Question

Book: Computer Security: Principles and Practice, 4th Edition, Authors: William Stallings and Lawrie BrownWilliam Stallings • Lawrie Brown

Problem: 27.11(12) – When you review the list of products evaluated against the Common Criteria, such as that found on the Common Criteria Portal website, very few products are evaluated to the higher EAL 6 and EAL 7 assurance levels. Indicate why the requirements of these levels limit the type and complexity of products that can be evaluated to them. Do you believe that a general purpose operating system, or database management system, could be evaluated to those levels?

Answer 1

Yes, higher the level of EAL  as taken in the example,the higher levels limits the type and complexity of the products that can be evaluated through them as EAL 6 and EAL 7 both are formally and semi-formally designed and tested and hence the security increases.

Also, the general purpose O.S. and DBMS can be evaluated through these levels, as now a days security is one of the major issue with the developing world. We can see the modifications in O.S. and DBMS now a days, security is increasing day by day. So, we can say that O.S. and DBMS can be evaluated through these EAL levels.