Unix (In)Security

[Jeff Glass]

> Also while on the subject Honeywell is having a new computer certified
> by the NSA for security class A2.  This computer is unix call compatible
> and is called SCOMP's look for it when it receives final security
> classification.

Honeywell's SCOMP has been certified by the Department of Defense
Computer Security Center (sponsored by NSA) as an A1 operating system.
This means that its Trusted Computing Base (kernel, trusted software)
has been formally specified and verified.  Reliable sources tell me
that an announcement will appear in ComputerWorld magazine.

> Since Multics was broken into by an Air Force Tiger Team in the early
> 70's and their methods of breakins fixed via Project Guardian Multics
> has not been broken into unless the Person breaking in had a users login
> name and password.

the Multics OS has been completely revised since then;  Multics is
also being evaluated by the DODCSC, and will have a B2 rating.
The major difference between an A1 rating and a B2 rating is that
formal specification is not done for a B2 evaluation.

/jeff
-- 
  security!jjg at mitre-bedford.ARPA				(MIL)
  jjg at security.UUCP						(UUCP)
  decvax!cca!security!jjg					(UUCP)
 {allegra,ihnp4,utzoo,philabs,uw-beaver}!linus!security!jjg	(UUCP)