Windows Server 2003 Earns EAL 4 Certification from U.S. Government

Published: January 11, 2006

by Alex Woodie

Organizations concerned about the security of Windows can rest a little easier as a result of several certifications the operating system received last year that will pave the way for U.S. Government use.. In December Microsoft was awarded Common Criteria Evaluation Assurance Level (EAL) 4 for various versions of Windows Server 2003 and Windows XP by the National Information Assurance Partnership, a governmental organization that serves as an international standards body, and which was created to meet the security testing needs of both consumers and producers of IT products.

EAL 4 certification was awarded to six Microsoft products, including the Standard, Enterprise, and Datacenter versions of Windows Server 2003 Service Pack 1 (SP1), Windows Server 2003 Certificate Server, Windows XP Professional SP2, and Windows XP Embedded SP2. The products were run through more than 20 real-world tests by Science Applications International Corp (SAIC), a San Diego defense contractor.

Steve Lipner, Microsoft's senior director of security engineering strategy, said the certification underscores Microsoft's deep and ongoing commitment to the Common Criteria process, and complements advances it has made in software quality. Another participant, Franchina Luisa, who is the general manager of Italy's High Institute for Communications and Information Technology and an author of a paper published by the IEEE Communications Society, called the certifications "encouraging evidence of Microsoft's progress on security and the viability of the Windows platform in security-critical computing scenarios."

The Windows platform product certifications join previous EAL 4 certifications for Exchange Server 2003, Internet Security and Acceleration Server (ISA Server) 2004, Microsoft Windows 2000 Professional, and Microsoft Windows 2000 Server and Advanced Server. Other operating systems to achieve the EAL 4 certification in recent months include IBM's i5/OS and BAE Systems's XTS-400 / STOP 6.0.E.