ACADEMIA

Sun Microsystems today announced that the Solaris 10 Operating System (OS) has entered into evaluation for Common Criteria certification at Evaluation Assurance Level (EAL) 4+, which is one of the highest globally recognized levels of certification for any commercial OS. Sun's comprehensive Common Criteria certification submission includes all the enterprise grade components necessary to help businesses and governments to run a highly secure OS. This announcement demonstrates Sun's continued commitment to provide customers with independent security certification, which has been a core component of Sun's products for more than 25 years. "Common Criteria Evaluation is critical for Sun to demonstrate the ability to serve our government customers," said Tom Goguen, vice president, Operating Platforms Group at Sun Microsystems. "Military, government and financial institutions demand the highest level of security, which is why we integrated over 80 percent of the functionality of Trusted Solaris into the Solaris 10 OS. They rely on Sun to provide software products and services that meet their stringent security standards." Common Criteria evaluation represents an agreed upon standard for independent certification of various security claims for IT products. The Protection Profiles and Evaluation Assurance Levels are mutually understood, agreed upon and accepted by more than 22 different countries around the world as being required for deploying technology into sensitive environments. Stepping above what is normal for the competition, the Solaris 10 OS will be evaluated against the Controlled Access Protection Profile (CAPP) and Role Based Access Control Protection Profile (RBACPP) at EAL 4+. EAL 4+ stipulates that Sun will remedy security issues found during testing. Proving its commitment to secure operating systems, Sun has offered the last three major releases of the Solaris OS -- Solaris 8, Solaris 9 and Solaris 10 -- at EAL 4 or better. Furthermore, the Solaris Trusted Extensions layered technology plans to bring multi-level security to the Solaris 10 OS by the first half of 2006. Sun plans to submit this product for CAPP, RBACPP as well as Labeled Security Protection Profile (LSPP) at EAL 4+. Currently, Sun offers the Trusted Solaris 8 OS, which carries CAPP, RBACPP and LSPP at EAL 4+. The Common Criteria testing for the Solaris 10 OS is being conducted by CGI Information Systems and Management Consultants, Inc. in Ottawa, Ontario, Canada, who also conducted the testing of the Solaris 9 Operating System. The Solaris 10 OS will be tested on a variety of systems, including SPARC processor-based servers and Sun Fire x86 (64 bit) servers powered with the AMD Opteron processor. The evaluation began in September and is scheduled to conclude in 2006. The Communications Security Establishment (CSE) is the Canadian recognition body that will be accepting the evaluation. Formal notice of the evaluation status of Solaris 10 is posted on CSE's Web at its Web site.