Tim Myers' Security Evaluations FAQ / Blog https://docs.microsoft.com/archive/blogs/timmyers/feed.xml Security Evaluations, Microsoft Security Engineering Center (MSEC), Trustworthy Computing Security Wed, 17 Apr 2019 03:27:13 GMT en-US hourly 1 Microsoft Windows Server 2008 R2 Hyper-V is now Common Criteria Certified https://docs.microsoft.com/archive/blogs/timmyers/microsoft-windows-server-2008-r2-hyper-v-is-now-common-criteria-certified Fri, 23 Mar 2012 12:39:00 GMT https://blogs.msdn.microsoft.com/timmyers/2012/03/23/microsoft-windows-server-2008-r2-hyper-v-is-now-common-criteria-certified/ Microsoft Windows Server 2008 R2 Hyper-V is now Common Criteria Certified. For details, see:

Windows Server Blog

 

]]> Microsoft Windows 7, Windows Server 2008 R2 and SQL Server 2008 SP2 Now Certified as Common Criteria Validated Products https://docs.microsoft.com/archive/blogs/timmyers/microsoft-windows-7-windows-server-2008-r2-and-sql-server-2008-sp2-now-certified-as-common-criteria-validated-products Wed, 27 Apr 2011 09:24:00 GMT https://blogs.msdn.microsoft.com/timmyers/2011/04/27/microsoft-windows-7-windows-server-2008-r2-and-sql-server-2008-sp2-now-certified-as-common-criteria-validated-products/ For details, please see the Future Fed blog post:

https://www.futurefed.com/blog/29/microsoft-windows-7-windows-server-2008-r2-and-sql-server-2008-sp2-now-certified-as-common-criteria-validated-products.aspx

]]> Windows Vista and Windows Server 2008 are on the NIAP CCEVS Validated Products List https://docs.microsoft.com/archive/blogs/timmyers/windows-vista-and-windows-server-2008-are-on-the-niap-ccevs-validated-products-list Wed, 02 Dec 2009 11:29:00 GMT https://blogs.msdn.microsoft.com/timmyers/2009/12/02/windows-vista-and-windows-server-2008-are-on-the-niap-ccevs-validated-products-list/ Microsoft Windows Vista and Microsoft Windows Server 2008 were Common Criteria (CC) validated on August 31, 2009.  The CC conformance claim is Evaluation Assurance Level 4 (EAL4) augmented with flaw remediation ALC_FLR.3 and vulnerability analysis AVA_VLA.3 (EAL4+).

 

The certificate, security target, and validation report are now available here:

https://www.niap-ccevs.org/st/vid10291/

 

A listing on the global Common Criteria Portal should appear here soon:

https://www.commoncriteriaportal.org/products.html

 

]]> Windows 7 and Windows Server 2008 R2 in Common Criteria Evaluation https://docs.microsoft.com/archive/blogs/timmyers/windows-7-and-windows-server-2008-r2-in-common-criteria-evaluation Thu, 05 Nov 2009 06:51:00 GMT https://blogs.msdn.microsoft.com/timmyers/2009/11/05/windows-7-and-windows-server-2008-r2-in-common-criteria-evaluation/ Microsoft Windows 7 and Microsoft Windows Server 2008 R2 formally entered evaluation for Common Criteria Evaluation Assurance Level 4 augmented with flaw remediation (ALC_FLR.3), commonly referred to as EAL4+. The Protection Profile in use is PP_GPOSPP_V7. This evaluation is being conducted in the USA with the NIAP Common Criteria Evaluation and Validation Scheme (CCEVS) with SAIC as the Common Criteria Testing Laboratory (CCTL). The official record may be found here:

https://www.niap-ccevs.org/cc-scheme/in_evaluation/?tech_name=Operating+System]]> Windows Server 2003 Web Edition and CC Revisited https://docs.microsoft.com/archive/blogs/timmyers/windows-server-2003-web-edition-and-cc-revisited Wed, 30 Sep 2009 14:01:00 GMT https://blogs.msdn.microsoft.com/timmyers/2009/09/30/windows-server-2003-web-edition-and-cc-revisited/ Microsoft Windows Server 2003 Web Edition is a proper subset of the Windows Server 2003 editions that were included in the Target of Evaluation (TOE) of several Common Criteria security evaluations. The Web Edition has no more security functions than the validated editions. The security quality of these functions is known. However, the Web Edition has not been validated in a Common Criteria security evaluation. The Security Target and Validation Report documents available at the NIAP CCEVS web site may be referenced to review the security properties of specific components that may be of interest to your organization.

https://www.niap-ccevs.org/cc-scheme/st/vid10184/

There is documentation available that describes the similarity of Microsoft Windows Server 2003 Web Edition to the Standard Edition.

https://technet.microsoft.com/en-us/windowsserver/bb430828.aspx

https://technet.microsoft.com/en-us/windowsserver/bb429524.aspx

]]> Windows Vista and Windows Server 2008 are Common Criteria Certified at EAL4+ https://docs.microsoft.com/archive/blogs/timmyers/windows-vista-and-windows-server-2008-are-common-criteria-certified-at-eal4 Wed, 23 Sep 2009 14:13:00 GMT https://blogs.msdn.microsoft.com/timmyers/2009/09/23/windows-vista-and-windows-server-2008-are-common-criteria-certified-at-eal4/ Microsoft Windows Vista and Microsoft Windows Server 2008 received their Common Criteria (CC) certificate on September 23rd at the 10th International Common Criteria Conference in Tromsø, Norway.  The CC Evaluation Assurance Level is 4 (EAL4+). The target of this evaluation supports a rich set of real world features, roles, and scenarios for customers in the enterprise IT, international government, military, and intelligence community markets. 26 member nations recognize CC as a security standard for information security and assurance.

 

The evaluation was conducted by S.A.I.C. as the CC Test Laboratory (CCTL) and the U.S. Department of Defense (DoD) National Security Agency (NSA) National Information Assurance Partnership (NIAP) Common Criteria Evaluation and Validation Scheme (CCEVS).  Official details about the certificate, security target, and validation report will be posted to www.commoncriteriaportal.org soon.

]]> Microsoft Windows Server 2008 Hyper-V Role is now Common Criteria Certified at EAL4+ https://docs.microsoft.com/archive/blogs/timmyers/microsoft-windows-server-2008-hyper-v-role-is-now-common-criteria-certified-at-eal4 Wed, 23 Sep 2009 14:05:00 GMT https://blogs.msdn.microsoft.com/timmyers/2009/09/23/microsoft-windows-server-2008-hyper-v-role-is-now-common-criteria-certified-at-eal4/ Microsoft Windows Server 2008 Hyper-V Role has successfully completed validation against the Common Criteria at Evaluation Assurance Level 4 augmented by ALC_FLR.3 Flaw Remediation (EAL4+). The German Bundesamt für Sicherheit in der Informationstechnik (BSI) – Federal Office for Information Security – conducted the evaluation, the first such evaluation of Microsoft Windows by the German Evaluation and Certification Scheme.

Certification Report:

https://www.commoncriteriaportal.org/files/epfiles/0570a_pdf.pdf

Security Target:

https://www.commoncriteriaportal.org/files/epfiles/0570b_pdf.pdf

]]> Windows Mobile 6.1 Certified with Common Criteria at EAL4 https://docs.microsoft.com/archive/blogs/timmyers/windows-mobile-6-1-certified-with-common-criteria-at-eal4 Wed, 23 Sep 2009 13:53:00 GMT https://blogs.msdn.microsoft.com/timmyers/2009/09/23/windows-mobile-6-1-certified-with-common-criteria-at-eal4/ Windows Mobile 6.1 with System Center Mobile Device Manager 2008 and System Center Mobile Device Manager 2008 Service Pack 1 (SP1) have been validated at Common Criteria (CC) Evaluation Assurance Level 4 (EAL4). The CC evaluation was conducted by Stratsec as the CC Test Laboratory and the Defence Signals Directorate (DSD) Australasian Information Security Evaluation Program (AISEP).

 

This certification is good news for international government and enterprise customers in the 26 CC member nations. You can now take advantage of Windows Mobile 6.1 and the System Center Mobile Device Manager 2008 with their known and proven security features and assurance properties.

 

Official details about the certificate, security target, and validation report will be posted to www.commoncriteriaportal.org soon.

]]> Does Microsoft plan to evaluate Windows 7 and Windows Server 2008 R2 under CC? https://docs.microsoft.com/archive/blogs/timmyers/does-microsoft-plan-to-evaluate-windows-7-and-windows-server-2008-r2-under-cc Tue, 04 Aug 2009 18:35:00 GMT https://blogs.msdn.microsoft.com/timmyers/2009/08/04/does-microsoft-plan-to-evaluate-windows-7-and-windows-server-2008-r2-under-cc/ Q: Does Microsoft plan to evaluate Windows 7 and Windows Server 2008 R2 under CC?

 

A: Microsoft has evaluated every release of the Windows NT product family under Common Criteria, both Client and Server versions, since Windows 2000. It is currently our plan to do so for the Windows 7 and WS08 R2 releases. When we have further more detailed information, we will make it available on this blog.

]]> The Database Engine of Microsoft SQL Server 2005 SP2 Common Criteria Certification https://docs.microsoft.com/archive/blogs/timmyers/the-database-engine-of-microsoft-sql-server-2005-sp2-common-criteria-certification Wed, 08 Jul 2009 10:55:00 GMT https://blogs.msdn.microsoft.com/timmyers/2009/07/08/the-database-engine-of-microsoft-sql-server-2005-sp2-common-criteria-certification/ The Database Engine of Microsoft SQL Server 2005 SP2, Enterprise Edition (English) Version 9.00.3068.00 was validated/certified as meeting Evaluation Assurance Level 4 Augmented (EAL4+) in a CC evaluation. The certification includes verification of compliance with the U.S. NSA DBMS Protection Profile v1.1. Here is the Certification Report from the global Common Criteria Portal:

https://www.commoncriteriaportal.org/files/epfiles/0366a.pdf

 

]]>