Red Hat Reinforces Red Hat Enterprise Linux as a Foundation for Sensitive Computing with Common Criteria Certification, Commercial Solutions for Classified Status

Red Hat, Inc., the world's leading provider of open source solutions, today announced that Red Hat Enterprise Linux has further solidified itself as a platform of choice for users requiring more secure computing, with Red Hat Enterprise Linux 7.6 achieving Common Criteria Certification as well as Commercial Solutions for Classified (CSfC) Status. These validations show Red Hat’s commitment to supporting customers that use the world’s leading enterprise Linux platform for critical workloads in classified and sensitive deployment scenarios.

For Common Criteria, Red Hat Enterprise Linux 7.6 was certified by the National Information Assurance Partnership (NIAP), with testing and validation completed by Acumen Security, a U.S. government-accredited laboratory. The platform was tested and validated against the Common Criteria Standard for Information Security Evaluation (ISO/IEC 15408) against version 4.2.1 of the NIAP General Purpose Operating System Protection Profile and is the latest Red Hat Enterprise Linux version to appear on the NIAP Product Compliant List.

Additionally, Red Hat Enterprise Linux 7.6 is now an approved TLS Protected Server component for Commercial Solutions for Classified (CSfC) solutions and is included in the CSfC TLS Protected Servers Components List. This program, established by the National Security Agency (NSA), enables commercial products to be used in layered solutions protecting National Security System (NSS) data. More information on CSfC can be found at https://www.nsa.gov/resources/everyone/csfc/.

Red Hat Enterprise Linux and Evaluation Assurance Levels (EAL)

Previously, Red Hat Enterprise Linux operating systems were certified at EAL4+. The treaty that enables countries to recognize certifications across borders now includes a new Common Criteria Recognition Arrangement that only recognizes up to EAL2. This treaty also rewrote Protection Profiles across products to be very specific about individual product requirements, documentation and testing procedures. It is now expected that a solution either meets the Protection Profile exactly or does not.

In the previous EAL system, the number (EAL2, EAL4, etc.) distinguished the degree of rigor applied to meeting open-ended requirements. This revised certification is designed to be more predictable and better suited to an operating system with frequent minor releases like Red Hat Enterprise Linux, with future platform certifications intended to be aligned with this certification method.

Red Hat Enterprise Linux 8 and Common Criteria

Red Hat seeks to make the latest platform innovations meet the most stringent requirements for critical IT infrastructure. Red Hat Enterprise Linux 8.1 is now officially “In Evaluation” for Common Criteria certification as well.

Supporting Quotes

Paul Smith, senior vice president and general manager, Public Sector, Red Hat

“The operating system forms the heart of secure enterprise computing, from national security needs to critical biomedical research. Today’s Common Criteria certification and CSfC status for Red Hat Enterprise Linux 7.6 emphasizes our commitment to providing a more secure platform for even the most sensitive and classified workloads across the public and private IT sectors. ”

Ashit Vora, vice president, Acumen Security

“Acumen Security congratulates Red Hat on the successful NIAP Common Criteria certification of Red Hat Enterprise Linux 7.6. This rigorous security evaluation against stringent requirements identified by the National Security Agency under the global Common Criteria Certification Standard demonstrates and confirms Red Hat’s commitment to make CC certified versions of Red Hat Enterprise Linux available to security conscious customers such as the national security-related agencies, finance and healthcare verticals. We are honored that Red Hat selected Acumen Security as their security certification partner to achieve this significant milestone that few other operating system vendors in the industry have accomplished. ”