Path: utzoo!mnetor!uunet!husc6!bu-cs!bzs
From: bzs@bu-cs.BU.EDU (Barry Shein)
Newsgroups: comp.os.vms
Subject: Re: Help us defend against VMS!
Message-ID: <20781@bu-cs.BU.EDU>
Date: 21 Mar 88 05:57:51 GMT
References: <2814@enea.se> <4055@ihlpf.ATT.COM> <2886@enea.se>
Followup-To: comp.os.vms
Organization: Boston U. Comp. Sci.
Lines: 33
In-reply-to: sommar@enea.se's message of 20 Mar 88 17:46:32 GMT



From: sommar@enea.se (Erland Sommarskog)
>I wouldn't say that it's ridiculous. VMS 4.3, was approved for the C2 
>level of security. Unix is not even near of this.

Just for the record, Gould sells govt approved C2 Unix. C2 isn't that
hard. It's also a bad thing to throw around as a feature, people
should read what these classifications mean, particularly B and above,
I would imagine most of them wouldn't actually want this level of
security on their systems (for example, it can requre you don't allow
file sharing of any sort between users.) There's security and there's
security, you have to be careful what is being discussed, this is
spook stuff mostly, not what you might think.

Of course, certain govt agencies require these security levels,
whatever the cost to "user friendliness", and that's fine I guess,
just irrelevant to most of us who just want to feel our accounts and
files are guaranteed integrity (as opposed to foiling two enemy agents
on a system from passing data back and forth by signaling with morse
code on an enqueue flag, etc., the kind of thought that motivates the
orange book requirements.)

Also certification means that it can be operated at these security
levels, that the proper tools to do so and features have been
implemented (or not implemented, as the case may be.) There is a
definite operational requirement that the system be administered in a
certain way, it's not like it's something everyone who operates such a
system achieves by just buying it. For example, as has been said many
times, if you're on a network, you ain't secure, at least not by their
standards, not a fun restriction (secure networks can be built, but
that's not what we've all been putting in, Unix, VMS whatever.)

	-Barry Shein, Boston University