Re: [Xense-devel] Regarding security parameters..

[Markus Kuhn <Markus.Kuhn@xxxxxxxxxxxx>]

"Praveen Kushwaha" wrote on 2007-01-18 11:57 UTC:
>             I have heard that the security scale from 1-7, the OSs like
> Linux, windows are at security level 4.
>             But the Xen is claiming for security level 5. 

Security is not a scalar. You cannot compare different product
categories unless you provide a specific application and threat model:
"Is this virus scanner more secure than this bicycle lock?" is hardly a
meaningful question, but "Should I upgrade by bicycle lock rather than
my virus scanner to lower my insurance premium?" might be.

I suspect what you might refer to is that both Windows XP and at least
two Linux distributions (the SUSE and Red Hat enterprise versions) have
been formally evaluated under the ISO Common Criteria (CC) Controlled
Access Protection Profile (CAPP) at Evaluation Assurance Level 4 (EAL4)
a few years ago. Now, the EAL4 rating has nothing to do with the
security of the product, it only characterizes the depth of the common
criteria evaluation that has taken place (e.g., how carefully the
evaluators studied the source code and documentation). To find about the
actual strength of the product that was verified during the evaluation,
and what that might mean for your particular application of the product,
you'll have to read the security target document. Examples for Windows
and Linux are

  http://www.commoncriteriaportal.org/public/files/epfiles/ST_VID4025-ST.pdf
  http://www.bsi.de/zertifiz/zert/reporte/0256b.pdf

I have not seen yet any CC security target for Xen 3.0. It would also
not be entirely clear to me, how to directly compare the security of an
operating system with that of a hypervisor, given that the two provide
rather different levels of functionality. I doubt that CAPP (the
operating system protection profile under which Windows and Linux have
been evaluated) is directly applicable to the Xen hypervisor itself,
which has at present no notion of files, users, etc. (although that
might change with the XenSE project).

Hope this helped ...

Markus

-- 
Markus Kuhn, Computer Laboratory, University of Cambridge
http://www.cl.cam.ac.uk/~mgk25/ || CB3 0FD, Great Britain


_______________________________________________
Xense-devel mailing list
Xense-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xense-devel