Internet Info 1994 March/Internet Info CD-ROM (Walnut Creek) (March 1994).iso/security/doc/rainbow-series

Internet Message Format | 1991-12-19 | 4.3 KB

Path: wzv!svin02!tuegate.tue.nl!sun4nl!mcsun!uunet!cs.utexas.edu!asuvax!ukma!morgan
From: [e-mail] (Wes Morgan)
Newsgroups: alt.security
Subject: Re: covert channels
Message-ID: <[e-mail]>
Date: 19 Dec 91 18:28:58 GMT
References: <[e-mail]>
    <[e-mail]> <[e-mail]>
Organization: The Puzzle Palace, UKentucky
Lines: 82
X-Bytes: 3943

In article <[e-mail]> [e-mail] (Tom Neff) writes:
>
>I mean, if B2 requires covert channels be blocked, and N different
>products make the grade and get their little gold stars etc, then
>someone thinks of a radically clever new channel! -- are all the little
>gold stars automatically revoked until the gurus catch up, or what?
>


Whenever the subject of NCSC security ratings (B1,C2, et cetera) comes up,
there's one thing you need to remember.  The NCSC certifications are given
on SPECIFIC hardware/software/physical environments.  For instance, an
AT&T 3B2/600 running System V Unix 3.1.1 with the MLS add-on might be cer-
tified as B1 *in the testing laboratory*.  As soon as I take that IDENTICAL
system and place it in my machine room, it drops all the way down to a
rating of D.  Why?  In this case, because access to the machine room (the
physical security environment) is not adequately controlled; the custodial
staff's passkeys will give them access.  Software and hardware cannot, in
and of themselves, sustain a given rating (other than D, of course).

For instance, the NCSC guidelines indicate that no site participating in
Usenet can claim a security rating; the proof is left as an exercise for the
reader.

If you're interested in the NCSC criteria, you should get a set of the
"Rainbow Series".  While the "Orange Book" is the most widely known, the
other volumes in the set are equally informative.  Here's the list:

    -- Department of Defense Trusted Computer System Evaluation Criteria
       (TCSEC), aka the "Orange Book"
    -- Computer Security Subsystem Interpretation of the TCSEC
    -- Trusted Data Base Management System Interpretation of the TCSEC
    -- Trusted Network Interpretation of the TCSEC
    -- Trusted Network Interpretation Environments Guideline -- Guidance
       for Applying the Trusted Network Interpretation
    -- Trusted Unix Working Group (TRUSIX) Rationale for Selecting
       Access Control List Features for the Unix System
    -- Trusted Product Evaulations -- A Guide for Vendors
    -- Computer Security Requirements -- Guidance for Applying the DoD
       TCSEC in Specific Environments
    -- Technical Rationale Behind CSC-STD-003-85: Computer Security
       Requirements
    -- Trusted Product Evaluation Questionnaire
    -- Rating Maintenance Phase -- Program Document
    -- Guidelines for Formal Verification Systems
    -- A Guide to Understanding Audit in Trusted Systems
    -- A Guide to Understanding Trusted Facility Management
    -- A Guide to Understanding Discretionary Access Control in Trusted
       Systems
    -- A Guide to Understanding Configuration Management in Trusted Systems
    -- A Guide to Understanding Design Documentation in Trusted Systems
    -- A Guide to Understanding Trusted Distribution in Trusted Systems
    -- Department of Defense Password Management Guideline
    -- Glossary of Computer Security Terms

A complete set may be obtained, at no cost, by contacting:

    INFOSEC Awareness Office
    Department of Defense/National Security Agency
    Attn: S332
    9800 Savage Road
    Ft. George G. Meade, MD  20755-6000

    Phone: [phone]

If you're serious about security (or just want to get down in the bowels of
the topic), I'd recommend getting this series.  The reading does get a bit
tedious, but you'll develop a keen awareness of security needs/problems.  In
addition, you'll be placed on their mailing list for new volumes in the series,
as well as updates and conference/seminar annoucements.

I understand that there is a parallel volume in Great Britain, developed by
the British analogue of the NCSC; however, I have not seen it.  If anyone
knows how to obtain a copy (either online or hard copy), please let me know.

Wes

--
 [e-mail]    |Wes Morgan, not speaking for|     ....!ukma!ukecc!morgan
 [e-mail]  |the University of Kentucky's|   morgan%engr.uky.edu@UKCC
 [e-mail] |Engineering Computing Center| [e-mail]