Informix Secure Database C2, B1 and B2 Evaluation Status

There have been some recent questions regarding Informix' Secure DB Products Evaluation status in both the US (NCSC) and Europe (ITSEC). Some of the "fog" needs to be cleared, both regarding the status of the ongoing evaluation efforts themselves, and also regarding the meaning of the security levels. We note, surprisingly, that another DB vendor responded to question to us by including partial electronic copies of the NCSC Evaluated Products List (EPL) entries, unsurprisingly for their own products. Should the reader desire it, I will include the analogous Informix-related entries and, in addition, will also include the Secure Operating Systems on which our database engines were evaluated. According to both US and European evaluation ground rules, Secure DB products must be evaluated at each level IN TANDEM WITH Operating System foundations that have also already been evaluated at each level. These Informix EPL entries will be appended to this response, should you be interested. The nature of the original question, however, seems to be requesting a level of perspective BEYOND what the EPL listings, alone, will tell you. Reading the EPL listings, you will find that: 1) Informix was the first database vendor to be successfully evaluated at the NCSC "C2" and "B1" levels of security. 2) Informix was (and is) the first (and only) database vendor to attain NCSC Ratings Maintenance Program (RAMP) certification, essentially, extending its original C2 and B1 ratings to successor versions, or releases of its database products. 3) Informix was (and is) the first (and only) database vendor to attain in European (ITSEC) evaluations, with: a) Full CLIENT-SERVER security evaluation, INCLUDING the Client-Server Networking component, at F(C2)/E3 and F(B1)/E3 levels, (the first Client-Server-evaluated DB Product), ...AND... b) Completely new ITSEC "PLATFORM-INDEPENDENT" guidelines, greatly alleviating and expediting the need for (and burden of) evaluation on multiple Hardware/Secure OS platforms. 4) Finally, Informix is the ONLY DB Vendor, as far as we know, that has submitted it's database products to the rigorous B2 Evaluation process with (surprising and revolutionary to some) its latest, fully Multi- Threaded Database Architecture, Dynamic Scalable Architecture, v.7.x. When you enter the world of the Trusted Products Evaluation Program(s), you quickly realize two crucial facts: 1) That the most dangerous of all states is one that conveys a FALSE sense of security, and 2) that, for Database Server products, B2 is the first Trust-WORTHY level of security. (This fact was realized even in the early days of "Orange Book" specification, by both the NCSC and ITSEC.) B2 is the first level of security that deals with the problem of "Covert Channels." Covert Channels are technical means by which a process at a high security level can convey highly sensitive information to other processes at lower (or even public) security levels by transmitting information through either memory or timing mechanisms, visible to the outside. In the database environment, where the "object granularity" (for example, a database row or column) is exceedingly small, these "Covert" channels are so numerous that they are almost OVERT. In a sense, what we're saying is that Data- base products, if designed only to meet B1 guidelines, or if evaluated only at levels B1 and below, are as leaky as a seive. A recent 30-line SQL code test showed (on another vendor's "B1" DB engine) a quite obvious "leak" which exposed "Top Secret" data to "Public" scrutiny at a rate roughly TWICE the rate of the fastest modem that can be bought. Informix Database Products were designed FROM THE OUTSET to meet and exceed B2-B3 evaluation levels. It is, in fact, the exact same code, evaluated in two evolving releases at B1 levels, that is NOW being evaluated at B2. They are, from a Secure Code Module standpoint, the exact same product. As an aside we must point out, however, that B1-level Secure Operating Systems quite trustworthy. This is because the object granularity at the OS level is generally that of whole files. Very little site-critical information can be conveyed through OS covert channels save, perhaps, the presence or absence of files, themselves. (But not the contents of them.) Yes, our present EPL listings describe previous releases, versions 4.1 and 5.0, at C2 and B1 levels, and, in Europe F(C2)/E3 and F(B1)/E3 - including the Client-Server networking components under the unique European "Platform Independent" guidelines. We decided to skip v.6.0 and immediately offer our multithreaded v.7.1/Secure "Dynamic Scalable Architecture" for the FULL B2 evaluation process. Because of this, we have already been selected as the sole DB vendor for National Security Agency's own "Dockmaster II" client- server database system. We're already 9 months into the evaluation, some- where around the mid-point. While a multithreaded architecture (to allow high performance and security in the same product) was initially difficult to propose from a security vantage point, the parallel/secure architecture subtleties are now behind us, and we're using the single code stream of our standard, commercial database product, with NO pricing add-on. Further evaluations and platform ports will be driven simply by business case. Extruding these Secure B2 functions into today's commercial (and Civil Govern- ment) open enterprise, on commercial OS's, using open enterprise connectivity, and PC's as clients is also a major developmental priority at Informix. We have also announced a number of unique Security Technology Partners, each dealing with different domains in the enterprise-wide security spectrum: Encryption, Digital Signatures, Hashing, Enveloping, Intrusion Detection, "vanilla" UNIX (SuperUser) protection mechanisms, Authentication Services (such as Kerberos), Name Services (such as DCE), and the like. You may have read, for example, of the joint Informix/Hewlett Packard/Gemplus announcement at Telecom '95 in Geneva of our integration of our Database products with Gemplus' Smart Card and HP's International Cryptography Framework (PCMCIA Encryption Card) technologies. Integration of each of these partner products will allow the user, whether governmental or commercial, to deal with the full spectrum of security issues in his or her global enterprise. Each technology represents a critical dimension in attaining not only full, but high-performance site-tailorable and cost-constrained database security. If you have any questions or comments on any of these dimensions of database security, please call: Bob Hedges Market Development Manager - Secure Products Informix Software, Inc. 4100 Bohannon Drive Bldg. 4600/2 Menlo Park, CA 94025 (415) 926-6791 bhedges@informix.com ************** NCSC EVALUATED PRODUCTS LIST ENTRIES, BELOW ****************** *** Informix' First C2 Evaluation - OnLine/Secure v