Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

For an army project we need to know whether Windows XP, both client and corresponding server os, are c2 certified. Are they?

Are there any resources on that, like guidelines how to configure for c2 security level?

share|improve this question
add comment

2 Answers 2

up vote 1 down vote accepted

No, XP is not C2 certified, nor are any TCSEC certifications being done anymore. NT achieved a standalone (i.e., no network drivers) C2 with a specific Compaq hardware configuration. If you want a Windows client/server arrangement with even a C2 TCSEC rating, you're out of luck.

C2 (discretionary access) requirements can be met by most multiuser operating systems. Security auditing is sometimes initially missing, but has been added for these information assurance requirements. So even without the certification, you may be able to meet your project's requirements.

Meanwhile, the currently used standards are referred to as the Common Criteria. The wikipedia article is a good introduction, and the official organizational home page is here. Roughly speaking, TCSEC C2 would be an EAL4 certification, and, luckily for your project, XP and Server 2003 have EAL4 certs.

share|improve this answer
    
Thank you. I guess EAL4 is weaker than C2, as it is only based on documentation and design papers, not on testing software. –  malach May 10 '10 at 12:50
add comment

It depends on how the systems are actually configured, but yes, they can succesfully fulfill the requirements.

This link is quite outdated, but should help you anyway:

http://technet.microsoft.com/en-us/library/cc767091.aspx

share|improve this answer
    
Newer documents from MS show that XP only is "in the working" for c2 certification, but they are outdated too (more than 1 year old). Any newer information? –  malach May 10 '10 at 11:41
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.