Several of Microsoft Corp.’s Windows platform products have achieved a Common Criteria certification of 4+, a rating that bolsters their profile among government and other vertical-market customers that have high-security needs for IT products, a company spokesman said Wednesday.
Common Criteria is a standard evaluation rating issued by the National Information Assurance Partnership that primarily government customers use to evaluate the security of IT products before making purchasing decisions.
Both 32-bit and 64-bit versions of Windows Server 2003, Standard Edition with Service Pack 1; Windows Server 2003, Enterprise Edition with Service Pack 1; and Windows Datacenter Edition with Service Pack 1 have achieved Common Criteria (CC) Evaluation Assurance Level 4, Augmented with ALC_FLR.3 certification, said Mario Juarez, senior product manager in the Security Technology Unit at Microsoft. The certification is more commonly known as EAL 4+, with the “+” denoting the addition of the ALC_FLR.3 certification, he said.
The highest level of the Common Criteria certification is EAL 7. Other Windows software that has been rated EAL 4+ includes Windows Server 2003 Certificate Server, Certificate Issuing and Management Components (Security Level 3 Protection Profile, Version 1.0); Windows XP Professional with Service Pack 2; and Windows XP Embedded with Service Pack 2.
Juarez said that Microsoft began the evaluation process for the Windows Server 2003 software about two years ago, and tested the products together as an end-to-end platform rather than separately because they typically will be used in that scenario. “If we say a certain security threat is going to hit a system, in our case we’re talking about the whole [Windows] platform,” he said.
Microsoft had previously reached the EAL 4 rating for Windows Server 2000, but did not test the server OS with other pieces of software that typically would run with it, Juarez added.
Russ Cooper, editor of the NTBugtraq mailing list and a scientist at security vendor Cybertrust Inc., called Microsoft’s achievement of EAL4+ “wonderful,” but questioned whether IT administrators and engineers will have to tweak Windows to achieve settings that recreate the OS scenarios that were evaluated.
“Sometimes you have to install the software and then do some things to achieve the certification, [such as] turn off insecure services,” he said. “The real question is what gyrations do you have to do to the operating system and how functional is it when you’ve done that. If [Microsoft says], ‘We’ve achieved this out of the box with a default installation,’ then that’s a big deal.”
The Windows EAL 4+ certification was not achieved by evaluating the default settings of the software, according to a statement e-mailed Wednesday afternoon by Microsoft’s public relations firm, Waggener Edstrom Inc., and attributed to Juarez.
Usually, companies customize the configuration of Windows for security purposes, according to the statement.
“Each organization has its own security policy, which necessarily requires some configuration,” the statement said. “What we’ve provided through this … certification is a set of guidance documents, templates and tools to help customers deploy systems against real-world security scenarios.”
Government customers have historically deployed a lot of Unix in their environments because of its tendency to be extremely secure, and in recent years also began using Linux, an open-source version of Unix, as another OS option. Currently, Red Hat Inc. is testing its Red Hat Enterprise Linux 4 for EAL 4. SUSE Linux Enterprise Server 9 has achieved EAL 4 certification on an IBM Corp. eServer, according to the Web site of Novell Inc., which owns SUSE Linux.
In the past few years, Microsoft has come under considerable fire due to the insecurity of Windows. As a result, the company became concerned not only with fixing Windows’ security holes, but also with customers’ perception that Windows is not sufficiently safe enough for deployments that require the highest level of security, Juarez said.
The company has made and continues to make a concerted effort to ensure Windows is more secure so customers can feel confident deploying it in any IT environment, he said. The Common Criteria EAL 4+ certification is just one result of that effort.
“Three years ago we realized we needed to step it up a bit on multiple fronts and we began to look very comprehensively at security,” Juarez said. “[Common Criteria evaluation] was not a decision we made lightly. It’s an investment of time and financial resources, and you put your product through a process that influences the development of the product. We made sure it was something customers cared about before we took that step.”
(Robert McMillan in San Francisco contributed to this story.)
