Common Criteria

By Author: Robert Elam
Total Articles: 1
Comment this article

Windows 2000 was awarded the Common Criteria Certificate. This is the first Microsoft Operating System to receive such a prestigious certification putting it on the same level as SecureOS Solaris Unix, both built on an operating system that has been around for over thirty years. This document will explain what the Common Criteria Certificate is, how a vendor achieves it and why a vendor would want it.

Common Criteria is based on the idea of a sound way of evaluating the security of an operating system. Common Criteria has evolved over the years. Security evaluation criteria goes back to the ‘70's. The first standard for this criteria was published in the United States Trusted Computer Systems Evaluation Criteria (TCSEC), the Orange Book. It was published in 1985 by the National Security Agency. Europe came up with similar standards in an effort to create an international standard called Information Technology Security Evaluation and Certification (ITSEC) in 1991. This led to the CC Editorial Board (CCEB) which was formed establishing globally recognized standards for security evaluation (dinopolis). ...
... Each country has its own organization that enforces and advertises these international standards. In the United States, both the NSA and the National Institute of Standards and Technology meet the security and testing needs of Information Technology producers and consumers. They do this through a joint program called the National Information Assurance Partnership (NIAP). The responsibilities of these organization are outlined in the Computer Security Act of 1987 (epic).

In order for a vendor to be awarded the Common Criteria Certification it must pass all required tests for a security certification accepted in 15 countries. There are three parts to the CC: 1) Introduction and general model, is the introduction to the CC. It defines general concepts and principles of IT security evaluation and presents a general model of evaluation. 2) Security functional requirements, establishes a set of security functional components as a standard way of requirements for Targets of Evaluation (TOEs). 3) Security assurance requirements, establishes a set of assurance components as a standard way of expressing the assurance requirements for TOEs (CRYPTIC).

Common Criteria is essential particularly in these times of heightened Information security awareness. The CC Certification is verification that the operating system has met a specific level of security. Consumers are more likely to purchase an operating system that is internationally accredited than one with just a good reputation.

This certification took Microsoft three years and millions of dollars to attain. Very few companies have the time, money and resources to reach this level security. According to Microsoft they obtained the Common Criteria because its evaluation and certification process helps consumers make informed security decisions (Microsoft).

Works Cited

Dinopolis. Common Criteria History. 11 May 2001. http://www.dinopolis.org/documentation/misc/theses/hhaub/node78.html

NIAP. Common Criteria Evaluation Verification Scheme.
http://niap.nist.gov/

Electronic Privacy Center. Computer Security Act of 1987. http://www.epic.org/crypto/csa/

Microsoft. Windows 2000 achieves the Common Criteria Certificate. 29 Oct 2002.
http://www.microsoft.com/windows2000/server/evaluation/news/bulletins/cccert.asp#top
Radium. The Rainbow Series Library. 28 June 2000.
http://www.radium.ncsc.mil/tpep/library/rainbow/

About the Author Rob Elam has authors the eLamb ★ Computer security blog at http://elamb.org. He has been doing security for the Department of the Defence for 10 years and is currently a System Security Engineer in Colorado.