Eight of Microsoft’s widely used applications now have the highest assurance level for information security thought possible for commercial products, a security expert said today. The company announced today that six varieties of Microsoft Windows Server 2003 and two varieties of Microsoft Windows XP now meet Evaluation Assurance Level (EAL) 4+ of the Common Criteria.EAL 4 probably is the highest assurance level that a complex, commercially developed product can achieve, said Helmut Kurth, chief scientist and lab director at atsec, an information technology security-consulting firm. Kurth wrote the security standards on which the Common Criteria are based. Higher EAL levels are possible only with applications that are designed initially with security as their driving force, Kurth said. EAL certifications range from 1 to 7, and 7 is the highest. “EAL 4 has become a kind of standard for all general-purpose operating systems,” Kurth said. Sun Solaris, IBM AIX and Microsoft Windows 2000 have all achieved that certification, he said. EAL 4 reasonably assures users that their operating systems, together with firewalls and other security measures, will protect them from standard attacks, Kurth said. You can read the complete article at FCW.comPosted by NIST.org on Wednesday 14 December 2005 - 22:40:21 | |  | 
