From: spexet@engin.umich.edu (Dennis Robert Spexet)
Subject: Re: Why people bow and scrape before NT (long)
Date: Wed, 26 Aug 92 23:51:54 EDT
Organization: University of Michigan Engineering, Ann Arbor
Distribution: world 

In article <1992Aug26.190954.28937@hellgate.utah.edu> brian%jaguar.cs.utah.edu@cs.utah.edu (Brian Sturgill) writes:
>The get a life comment was directed at you, one of those anal-retentive
>individuals that don't believe it is appropriate for a system to
>declare that it has the features of C2 (or other ratings) security.  If
>you need C2 certified I'm sure that there will be an OEM AFTER NT IS
>RELEASED that will go through the unduly hard and lengthy process that
>the government has created.  No doubt they'll earn quite a portion of
>my tax dollars by charging high prices for having to go through all the
>nonsense.

Oh my, now we are down to name-calling.  Without going into too much detail,
one of the basic reasons for having an independent firm (such as Mitre) perform
the security rating is to prevent an operating system vendor from claiming
a system security level without going through a rigorous security analysis.
The claim that MS and various people, including yourself, are propagating is
that Windows NT is secure on the C2 level.  I claim that, while MS may have
included what they claim to be C2-level security features, the system as a
whole cannot and *should not* be considered C2-secured until it is rated as
such by a firm other than Microsoft.  If one is truly serious about security,
then they will care about this rating.  Furthermore, since MS is claiming it,
then they should be able to back it up with an independent rating.  It may
be a "unduly hard and lengthy process", but I think that Microsoft has enough
money to handle the certification process.

>>Until it's rated as C2-secure by someone other than MS or yourself, then it
>>cannot and should not be trusted as such.
>
>That's correct, if you must have C2 certification, then you must wait for
>that certification.  Most places would be better served by have C2-level
>features now, and then in specific instances getting the C2 certified version
>if necessary.  I can only assume that you don't run any OS... there were
>(at least as of a year ago, when I actually cared about such things) VERY FEW
>that had been certified... can you say how many there are now?

There aren't very many.  What is your point?  My point is, bluntly stated,
that Microsoft and its supporters (namely yourself) are claiming that the
NT platform satisfies a level C2 security rating.  Until said rating is
assigned by an approved contractor, I cannot agree with your claim.

It is irrelevent whether or not IBM, SCO, Sun, etc. are providing secured
systems.  (They do.)  What is relevant is that MS is claiming something that,
IMHO, cannot be claimed as yet.

In other words, having a "checklist" (your words) of various C2-level
features does not automatically qualify the operating system as satisfying
a C2 security class.  While NT may indeed satisfy such a checklist, the
combination has not to my knowledge been tested as a whole.  This is just as
important, if not even more so, than satisfying a checklist.

This may seem "anal-retentive" to you, but system security by its very
nature is anal-retentive.

>I came back from the NT Developer's conference with an arm full of glossies.
>From memory: Hamiltion C-shell, Blue Sky Softwares complete suite of GUI
>tools, Chameleon had TCP/IP add-ons.  I believe were 40 vendors
>shipping products for NT, I'm sure that number grow daily.  Certainly
>I intend to be shipping my product before NT's release.  SGI is already
>shipping hardware that comes with NT running on it (check some of
>my previous posts.. it had the phone number).  There are two or three
>small companies shipping MIPS based machines made to the ACE spec.
>Two of them have multiprocessors that run NT.  I think one was Acler, but
>I don't remember the other one at all... someone want to help this guy
>get a machine running NT and some apps? :-)

According to the SGI rep I spoke to last week, NT-based platforms from
SGI are not shipping yet to the general public, except for developers.
This goes for Chameleon also.  While you may have some product announcements,
they do not constitute shipping products.

Furthermore, ACE-compatible hardware is indeed shipping, but I am referring
to NT and applications that run under NT.  Not hardware.

>>See above.  Until true NT apps exist, your claims are mere speculation.
>Hmm.... I suspect if I hunt around, one or two will already exist.  More
>importantly there are many available for 3.1... it's an easy port.  That
>I know for a fact as I've been studying just that in the last week.
>I imagine by beta time, it will be quite easy.  I already know of one third
>party tool that helps you do this.

When you see some applications that are now shipping for NT (as opposed to
being announced, or 3.1 apps), then come back and tell this newsgroup all
about them.

>You mean you're all upset about C2 level vs. certification, and you don't
>even have to have the certification?  Sheesh!  What makes you think that
>some government testing procedure actually adds real value?  The only
>thing it really shows is that the company had the money to go through
>the procedure and that indeed they do meet the checklist.  Why not do
>the checklist yourself.  C2 is relatively moderate in requirement.
>Mainly you have to be able to log that someone has done something.
>It does not specify much in the way of prevention.

See above.  The security ratings process helps to insure that the system
*as a whole* works in a C2 security class.  It doesn't just make marks
on a laundry list, as you appear to think.

You may find further references on this process in the appropriate
books in the rainbow series, if you are interested.

>Gratuituous editing!!!!!  NT is not a system for end-users yet,  I don't,
>didn't, and will not claim that it is.  It is however fully featured
>minus the TAPE API and POSIX and miscellaneous small parts.

The POSIX layer, to me, is not really a "small part".

>>SVGA is already running on many boards, though not all.  As for Windows
>Bullshit... there are precisely 3 drivers available now, 2 of which
>are in beta.  Only one supports seemless windows.  3 does not equal many.

The nice thing about most video boards is that they support fewer hardware
standards than video board makers.  That means that drivers specific to
each video board maker do not have to be created.  For example, let's say
that we have a VGA driver, an XGA driver, an 8514 driver, and an ET4000
driver.  (We do.)  Four drivers.  Four may not be very many drivers to you,
but I make the proposition that those four drivers would cover a majority of
the current video board market.

>Brian


-- 
D. Robert Spexet II, N0OKR   Internet:  spexet@math.lsa.umich.edu
Department of Mathematics    BITnet:    user68xr@umichum.bitnet
The University of Michigan   UUCP:      uunet!mailrus!math.lsa.umich.edu!spexet
Ann Arbor, Michigan 48109