News

Microsoft Issues a Self-Report Card on Common Criteria for Servers

• By Scott Bekker
• November 17, 2004

The criteria are 16 standards that each new member of Microsoft's 2005 server family is supposed to hit. Compliance is considered at the product definition phase and measured at the time of the first beta test release and prior to launch. Many of the standards are designed to make Microsoft's server products more similar to ensure that IT skills and tasks on one Microsoft server product translate to all other Microsoft products in the family.

Microsoft published its first report on Tuesday for one beta product, SQL Server 2005, and three shipping products: Microsoft Operations Manager 2005, Virtual Server 2005 and Live Communication Server 2005.

Of the 16 standards, the SQL Server 2005 beta satisfies them all, Virtual Server meets only half, Live Communication Server meets 11 and MOM meets 12, according to the Microsoft report.

The criteria are .NET Connected Logo Program, 64-bit support, support for multicore processor technology and licensing, core training and training roadmap at launch, adoption of secure software development guidelines, hot patch technology support, Windows/Microsoft Update support, production implementations prior to launch, Windows Server 2003 Logo certification, customer feedback loop, MOM 2005 Management Pack support at launch, scripting support for operations, Virtual Server support, a standardized installer, product upgrade roadmap and guidance, and standard packaging and licensing.

Exceptions to the standards at release can only be approved by the Server and Tools Business executive leadership team, according to a Microsoft white paper about the criteria. "The process for granting exceptions is rigorous," the white paper states. "STB executive leadership has the authority to stop or delay release of a product for non-implementation of Common Engineering Criteria."

Several of the exemptions granted for this first round of 2005 releases appear to stem from timing problems, in which the criteria depend on the existence of a Microsoft technology that wasn't ready in time for the product's ship date.

For example, all three shipping products have exemptions on the criteria of 64-bit support, and the report card indicates delivery will have to wait until the next full release after Windows Server 2003 Service Pack 1 64-Bit Edition. A similar situation exists for all three shipping products on hot patch technology support, Windows/Microsoft Update Support and, for Live Communication Server, Windows Standard Logo certification and customer feedback loop (Watson 2.0).

The requirement that the products include scripting support for operations is proving to be a difficult one, with MOM and Virtual Server both partially supporting it. Meanwhile, Microsoft vows that Virtual Server will meet the Windows Server 2003 Logo certification requirement at the standard server level with the first service pack and at the enterprise level with the next release. The code, acquired from Connectix in pre-release form, is currently unable to support 3 GB of memory or host clustering.

For more details of the Microsoft common criteria and each product's progress, visit www.microsoft.com/windowsserversystem/cer/report.mspx.