From: bdubbs@cs.tamu.edu (Bruce Dubbs)
Subject: Re: OS/2 Future Trends and Directions
Organization: Computer Science Department, Texas A&M University
Date: Mon, 5 Oct 1992 02:26:33 GMT

In article <1992Oct03.214417.22227@microsoft.com> adamba@microsoft.com (Adam Barr) writes:
>In article <1992Oct2.035941.23197@tamsun.tamu.edu> bdubbs@cs.tamu.edu (Bruce Dubbs) writes:
>>In article <1992Sep30.184354.9987@microsoft.com> philipla@microsoft.com (Phil Lafornara) writes:
>>>In article <1992Sep29.172201.6487@tamsun.tamu.edu> bdubbs@cs.tamu.edu (Bruce Dubbs) writes:
>>
>>>>  It seems
>>>>that IBM has a more obvious way of implementing some of the proposed
>>>>features than MS does with NT.  Here I'm specifically refering to C2
>>>>security which is a HW/SW combination.  Is MS going to start building
>>>>hardware (besides mice).
>>>
>>>     I suspect that one Windows NT is released, Microsoft will assist
>>>hardware vendors in completing the certification process.
>>>
>>Sure, I believe MS will help the hardware vendors, but it will
>>certainly not be painless.  Have you ever seen the arguments that can
>>go on -- Its the hardware's fault  -- No, its the software's fault.
>>These are very real problems and compounding the problems by having
>>differnt companies work together will be a real feat.  If MS + Some
>>Hardware Company (tm)  pull this off in a reasonable time period, I
>>will be very impressed.
>
>
>This argument that goes, "C2 certification is a HW/SW combination,
>therefore Microsoft's claims about it are null and void" is getting
>old. 

Wait a minute. Did I say that MS's claims were 'null and void'?  I
don't think so, and if you read that into the above comments, it would
seem that you are a bit sensitive.

>Windows NT is being evaluated by the NCSC for a C2 rating. Since
>it has been designed following the guidelines for C2 security, such
>as ownership of objects and accountability for access-related actions,
>presumably it will get this rating.
>
>So, a C2 rating is a function of the software only. This is what NT
>will have and IBM is claiming OS/2 will have. The difference is
>that NT has all the software in place; all that is missing is the
>stamp of approval.
>

I don't really know the C2 certification process.  I didn't know that
the OS only could be so certified.

>C2 certification, however, does not just apply to a particular
>combination of hardware and software, but to a specific location
>or office that wishes to be certified. 

Wait a minute, you just said in the previous statement that C2
certification was software only.  Now you say its a combination of
hardware, software, and location.  (How about network interconnections
and physical computer access too?)  Your statements seem to be
contridictoy. Which is it?

By the way, since you contridict yourself, would you care to post the
source of your information?

>As you would expect you
>need software with a C2 rating. But it's not like IBM could start
>selling a system that runs OS/2 and claim it is "C2 certified";
>they could sell a system and claim it was "C2 certifiable", but
>any clone manufacturer could put NT on their systems and say
>the same thing.
>
>- adam

I never said IBM could do what you suggest.  I just said that the
process of certification would be easier for any manufacturer that
made both the hardware and the software.
--
Bruce Dubbs                   |  Oxymorons of note:
bdubbs@neuron.tamu.edu        |  Honest Politician, Political Science,
bdubbs@sadis01.sa.aflc.af.mil |  Scrupulous Lawyer