Hi,
> So you can have a C2 TCSEC eval or C2 TNI eval or a C2 TDI eval. We are
> in a B2 TNI eval and our partner is in a B2 TDI eval on top of ours. And
> yes, I believe that C2 NT includes IP, but does not include the floppy disk
> and lots of other real world things.
Since C2 doesnt require verifying the code (which is nearly impossible
anyway), C2 only covers how it 'should' ork, not how it 'does' work. This
means buffer overruns, shell escape and all that stuff introduced by bugs
will not be covered from C2 Certification.
I thin B recommendation are slightly more detailed in verifying
implementations, right?
Greetings
Bernd
--
(OO) -- Bernd_Eckenfels @
Wittumstrasse13 .
76646Bruchsal .
de --
( .. ) ecki @
lina .
{inka .
de,ka.sub.org} http://home.pages.de/~eckes/
o--o *plush* 2048/A2C51749 eckes @
irc +4972573817 *plush*
(O____O) If privacy is outlawed only Outlaws have privacy
Follow-Ups:
References:
|
|
