Security-evaluated Operating System

Security-evaluated Operating System

In computing, security-evaluated operating systems have achieved certification from an external security-auditing organization, such as a B2 or A1 CSC-STD-001-83 "Department of Defense Trusted Computer System Evaluation Criteria" or Common Criteria (CC) certification.

Note that meeting a given set of evaluation criteria does not make a computer operating system "secure".

Certificates do not endorse the "goodness" of an IT product by any organization that recognizes or gives effect to the certificate. A certificate represents the successful completion of a validation that a product met CC requirements for which it was evaluated/tested.

Note that certification applies to a particular configuration of the system running on a certain set of hardware; the certificate is only valid for this specific configuration, and does not extend to the same software if any aspect of the installation varies in any way. Often these scenarios are extremely limited compared to the normal environments in which computer operating systems usually run.

Moreover, the field of operating systems which can apply to be evaluated is restricted to those with strong financial backing, because of the costs that ensue. In general, major vendors get listed, while this does not mean that other solutions, such as open-source solutions, couldn't reach or exceed this level of security under certain circumstances, without even having tried to pass this advocacy evaluation.