FBI supplier readies secure Linux

TalkBack 38 of 54:

Next »

« Previous

• Thread View
• Flat View

Hopefully the buyers know

Apparantly, Common Criteria is the replacement for several separately developed security classification schemes, including Orange Book. If your system met Orange Book criteria, you knew that information could not leak out very quickly and there were audit trails in place. But suppliers didn't know exactly how to meet the criteria because the book was classified!! From what I understand, auditors told suppliers that they could fix deficiencies by adding or doing certain things in the system; suppliers weren't told exactly why. (Of course, the auditors represented the same folks as the customers, i.e., military or related users.)

With CC EAL1 thru 7, the criteria appear to be more in the open. From skimming the "Common Criteria User Guide," it appears that each successive level involves increasing strict testing. But since products don't conform to the same API, it is unclear how you get an objective standard. (Not a criticism; in my neophyte mind, I just don't understand.) Hopefully the buyers really know what they are buying.

In particular, EAL4 means "methodically designed, tested and reviewed."

Posted by: asky   Posted on: 10/20/04 You are currently: a Guest | Members login | Terms of Use

Alert moderator to an offensive message

Subscribe to this discussion via Email or RSS

SponsoredWhite Papers, Webcasts, and Downloads

• Three Steps You Need to Know to Stop Data Loss Varonis Sensitive data exposed to misuse or loss... it is the stuff of nightmares ... Download Now
• Virtualization: Architectural Considerations And Other Evaluation Criteria VMware Of the many approaches to x86 systems virtualization available in the ... Download Now
• VMware Infrastructure: A Guide to Bottom-Line Benefits VMware Frustrated by the costs of maintain ever larger data centers?or building ... Download Now