IBM, Argus Systems Get EAL4+ Certification on AIX-PitBull Combo

Published: June 8, 2006

by Timothy Prickett Morgan

Server maker IBM and Unix security software provider Argus Systems have worked together to get the combination of IBM's AIX 5.2 Unix variant and the PitBull Foundation 5.0 security software certified under the Common Criteria security specification.

The PitBull Foundation software provides a layer of multi-level security for AIX operating systems, something that is lacking in AIX and, indeed, other Unix and Unix-like operating systems. PitBull eliminates vulnerabilities associated with the root or superuser account; the software also protects applications and operating systems from attacks from within a company or outside a firewall. Argus originally developed the product for Solaris, but in November 2004, the program was ported to AIX. Argus also sells a program called PitBull LX, which is a security layer that wraps around Linux or Unix applications and prevents hackers from exploiting known bugs in the application software to gain access to the systems. PitBull LX also protects sensitive information and does not allow hackers to deface Web sites. Both PitBull Foundation and PitBull LX essentially provide a finer granularity to root access than Unix and Linux themselves. PitBull LX was available for Solaris 8 and commercial Linuxes based on the 2.4 and 2.6 kernels, and now it is also available on AIX 5L 5.2.

According to Jay Kruemcke, AIX product manager at IBM, the AIX-PitBull combination has been certified at the EAL4+ level using the Labeled Security Protection profile (LSPP) of the Common Criteria. The Common Criteria certification is the result of the merging a few years ago of security standards from North American and European governments, and it is used to separate products that have demonstrated their security, as audited by expert third parties, from those products that cannot or have not attained the certification.

Incidentally, IBM tested AIX 5.2 for the Common Criteria test because when it began the certification process at the end of 2004--which was when PitBull first became available on AIX--AIX 5.3 was just starting to ship and IBM knew it was going to add a lot of functionality with AIX 5.3 in 2005. Now that the rigorous and expensive Common Criteria process is done for AIX 5.2, IBM has already begun the process of getting AIX 5.3 and PitBull certified together. IBM is not too worried about the impact being one release behind might have on sales. "Unix customers tend to be conservative, and they do not always adopt new technology too quickly," explains Kruemcke. "Moreover, many customers are willing to buy new products based on your submission for the Common Criteria certificate. They know that, given the cost and complexity of the tests, you are not going to submit to the process unless you are pretty sure you will get the security rating."