PRESS RELEASE: INFORMIX-ONLINE/SECURE FIRST B1, C2 RATED SECURE DATABASE

INFORMIX-ONLINE/SECURE FIRST B1, C2 RATED SECURE DATABASE OnLine/Secure Submitted to NCSC for B2 Security Evaluation Fort Meade, MD, (Sept. 14, 1993) Informix Software, Inc. (NASDAQ:IFMX) and the National Computer Security Center (NCSC), today announced that INFORMIX-OnLine/Secure, Informix's multi-level secure database, is the first database to meet B1 and C2 security levels. Informix has also announced today that it has submitted OnLine/Secure for evaluation by the NCSC at the B2 level of security. "NCSC evaluation is a key confirmation of our commitment to provide industry-leading secure database products," said Phil White, Informix chairman and CEO. "With the proliferation of client/server and distributed computing environments, the need for security, especially in commercial markets, is becoming a critical issue. Only through the NCSC's detailed evaluation process can users be assured that secure database products meet the requirements that will enable them to maintain a truly secure environment." "The evaluation process with Informix is an excellent example of government and industry cooperation," said Patrick Gallagher, NCSC director. "We could not have had a better partner than Informix for our first database evaluation. We both learned a great deal about what a full, unbiased and extremely detailed RDBMS evaluation must be in order to provide the proper level of assurance for the highly-classified environment for which OnLine/Secure was designed." B1, C2 : Increased Security, Greater Control, Reduced Costs B1 and C2 secure databases allow organizations to limit, control, and track access to classified information, at different user sensitivity levels, without maintaining separate databases for classified and unclassified data. Because data is maintained in one database, information can be accessed and manipulated faster and easier, and the cost of maintaining a secure environment is reduced. Further cost reductions can be realized because applications no longer need to include extensive access control functions. The B1 configuration of OnLine/Secure protects classified or sensitive data from unauthorized access using Mandatory Access Controls (MAC). MAC compares the sensitivity level of the database user's log-in identification with the sensitivity level that is assigned to each row of data requested by the user. If the user's sensitivity level is equal to or superior to the sensitivity level of the data, the information may be accessed. The C2 configuration of OnLine/Secure controls access to the database using Discretionary Access Controls (DAC). The database requires all users to log in with a unique ID that is either accepted or rejected by the system before allowing access to appropriate data. A C2 level database also audits and notifies database administrators of attempts to access, modify or delete information from the database. B2 Security: Added Security, Increased Assurance The B2 configuration of OnLine/Secure protects against unauthorized access of the database by indirect methods or "covert channels". (B1 security protects against overt data access attempts only.) A B2 secure database searches for covert channel communications using storage or timing mechanisms and notifies database administrators of such attempts. OnLine/Secure includes built-in locking mechanisms that shield classified information from low-level users. The increased security and assurance provided by a B2 database is also ideal for high security environments that require the separation of more than two levels of security. "We strongly believe that a truly secure database must eliminate security breaches by direct and indirect methods," said White. "That is why we've added B2 security features into the latest version of OnLine/Secure. This capability puts us years ahead of any other database on the market in terms of protecting data against covert, unauthorized access to data." The NCSC Evaluation Process To receive a B1 rating or higher, a relational database must successfully complete a rigorous evaluation process by the NCSC. Vendors seeking an NCSC rating must submit a product proposal which describes the product and outlines the technical approach that will be taken to gain compliance with the evaluation criteria. Once a product completes the security evaluation and receives a rating, it enters a Rating Maintenance Phase (RAMP), which allows the vendor to maintain the NCSC rating as new versions of the product are released. Now that OnLine/Secure has been successfully evaluated as B1 and C2 compliant, Informix will use the RAMP program to maintain that rating with future releases of OnLine/Secure. Informix plans to evaluate future versions of OnLine/Secure on major UNIX platforms throughout the year. About OnLine/Secure INFORMIX-OnLine/Secure is a multilevel secure database for secure UNIX and compartmented mode workstation (CMW) platforms. It is designed to meet the high security class requirements of B1, B2, B3 and C2 as defined by the US Department of Defense "Orange Book," a standard for secure operating systems, and the Trusted Database Interpretation, or "Lavender Book," a standard for secure database products. OnLine/Secure is also designed to meet the F(B1)/E3 rating, a database specification defined in the European Information Technology Security Evaluation Criteria (ITSEC). OnLine/Secure has been rated B1 and C2 secure by the NCSC. It is currently undergoing evaluation at the B2 level by the NCSC and the F(B1)/E3 level by European ITSEC. About the NCSC The National Computer Security Center develops and publishes criteria for the evaluation of trusted information processing systems and guidelines for the development and use of those systems. The NCSC also works with industry to assist in the development of trusted commercial information processing products and evaluates those products. About Informix Informix Software, Inc., provides the most complete and productive database technology to build, deploy, run and evolve applications. Informix products include powerful distributed database management systems, robust application development tools, and graphical- and character-based productivity software for delivering information to every significant desktop platform. With corporate headquarters in Menlo Park, Calif., Informix has European headquarters in London, and Asia/Pacific headquarters in Singapore. ### -- %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%% William Daul Advanced Support INFORMIX SOFTWARE INC. 4100 Bohannon Dr. (415) 926-6488 - wk Menlo Park, CA. 94025 uunet!infmx!billd or billd@informix.com