🚀 go-pugleaf

rodgers@engcon.marshall.ltv.com (KMRODGERS) writes:

>All of this talk about NT's level of security misses a very important point:
>The OS itself has no security rating.  ONLY hardware/software combinations
>are security rated.  It makes no sense to talk about an OS having a C2 or
>whatever rating.  A computer _system_ is rated -- not an OS.

Geez.  What whingeing!

Orange book ratings used in general computing are overkill.
Basically, I think that non-defense users are looking at two or three
categories: unsecure and generally secure.  The protection that's
desired is protection against malicious or ignorant attacks on the
integrity of the system.  ACLs on the file system and device drivers
provide this, and ACLs are provided at the C2 level.

Hence - I want C2 from my operating system.  I'll provide physical
security, and if anybody wants to steal my data by monitoring
electromagnetic emissions - Hey, more power to 'em.
-------------------------------------------------------------------
Terry Kane (terryk@cc.gatech.edu)
-------------------------------------------------------------------
I am a .sig file virus. Copy me into your signature file please.

In article <terryk.711987309@cc.gatech.edu> terryk@terminus.gatech.edu (Terry Kane) writes:
>
>Orange book ratings used in general computing are overkill.
>Basically, I think that non-defense users are looking at two or three
>categories: unsecure and generally secure.  The protection that's
>desired is protection against malicious or ignorant attacks on the
>integrity of the system.  ACLs on the file system and device drivers
>provide this, and ACLs are provided at the C2 level.
>
>Hence - I want C2 from my operating system.  I'll provide physical
>security, and if anybody wants to steal my data by monitoring
>electromagnetic emissions - Hey, more power to 'em.

Sorry to disappoint, but C2 does not requires ACL's for devices.  That
is a B1 feature.  C2 is the _minimal_ level of security that provides
even a reasonable level of security in the face of an attack.  

Nevertheless, your point about orange book ratings typically being
overkill is correct.  Even something as "wimpy" as C2 can be extremely
limiting in a shared computing environment.  Unfortunately, Msoft is
setting up NT as being a replacement for server-type OS's at large
sites.  As a result, I guess they felt that they would have to make
some noise about security issues to sound like they knew what they
were doing.  However, they started saying C2 before they apparently
knew what was involved, then backpedaled on it saying that the government
(NCSC) was moving too slowly.  Given that the pre-beta SDK just shipped
doesn't even include the filesystem, we can all tell who didn't have
their act together.

It seems that security in the orange book sense doesn't make much sense
for most folks however.  It focuses on things like loss or alteration
of information.  While these things are certainly important, for most
non-military related systems, attacks (malicious or inadvertant) that
result in denial of service are just as important.

Cheers,

David Boles

In article <1992Jul24.201426.5137@chpc.utexas.edu>, apas611@chpc.utexas.edu
(David Boles) wrote:
> 
> It seems that security in the orange book sense doesn't make much sense
> for most folks however.  It focuses on things like loss or alteration
> of information.  While these things are certainly important, for most

I think loss or alteration of information is very important for most folks.
 Computer related fraud is a multi-billion dollar problem.  If businesses
took security a bit more seriously, they could probably prevent a fair
amount of the fraud.  Unfortunately, most corporations either unwilling to
pay the price it takes or don't have the personnel who understand security
issues.

> non-military related systems, attacks (malicious or inadvertant) that
> result in denial of service are just as important.
> 

Denial of service is important but something like that is detectable.  The
important problem is to make sure your "enemy" doesn't get access to
important information without you knowing about it.  This issue is relevant
in the corporate setting.  With the cold war over, there have been numerous
reports of various corporations and governments spying on foreign
businesses and business personnel to get trade secrets.  

-------------------------------------------------------------------------
Heeren Pathak                      | Television is a device that permits
pathak@mitre.org                   | people who haven't anything to do to
Mitre Corporation                  | watch people who can't do anything.
(617) 271-7465                     |	               	-- Fred Allen
-------------------------------------------------------------------------
Disclaimer: Mine not Mitre's.