Tell me more ×
IT Security Stack Exchange is a question and answer site for IT security professionals. It's 100% free, no registration required.
up vote 4 down vote favorite

Are there any? What are their names? Are they publicly available/downloadable/installable?

Thank you!

share|improve this question
3  
Sadly, the only real answer is that there aren't any. It appears to be impossible to mathematically prove that one can ever be that secure. All you can do is aim for "secure enough" and that will depend on requirements. See @Graham's answer for one considered very secure. – Rory Alsop♦ May 20 '11 at 7:04

2 Answers

up vote 12 down vote accepted

The OKL4 Verified microkernel has passed the most stringent of Common Criteria evaluation assurance levels (EAL 7). Even this doesn't mean that it's "secure", "100% secure" or "more secure", it just means that it has been formally proved that the microkernel's implementation is compatible with the security model defined by the vendor.

Such a security model will contain assumptions about the environment and mode of operation of the software that may not be consistent with your environment. Taking a different example, when the Target of Evaluation is a commercial operating system the model usually assumes that all of the operators are benign and that any remote system to which the evaluated device is connected will also be consistent with the security model of the ToE.

share|improve this answer
1  
Perfect answer! As a side note, when OSes are evaluated, it's the Trusted Computing Base that gets verified by things like common criteria - not the whole OS. The TCB is the core set of highly privileged functions and security protection mechanisms that are used by all peripheral parts of the OS. The idea is that you're only as secure as your TCB, but that doesn't mean that crazy stuff can't be happening outside of the TCB, only that the evaluation mechanism (like CC) has verified that the TCB is living up to its specs. – bethlakshmi May 20 '11 at 17:51
up vote 3 down vote

How do you quantify 100% secure? No system connected to the Internet is ever 100% secure. Let's also not forget about bugs, exploits, malware, viruses, and so on. The only 100% secure system is one that is unplugged and turned off!

share|improve this answer
It's not the right example, but maybe: qubes-os.org/Home.html ? – LanceBaynes May 20 '11 at 5:47
And people. Dont forget about people, usually these are the biggest vulnerabilities... To reach 100%, you'd need to find a way to neutralize that threat. – AviD♦ May 31 '11 at 15:49

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.