Walking down a quiet street one night, a man encounters another man on
his hands and knees, desperately feeling around on the pavement. He
asks him what he's doing.
"I've lost my wedding ring," the man moans, "my wife will kill me."
"That's awful," the first man replies, "let me help you find it. Where
exactly did you lose it?"
"Over there in the grass."
"Well, why are you looking for it out here in the street?"
"The light is much better here."
The light shines very strongly on C2. The Orange Book was developed by
the Feds as a convenience for defense agencies. Along with the Yellow
Book, it provides guidance as to what set of security features should be
acquired when processing info of a specific security relevance. It was
also meant to provide requirements to OS vendors. Basically, all UNIX
vendors provide all C2 features and so does NT.
C2 is not necessarily the right question to ask for a commercial site.
C2 doesn't include my favorite feature, passwd management (Green Book).
NCSC evaluation doesn't necessarily provide any value to a commercial
organization.
Arguing the relative C2ness of an OS is probably not productive.
Wide implementation and understanding have made C2 a useful idea, but
suspect that many of these arguments over C2 are due to unrealistic
expectations.
--
Jay Heiser, 703-610-6846, jay @
homecom .
com
Homecom Internet Security Services
http://www.homecom.com/services/hiss
Follow-Ups:
|
|
