Slashdot Mirror
IEEE to Standardize OS Security Components
aster_ken writes "The Institute of Electrical and Electronic Engineers has started work on a standard for securing operating systems, as a recognition that software security is 'limited by the operating systems that underpin them', the organization said yesterday. The standard, dubbed IEEE P2200, will address external threats and intrinsic flaws arising from software design and engineering practices."
Microsoft creates own standards beaurou
Deems Windows perfect, others not
That's just great, codify the security aspects of OSes into a $100 document that can't be freely redistributed. That's a really good idea...
The other is that at some point a system that adheres to the standard will be compomised and will raise questions as to the usefulness of this standars.
I don't question the need for standards , but not all things can be standardized. Standards stand for a commonnly accepted way of doing something. Security is still too volatile.
Slashdot Sig. version 0.1alpha. Use at your own risk.
Never mind a secure OS, I think these electronic engineers sound like very useful devices. Is there a review of one anywhere? How much do they cost? Do they run Linux?
So, did anyone else read the linked article and think "Looks like someone bought the IEEE's support of TCPA / Palladium"?
I hope not, but it certainly sounds that way. Basically, it makes the point that we cannot trust people not to run programs that break their own (or others) computers, so the task of limiting what (possibly malicious) code can run falls to the OS.
Sad. If I didn't have complete confidence that any DRM scheme will eventually prove itself flawed, I might actually worry. Though, I certainly do not look forward to the general inconvenience it would cause, regardless...
Only education (and not running Outlook) will help reduce the modern plague of worms, virii, spam, and other ways to generally make a computer and the internet grind to a crawl. Not legislation, and not crippled hardware. People simple need to learn how to secure their own damn machines.
don't get too excited there, guy. just becuase someone puts out a 'standard' doesn't mean everyone has to follow it. anyone can form an organization to make standards, but they dont' mean anything if nobody wants to follow them.
Not only that, but people like microsoft will just make their own standards and ignore the ones already set. They won't have any affect on anything, imho.
It's true that some flaws in the OS are inherently design-based. However, even if we make certain design requirements to be incorporated in the OS, it still doesn't guarantee that the OS is secure. I would think that it even can't minimize the number of OS breaches. It would even hamper the OS development in order to comply with their standards.
About the quote regarding the "minimum expectations of consumers for security and general reliability by establishing a floor for these characteristics". I don't think it would be possible the goal of "the least restrictive requirement while not relenting the control" is vague. Unless it provides rigid post- or pre-conditions of each method (in first order logic if necessary) and provide each formal specifications unambiguously, I would still see some leaks here and there. And, guess what? They put the requirement like UML standards: Way to vague. Congratulations.
For those of you who are curious, click here for the draft.
--
Error 500: Internal sig error
I think it's time for all OS's to accept standards to help people interact with eachother effectively and securely. As everyone know MicroSoft has shunned many attempts at standards in order to control their market share by keeping their users pinned into MicroSoft sanctioned data. This has the effect of forcing businesses to support the MicroSoft users first and everyone second if at all.
.Net applications thus forcing the same cycle of users/companies designing to MS standards again thus shutting out the rest of us from secure systems.
I think a security standard should be enforced by a world body to help prevent MicroSoft from once again taking the standard and corrupting it to work only with Windows and
Some would say standards hurt computing that's not exactly the case. You can design products around standards and still compete with other standard compliant products. It allows everyone to remain compatible and at the same time darwinism will take effect with bad products going away and good products evolving to better suit their users.
One, the final standard spec will be loose enough that Windows will already be compliant, so it won't mean anything.
Two, the final standard spec will be Microsoft's Window-centric implementation of a secure system (existing windows systems may not be compliant, but future ones would be). No non-Windows system would be able to meet the standard without extensive licensing fees being paid to Microsoft to license the technologies needed.
Three, the final standard spec will be sensible, and Microsoft will ignore it. With the mainstream desktop environment paying no regard to the specification, the spec fails to acquire the widespread adoption necessary to become a real standard.
File under 'M' for 'Manic ranting'
It has no network adapter (modem or otherwise) and no input devices (as in all the ports ps/2 com et cetra have been melted shut or broken off) It has no hard drive, just rom, and It's in a chest rigged to explode somewhere at the bottom of the north atlantic! I extend an invite to all the hackers/crackers to try to by pass it!
--fetch daddy's blue fright wig, i must be handsome when i release my rage
This is typical of so many kiddies these days: "I want everything for free, even if it's something I will never need/use/understand".
Many products that are the result of the work of many people - like cars, toasters, and yes, even documents - cost money to produce. Learn to recognize which items are worth the amount on the price tag, and purchase accordingly.
I want to drag this out as long as possible. Bring me my protractor.
I beg to differ. IEEE won't take them down, but it will bug them a bit. It is somewhat like MS being a rampaging bear, Linux being a horde of bunny-rabbits, and IEEE being a bunch of thorny trees.
Linux hits the trees less, but it irritates the bear and prevents it from rears up. Eventually, after the Linux bunnies all mate like crazy, one bunny rabbit is born that is somewhat like the bunny in Monty Python's The Search for the Holy Grail. The point here is to mate Linux distros with each other until the perfect bunny emerges.
Um, yes, perhaps.
... and laugh or weep to taste. (I have this phone which works in 199 countries of the world and doesn't work in one, which is ... guess which? Likewise there's just one county in the world which uses strange paper sizes ... just one country which is so wedded to Imperial units that it crashes spacecraft in preference to following international standards ... and so on and so on ...)
Remember the reaction of the average American to an international standard is to denounce it as a communist plot, particularly if one of the European standards bodies takes an interest (or even ISO, which most Americans regard as European and therefore communist).
If you want an example of how well Americans make good use of international standards you just have to look at their mobile phone system
Now, if most operating system manufacturers were European and Japanese this would be a good idea, because they'd be likely to follow any new international standard. But it happens to be a fact of life that many operating systems are produced or contributed to by Americans, so any such idea is dead in the water before it gets off the ground.
As long as there are people creating software, there will always be security bugs in the operating system. You just can't go over millions of lines of code and spot every bug that can result in a security breach - especially if two portions of code combined are the reason for the breach (those two pieces of code can be hundreds of thousands of lines of code apart). I predict that they'll certify an operating system secure... and then the next day a security alert will be announced for it. Microsoft has come a long way from their old operating systems - Windows Server 2003 is much more secure, but no operating system will ever be 100% secure as long as there are hackers out there to test every possible vulnerability... and the fact that there are administrators out there that may not secure the OS down and make stupid configuration errors.
You just can't go over millions of lines of code and spot every bug that can result in a security breach
That's why really secure OSes don't have millions of lines of security-critical code.
Yes, like the P1003.6 (POSIX Security) which I was involved with (died because of lack of interest and politicial conflicts) as well as P1003.22 (Distributed Security) which I was one of the founders of (was later adopted by X/Open and is usually irrelevant today).
For some reasons (like practical experience), I don't believe the IEEE will manage this any better than they have before (i.e., very badly, mostly due to political aspects having precedents before technical and security aspects).
Feel free to mod an old cynic down.
-- Roland Buresund MBA, MCMI, CISSP