Slashdot Mirror

← Back to Stories (view on slashdot.org)

Justifying the Common Criteria Security Evaluation

Posted by michael on from the secure-is-as-secure-does dept.

lewko writes "Microsoft has just received a Common Criteria certification for Windows 2000 at Evaluation Assurance Level (EAL) 4. Security experts have been saying for years that the the security of the Windows family of products is hopelessly inadequate. Now there is a rigorous government certification confirming this. What does it all mean? This paper suggests that Microsoft spent millions of dollars producing documentation that shows that Windows 2000 meets an inadequate set of requirements, and that you can have reasonably strong confidence that this is the case. Microsoft bashing aside, the process in evaluating a security product is relevant to anyone considering the deployment of technology into their environment." The EROS operating systems he mentions looks interesting - of course, it also looked interesting three years ago.

3 of 168 comments (clear)

  1. Other discussions by Tyreth · · Score: 5, Informative
    This was written about on newsforge a few weeks ago. It was a link to the thoughts of Joe Wagner who wrote a rather agitating article about how Windows must be more secure than Linux, because Linux had not obtained this certification, and potentially could not possibly attain it.

    It was followed by a short lived, but lengthy discussion with regular readers of worldtechtribune (including the editor-in-chief apparently) and some other newsforge readers.

    You may or may not find some interesting thoughts, or just more (mis)information.

  2. There are real, secure, systems out there. by Animats · · Score: 5, Informative
    Check out the NSA-approved secure systems list. Operating systems have been built in the past that met reasonably stringent criteria, but few current mainstream systems are on that list.

    Vendors hated NSA's old rating process. The standards were tough, NSA did the evaluations themselves, and you only got two tries to pass. After the first evaluation, NSA told you what was wrong. If you failed on the second try, that was it - you flunked. Worst case, NSA listed your product as "Class D - This class is reserved for those systems that have been evaluated but that fail to meet the requirements for a higher evaluation class."

    Later, the process became much more "vendor friendly". Evaluations are performed by outside contractors, and vendors can submit their software over and over and over again until it passes. Microsoft used this process to push NT 4 through. It took years. The evaluation process is controlled by the vendor, and there are no public reports of failure.

    The "common criteria" are rather weak, down near the bottom of the old NSA criteria. And the evaluation process is almost totally under vendor control, although it does have to be performed by an outside contractor acceptable to the Government.

    There's better stuff out there. Currently, the most secure OS certified is the Wang XTS-300. This is certified to level B3 of the old Red Book criteria, which is about four notches above the level Windows 2000 just reached. Various FBI and DoD systems use Wang XTS-300, which is on Wang-built Pentium II and III systems. Wang is gone, but the product has been taken over by Getronics, which keeps a low profile.

    Read the data sheet for the XTS-300. It's UNIX-like, but very different inside.

    Coming soon, the XTS-400, which runs Linux apps.

    These secure systems enforce a "mandatory security" model. Data has a security level, an integrity level, and a list of compartments to which it belongs. Movement downward in security level or upward in integrity level is prohibited, as is movement out of a security compartment or into an integrity compartment. This is very restrictive, but it's the only approach known to have any chance of really working.

  3. Why you should care by joeflies · · Score: 5, Informative
    Common Criteria, in layman's terms, is a group of security requirements that state a given security product has a given set of features. It is not an easy process to get Common Criteria certified (and it isn't cheap for the vendor).

    In essence, like the author stated, many people are substituting education about security issues with Common Criteria certification. However, if the customer doesn't know what they want, or if they don't understand what Common Criteria does and DOES NOT check, then the customer still has no idea what they are getting. And like the author, I sometimes wonder if Common Criteria certification short cuts the basic security background required to write an RFP and replaces it with a check box for an EAL.

    In particular, if you work on or sell a security product and want to sell to government or the European Union, it must be Common Criteria certified. What the certification proves, however, is up to the interpretation of the person implementing the product.