holy Grails," he said. "It's a watermark for acceptance, so it's not something we take lightly. It's absolutely mandatory for us to have."

Red Hat's rival in the government market is Suse Linux, distributed by Novell. IBM has partnered with the developers of both distributions. IBM paid for Suse to get an earlier Common Criteria evaluation but appears to have picked Red Hat as the path for the future, said Tom Adelstein, a principal and open-source software consultant at Hiser and Adelstein.

"Red Hat's more popular in North America," Adelstein said. "IBM's able to sell it. They're using it almost exclusively. All the [IBM] Tivoli software runs on Red Hat."

The new certification and IBM's allegiance will only widen the gap between the Linux vendors, he said.

"IBM doesn't really go after new business, but they've got a huge customer base," he added. "They're able to go in there and replace things at a lower cost."

Adelstein said Linux has reached the critical mass it needs to continue spreading in the government. Once seen as a risky alternative to proprietary operating systems, Linux has proven to be secure, stable and technologically capable, he said.

"IBM and Red Hat don't advertise their wins, but they've been extremely successful at DOD," he said.

Red Hat launched its government division earlier this year, and it's already growing beyond expectations, Smith said. The company's recent new customers and business expansions include the CIA, the U.S. Postal Service and the Commerce Department, he said.

Echoing Adelstein's belief that Linux has come into its own, Smith said agencies are generally willing to consider the system and sometimes even seek out Red Hat.

"It's a good push and pull," he said. "The phone is ringing, but we are knocking on a lot of doors as well."

The use of Linux on desktop PCs is still relatively low, Smith said. Most Linux implementations are at the server level.

"In the [United States], most of our market still remains in Unix replacement and enterprise-level applications," he said, but the company has invested in desktop systems and is ready to expand their use.

Partners benefit

For IBM and TCS, joining forces with Red Hat is a logical way for each to strengthen its presence in the open-source market.

IBM adopted Linux as its open-standard operating system in 2003. As part of that commitment, the company opened a Linux Technology Center in Austin, Texas, said Mary Ann Fisher, manager of IBM's Global Government Industry Division.

"Security has been one the strong areas of focus for IBM over the years," she said. "We started working with various distributions of Linux, including Red Hat and what is now Novell Suse."

IBM does not serve solely as a hardware provider, Fisher added. The company collaborated with Red Hat in updating the Linux kernel so that it can support the necessary security specifications to earn trusted status.

"We continue to work with Red Hat and the open-source community, as this is an open-source community initiative," she said. "We will continue to work with them over this evaluation period to ensure that the appropriate changes are developed and integrated and available upstream."

IBM is providing servers for the Common Criteria process that run processors from Intel, Advanced Micro Devices and IBM itself.

That approach "will give the government a choice," she said. "This will be the first time the government will be able to take its trusted applications and explore using them on Linux across a wide variety of architectures."

It's a good strategy for IBM because the certification is tied to software and hardware combinations, not just the software, Fisher said.

She shared the optimism of Smith and Adelstein about the prospects for Red Hat, and Linux in general, in the government.

"We do see an evolution in the adoption of Linux in government over time," she said. "Certainly, the effort here will elevate Linux to the highest level."

TCS is providing software now that incorporates the Linux improvements so users don't have to wait, said Ed Hammersla, the company's chief operating officer.

TCS chose to partner with Red Hat because there was no trusted distribution of Linux, he said.

"Prior to this, all of our applications ran on Trusted Solaris [from Sun Microsystems], because our applications require a trusted operating system," he said. "We went looking for a trusted version of Linux and couldn't find one."

TCS will continue to support Solaris, however. Hammersla said the most likely customers for a trusted Linux will be new implementations or overhauls of outdated technologies rather than replacements of smoothly running systems.

"If somebody's made a big investment and they're comfortable with the Sun platform, there's probably not a big incentive to switch," he said.

Sun announced last week that Solaris 10 is also being evaluated for Common Criteria certification.

TCS has incorporated Red Hat's Linux enhancements into NetTop, a component of TCS' SecureOffice suite, which allows government users to access multiple secure networks from a single desktop computer while maintaining the separation of data that has typically required the use of multiple machines.

"You buy one of our apps and you get all the functionality" of the new Linux, Hammersla said. "We needed the functionality there to run our apps."

When most products enter the Common Criteria evaluation process, they "aren't functionally complete. All the code's not written yet," Hammersla said. "In this case, all of the code is written."

He said Red Hat's decision to incorporate the security features into its standard distribution was a smart move.

"It makes customers feel comfortable," he said. "Making a trusted operating system mainstream is something people have been calling for for several years. This will be the first."