Fw: [ISN] IBM earns Linux certification

["David Eaves" <deaves@plansys.com>]

SE-linux appears to headed for a DCID certification at NSA, to expedite its
availability, rather than a CC one? Is that right Steve? If you can say one
way or the other.

MDSPP and MNISPP are available at
http://www.iatf.net/protection_profiles/profiles.cfm, under Multiple Domain
Solutions, and Multinational Information Sharing, respectively. MDSPP is a
little bit shaky in terms of usefulness, while MNISPP is more geared toward
workflow and systems. Neither one is the be-all and end-all of CC though.

Flaw remediation sounds a little dubious in terms of assurance, but every
little bit helps I guess... It sounds a little like credit ratings for
bonds, BBB+ versus BBA-, i.e. fine gradations beyond actual resolvable
differences.

Anyway, since everybody seemed to be making such a fuss, I just wanted to
state the obvious, regarding the general unimportance of the IBM/Suse-linux
noise. Back to work now.

Dave Eaves
Principal Information Assurance Software Engineer
Planning Systems, Inc

----- Original Message ----- 
From: "Florian Weimer" <fw@deneb.enyo.de>
To: "David Eaves" <deaves@plansys.com>
Cc: <selinux@tycho.nsa.gov>
Sent: Thursday, August 07, 2003 1:45 PM
Subject: Re: Fw: [ISN] IBM earns Linux certification


> "David Eaves" <deaves@plansys.com> writes:
>
> > The Windows product lines already have EAL4+ (what the plus means I
> > don't know)
>
> EAL 4 plus flaw remediation procedures.
>
> > versus CAPP, which as a protection profile is next to worthless from
> > my pov.
>
> I agree.
>
> > Solutions I need will have to address the MDSPP and MNISPP profiles,
which
> > are much wider in scope and more difficult to assure.
>
> Are the profiles already fully defined and available for
> certification, and can they be applied to software which wasn't
> designed from the beginning to meet those criteria?


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.