Re: Informix Secure Database C2, B1 and B2 Evaluation Status
Tom, I think Bob was deliberately reading (and writing) between the lines so that he could move the whole debate from C2/B1 to B2 (Informix Online/Secure's holy grail ?). Isn't is strange that B1 is really only B1 when taken in context of the operating system, but fails to provide any trust when used as the basis for RDBMS design ??? Isn't it strange that going to B2 means that you can have *no* cross-level referential integrity enforcement, as this would open up huge potential covert channels ? This is not the fault of Informix, it is simply the way of life. To remove/minimize covert channels means that you have to give up something - unfortunately it is one of the RDBMS fundementals that you have to give up: DATA INTEGRITY. I actually met a strange man at NIISC (and he has contributed to this post !) this year who tried, unsuccessfully I might add, to convince me that the B2 mode of operation provided both cross-level referential integrity AND no covert channels - I put that claim down to too much beer or stress on his behalf. In article <47404l$cvo@inet-nntp-gw-1.us.oracle.com>, tkyte@us.oracle.com (Thomas J Kyte) wrote: > Bob, > > chill out dude. I mean really, you are a little oversensitive here. Lets look > at the original post and my response (I assume you mean me when refering to > another db vendor) > > { from previous posting } > >Does INFORMIX-OnLine/Secure remain the > >"only" RDBMS product with a successful > >NCSC B1/C2 evaluation? (As I know, in > >1994 Summer, it did.) > > >Has INFORMIX-Online/Secure got its B2 > >certification yet? > > >Thank you. > > Informix Online Secure v4 was the first by weeks to get its B1/C2 rating. > > On April 5, 1994 Oracle7 was awarded C2. > On April 5, 1994 Trusted Oracle7 was awarded B1. > > Informix has ramped their v4 product to v5.0. Note, Informix v6 and v7 are not > B1 or C2 certified. > > no one has gotten b2 yet. > { end of previous posting } > > > So, any corrections on the above? I thought not. It is pretty factual, > contained only facts and more to the point, answered the question (actually > undid some of the FUD spread in 94 as to who was certified or not). I actually > gave you credit in the above for "the first ever ramp". Also, no one has gotten > B2 yet (and maybe my EPL is out of date but I don't see you on it yet. BEFORE > you go off the deep end, the latest date in mine is June of 95 so if you entered > after that, that be that). And your "first" to B1/C2 was by DAYS actually (3/21 > to 4/5.). And it was with an obsolete version as I recall. Version 5 had been > out for a long time by then. It is no wonder you are the first to ramp. > Necessity is the mother of Motivation in that area. > > > bhedges@informix.com (Bob Hedges) wrote: > > >There have been some recent questions regarding Informix' Secure DB > >Products Evaluation status in both the US (NCSC) and Europe (ITSEC). > Where? I didn't see any questions on Informix's status, but anyway.... > > >Some of the "fog" needs to be cleared, both regarding the status of > >the ongoing evaluation efforts themselves, and also regarding the > >meaning of the security levels. > Again, why, what needs to be cleared up. They person simply asked "Is Informix > the only one?". They did not ask for a dissertation. > > >We note, surprisingly, that another > >DB vendor responded to question to us by including partial electronic > >copies of the NCSC Evaluated Products List (EPL) entries, unsurprisingly > >for their own products. > Of course, read the posting. The poster OBVIOUSLY KNOWS your were certified. > Why does this surprise you given the nature of the question? They asked "who > else".... > > >The nature of the original question, however, seems to be requesting a > >level of perspective BEYOND what the EPL listings, alone, will tell you. > >Reading the EPL listings, you will find that: > You certainly can read between the lines can't you. Sorry, I don't see it. > Where in the nature of the question "Is Informix the only one" is the poster > asking for a level of perspective BEYOND what the EPL states? They simply > asked, "any other database vendors C2/B1 yet?" > > > [snip] > > > > Bob Hedges > > Market Development Manager - Secure Products > > Informix Software, Inc. > > 4100 Bohannon Drive > > Bldg. 4600/2 > > Menlo Park, CA 94025 > > > (415) 926-6791 > > bhedges@informix.com > > > Thomas Kyte > tkyte@us.oracle.com > Oracle Government