Re: B1/C2 security level?

One thing to bear in mind whenever reading Informix's claim to be: "...the only RDBMS product with a successful NCSC B1/C2 evaluation...", is that it is a slimy marketing claim which Informix maintained even after the beginning of April 1994 when Oracle's products completed 4 evaluations ! Oracle chooses to market it's C2 product as Oracle7 (yes that's right it is the standard database offering that is secure !) and it's MLS B1 product as Trusted Oracle7. These products are produced out of the same codeline. So note the claim from Informix "...RDBMS product..." rather than productS (some difference!). In article <4701aq$s3u@inet-nntp-gw-1.us.oracle.com>, tkyte@us.oracle.com (Thomas J Kyte) wrote: > Tim <cchung@cs.tamu.edu> wrote: > > >Does INFORMIX-OnLine/Secure remain the > >"only" RDBMS product with a successful > >NCSC B1/C2 evaluation? (As I know, in > >1994 Summer, it did.) > > >Has INFORMIX-Online/Secure got its B2 > >certification yet? > > >Thank you. > > Informix Online Secure v4 was the first by weeks to get its B1/C2 rating. > > On April 5, 1994 Oracle7 was awarded C2. > On April 5, 1994 Trusted Oracle7 was awarded B1. > > Informix has ramped their v4 product to v5.0. Note, Informix v6 and v7 are not > B1 or C2 certified. > > > no one has gotten b2 yet. > > > the following gives you the numbers/cotacts you need to get the info: > > > ---------------------- extract ------------------- > This file constitutes an electronic copy of the official list of products > evaluted by the NSA's Trusted Product and Network Security Evaluations > Division. It was derived from a listing of all EPL announcements posted > to the Announce forum on Dockmaster. While the hardcopy EPL (chapter > four of the Product and Services Catalogue) maintains only those EPL > listings three years old or less, this electronic version is the complete > Evaluated Products List. (Because this is solely a text file, the summary > charts in the hardcopy EPL are not included here.) In the name of > completeness, there are also listed current Product Bulletins, which > announce transition from Design Analysis to the Formal Evaluation Phase > (under the old system) or transition from Advice to Evaluation (under the > new system). Product bulletins are removed upon completion of Evaluation > (i.e., posting of an EPL entry). > > Like the hardcopy version, this file is divided into seven sections: > Product Bulletin entries, Operating Systems EPL entries, Network EPL > entries, Database EPL entries, Compartmented Mode Workstation EPL > entries, Sub-System EPL entries, and RAMP EPL entries. Entries within > each section are listed chronologically by official announcement date. > > Questions concerning listed products may be directed to the Trusted > Product and Network Security Evaluations Division (410-859-4458). > Requests for copies of the Final Evaluation Reports should be directed > to the Publications Office (410-766-8729). > > Also, attached for your information is the following consolidated list of vent > of each vendor's point-of-contact. > > This index lists all products that have completed or are in > evaluation, sorted alphabetically by vendor company name and product > name. Each entry consists of: > > Vendor > Product > Point of Contact > Level of Trust / Product Type > Evaluation Status > > > In cases where a product was evaluated under one company but is now > owned by a company of a different name (either through sale of product > or company name change), there is an entry for each company name. The > entry for the original company (i.e., the company whose name appears > on the EPL entry and Final Evaluation Report) references the new > company under Point of Contact; the entry for the new company > references the original company under Evaluation Status. > > Every effort is made to keep the list of Points of Contact current. > Errors and updates should be brought to the attention of the Trusted > Product and Network Security Evaluations Division (410-859-4458). > > > [snip] > > > Oracle Corporation > Oracle7 > Linda Vetter, (415)506-6380 > C2 DBMS > Completed 04/05/94 > > Oracle Corporation > Trusted Oracle7 > Linda Vetter, (415)506-6380 > B1 DBMS > Completed 04/05/94 > > ------------------------------------------------------------------- > Serial: CSC-EPL-94/003 > > EVALUATED PRODUCT: Oracle7 > > VENDOR: Oracle Corporation > > RELEASE: 7.0.13.1 with the Procedural Option > > DATE: 5 April 1994 > > OVERALL EVALUATION CLASS: C2 > > ---------------------------------------------------------------------- > > Serial: CSC-EPL-94/004 > > EVALUATED PRODUCT: Trusted Oracle7 > > VENDOR: Oracle Corporation > > RELEASE: 7.0.13.1 with the Procedural Option > > DATE: 5 April 1994 > > OVERALL EVALUATION CLASS: B1 > > > > > > Thomas Kyte > tkyte@us.oracle.com > Oracle Government