Common Criteria, the Rainbow Series and Windows 2K

Windows 2000 was awarded the Common Criteria Certificate.  This
is the first Microsoft Operating System to receive such a prestigious
certification putting it on the same level as SecureOS Solaris Unix,
both built on an operating system that has been around for over thirty
years.  This document will explain what the Common Criteria Certificate is, how a vendor achieves it and why a vendor would want it.

Common Criteria is based on the idea of a sound way of evaluating the security of an operating system.  Common Criteria has evolved over the years.  Security evaluation criteria goes back to the ‘70’s.  The
first standard for this criteria was published in the United States
Trusted Computer Systems Evaluation Criteria (TCSEC), the “Orange Book.”  It was published in 1985 by the National Security Agency.  Europe
came up with similar standards in an effort to create an international
standard called Information Technology Security Evaluation and
Certification (ITSEC) in 1991.  This led to the CC Editorial Board (CCEB) which was formed establishing globally recognized standards for security evaluation (dinopolis).  Each country has its own organization that enforces and advertises these international standards.  In the United States,
both the NSA and the National Institute of Standards and Technology
meet the security and testing needs of Information Technology producers
and consumers.  They do this through a joint program called the National Information Assurance Partnership (NIAP).  The responsibilities of these organization are outlined in the Computer Security Act of 1987 (epic).

In order for a vendor to be awarded the Common Criteria Certification it must pass all required tests for a security certification accepted in 15 countries.  There
are three parts to the CC: 1) Introduction and general model, is the
introduction to the CC. It defines general concepts and principles of
IT security evaluation and presents a general model of evaluation.  2)
Security functional requirements, establishes a set of security
functional components as a standard way of requirements for Targets of
Evaluation (TOEs).  3) Security assurance
requirements, establishes a set of assurance components as a standard
way of expressing the assurance requirements for TOEs (CRYPTIC).

Common Criteria is essential particularly in these times of heightened Information security awareness.  The CC Certification is verification that the operating system has met a specific level of security.  Consumers
are more likely to purchase an operating system that is internationally
accredited than one with just a good reputation.

This certification took Microsoft three years and millions of dollars to attain.  Very few companies have the time, money and resources to reach this level security.  According to Microsoft they obtained the Common Criteria “because its evaluation and certification process helps consumers make informed security decisions (Microsoft).”

Works Cited

Dinopolis. Common Criteria History. 11 May 2001. http://www.dinopolis.org/documentation/misc/theses/hhaub/node78.html

 NIAP. Common Criteria Evaluation Verification Scheme.

http://niap.nist.gov/

 Electronic Privacy Center. Computer Security Act of 1987. http://www.epic.org/crypto/csa/

 Microsoft. Windows 2000 achieves the Common Criteria Certificate. 29 Oct 2002.

http://www.microsoft.com/windows2000/server/evaluation/news/bulletins/cccert.asp#top

Radium. The Rainbow Series Library. 28 June 2000.

http://www.radium.ncsc.mil/tpep/library/rainbow/

Digg This