Secure Linux OS seeks global dominance
The scarcity of security companies peddling enterprise-class wares at LinuxWorld could mean that the job of making Linux definitively more secure than its proprietary counterparts will owe more to initiatives in Washington, DC, than Silicon Valley innovations.
Overall, the products on hand lacked the originality and brand-name clout needed to wow enterprises. In the end, a development effort with the aim of making Linux a staple of governments worldwide may be what most convinces big business that the OS is secure and enterprise-worthy. The National Security Agency gave open-source software an initial boost when it pioneered the security-enhanced Linux OS (SELinux) prototype a year ago, but today universities are picking up the torch. The focal point of the current open source security push is the Cyberspace Policy Institute (CPI) at The George Washington University, which is spearheading the Project E-Government Operating System (EGOVOS). At an EGOVOS conference session at LinuxWorld, panel members made clear just how ambitious their project is. Their goal? Make Linux bulletproof and governments will be compelled to adopt it.
Mandatory access control
The lynchpin in SELinux security is mandatory access control, a method that NSA championed as early as October 1998 in a white paper on computer security failures. The problem is, mandatory access control systems can't do a thing if they don't have rules to follow. Having your developers write all those rules would be cumbersome to say the least, a fact not lost on CPI.
Panelist Mark Westerman of Westcam certainly doesn't think that SELinux rollouts have to be rocket science, even though he has overseen such projects at NASA. For future adaptors, he said, an upcoming graphical policy editor is expected to make rule development process easier.
As Westerman tells it, Linux security could indeed one day be a cinch. After one of his clients suffered an attack on a Linux DNS server resulting in a buffer overflow, he did the unthinkable: He didn't patch it. He put SELinux's mandatory access control in operation, and watched while the hackers continued to probe the server, but were unable to execute any code. The end result of a fully developed and audited SELinux, says Westerman, will be "military-grade security at open source cost."
International certification
Contrary to NSA's humble aspirations for SELinux, which its Web site says was "not intended as a complete security solution for Linux," CPI has a bit more in mind. CPI intends to have Linux code independently audited and ISO 15408-certified, a certification that Microsoft may soon receive for Microsoft NT 4.0, SQL Server 2000, and Windows 2000, based on evaluations performed by SAIC. That sounds quite a bit more ambitious than NSA, which didn't even claim that SELinux was an attempt to correct potential security flaws in the Linux OS.
The ultimate goal of international certification, said panelist John Viega of SecureSoftware, is to have accredited open-source software on every desktop inside of five years. Viega isn't just talking about the U.S., where proprietary software is king--he literally means everywhere. The U.S. Department of Defense's open source efforts are a good sign, says to Viega, but the ultimate goal for a secure Linux OS, says EGOVOS Founder Tony Stanco, is global. The anticipated inroads will be achieved with overseas governments, that have a lot to gain (or, rather, save) by sidestepping proprietary software's licensing fees. Don't expect Microsoft to take this sitting down.
How Linux might gain international acclaim might be a little clearer come October, when CPI co-hosts a conference on e-government and open-source software. If governments respond and take the Linux plunge, enterprises are likely to follow suit to improve their security. Then open-source advocates all over can reminisce together, "remember that 'trustworthy computing' campaign?"
Do you think a security-enhanced Linux OS can really end software vulnerabilities once and for all? Talkback to us.