The purpose of the Orange Book is to outline evaluation criteria with the objectives of measurement , guidance and acquisition . These criteria constitute a uniform set of basic requirements and evaluation classes for assessing the effectiveness of security controls built into systems . While many efforts have been made in the Orange Book to construct secure operational environments, there is an inherent weakness in the mathematical formal proof concept of the B3 and A1 levels. According to Godel's Incompleteness Theorem, no algorithm, or calculational procedure, that uses mathematical proofs can prove its own validity. That isn't to say that the formal models of the B3 and A1 levels are not successful - just that they are flawed in their concept.
Security is a human endeavour.
As such, when designing secure environments we must be aware that every design will eventually be broken, and that it is vigilance which is the real security. The O'Reilly and Associates book, Computer Security Basics by Deborah Russell and G. T. Gangemi Sr., is an excellent first resource for computer security. While this document provides an introduction and reference to the Orange Book, the O'Reilly book covers many other salient points not addressed here. Evaluations must be performed for systems with particular configurations on particular platforms. A system such as UNIX cannot be evaluated apart from its implementation on a particular piece of hardware.