Quantifying Security
Even with all the subjectivity surrounding security, it is useful and often required to officially rate a system (or a system component) security-wise. Such ratings are assigned using standardized evaluation criteria.
The Orange Book
The U.S. Department of Defense Trusted Computer System Evaluation Criteria (TCSEC) classifies systems into four broad hierarchical divisions of enhanced security protection: D, C, B, and A, with systems in the (A) division providing the most comprehensive security. These security ratings, popularly known as the Orange Book, are as follows (note that these apply to specific components as well as entire operating systems):
* D (Minimal Protection)
* C (Discretionary Protection)
o C1: Discretionary Security Protection (products are no longer evaluated at this rating class)
o C2: Controlled Access Protection (versions of OpenVMS, versions of AS/400 and RS/6000, versions of Windows NT)
* B (Mandatory Protection)
o B1: Labeled Security Protection (for example, certain versions of each of DEC SEVMS, DEC ULTRIX, HP-UX, IRIX; Trusted Oracle 7)
o B2: Structured Protection (for example, Trusted XENIX 4.0)
o B3: Security Domains (for example, the XTS-200 system from Wang Federal, Inc.)
* A (Verified Protection)
o A1: Verified Design (examples include the Boeing MLS LAN and the Gemini Trusted Network Processor, both of which are network components)
o Beyond Class (A1)
For more details, refer to Department Of Defense Trusted Computer System Evaluation Criteria.
Common Criteria for IT Security Evaluation
In June 1993, U.S., Canadian, and European organizations behind various security criteria started the Common Criteria (CC) project to evolve into a single, internationally accepted set of IT security criteria. Refer to the official web site of the CC project for details. The CC rating scheme consists of the following evaluation assurance levels, or EALs (approximate Orange Book equivalents are in parentheses)
* EAL 0: Inadequate Assurance (D)
* EAL 1: Functionally Tested
* EAL 2: Structurally Tested (C1)
* EAL 3: Methodically Tested and Checked (C2)
* EAL 4: Methodically Designed, Tested, and Reviewed (B1)
* EAL 5: Semiformally Designed and Tested (B2)
* EAL 6: Semiformally Verified Design and Tested (B3)
* EAL 7: Formally Verified Design and Tested (A1)
Regarding backwards compatibility, the CC objective states that: "The CC EALs have been developed with the goal of preserving the concepts of assurance source criteria so that results of previous evaluations remain relevant. [Using the approximate equivalents] general equivalency statements are possible, but should be made with caution as the levels do not drive assurance in the same manner, and exact mappings do not exist."
Examples of some CC ratings are as follows:
* Apple: No evaluations
* Linux: EAL 2, for Red Hat Enterprise Linux 3, February 2004
* Linux: EAL 3+, for SuSE Linux Enterprise Server V8, Service Pack 3, RC4, January 2004
* Solaris: EAL 4, for Solaris 8, April 2003
* Solaris: EAL 4, for Trusted Solaris 8, March 2004
* Windows: EAL 4+, for Windows 2000 Professional, Server, and Advanced Server with SP3 and Q326886, October 2002
A '+' indicates that the system meets some, but not all, requirements of a higher rating.
