http://cisr.nps.edu/cyberciege/ is a video game designed to teach computer security concepts. In addition to its more advanced scenarios, it includes a few simple "awareness" scenarios, the first of which directly addresses your topic. Further, this animated movie: http://cisr.nps.edu/cyberciege/movies/02CIEGE.html helps the layman understand why the problem of malicious software is so hard to solve. The link includes a free evaluation version of the game.
Right, the gnashing of teeth is not the DRM crowd, it is the government sponsored high assurance computing platform proponents. Today, low assurance systems like Linux and Solaris sit between SECRET networks and the Internet. Some hoped to use TxT to create high assurance replacements. But I'm sure they'll conclude this is the "last bug" and plow forward.
How do you feel about Linux sitting between SECRET data networks and UNCLASSIFIED data networks? There was a time when "high assurance" systems were needed for such connections. Now, B1 or "EAL4" will do.
Whenever this topic comes up, someone always incorrectly says that an "air gap" separates SECRET networks from unclassified networks. "Cross Domain Solutions" connect SECRET networks to uclassified networks. And these include "low assurance" solutions like SELiux and Trusted Solaris.
And these CDS machines also connect TOP SECRET networks to SECRET networks. Thus, two copies of SELinux sit between TOP SECRET networks and the Internet.
This should be mod'd up, it is the only post that gets close to the email issue. The fact that the email was sent over the internet is colossaly besides the point. How did the information get onto a computer that has an internet connection? It suggests people are doing classified work on unclassified computers. Not a "mistake". Rather it is a deliberate choice.
Just the other day I updgrade to 1.5 so I can use an extention. Unknow to me that turns on automatic updates. Turn my box on today and am told update is ready. Grumble, OK. Enter endless loop of Firefox unable to complete update (because I don't run as admin). Can't EVEN LOG OFF. Have to kill firefox from process list. I guess I'll run IE for an hour to feel better about Firefox again.
The author should have observed that the profile from which he drew the damning summary of "what it is good for" includes assurance of EAL3. I'm not suggesing that an EAL4 system would materially change "what it is good for", but a review of the protection profiles at http://www.iatf.net/protection_profiles/operating_ systems.cfm suggests that our gov't thinks EAL4 is good enough to protect SECRET data from uncleared users. I think that is plain nuts, but it does differ from the quoted summary.
Again, not true. A B2 system can have single level devices and multilevel devices as described in the Orange Book. A single level connection to a untrusted system is quite simple and practical, and consistent with taking the Orange Book seriouisly. Yes, a multilevel connection would require labels and a basis for believing labels (e.g,. connection to another evaluated system). If you need help with the engineering of it, refer to the TNI.
"A B2 O/S cannot be connected to any sort of network and remain B2 secure, still interested?" Not true. The network connections simply must be part of the defined security architecture. The DOCKMASTER system ran B2 Multics with Internet connections and was trusted by many commercial vendors to protect proprietary information they were sharing with Government evaluators.
Slashdot Mirror
http://cisr.nps.edu/cyberciege/ is a video game designed to teach computer security concepts. In addition to its more advanced scenarios, it includes a few simple "awareness" scenarios, the first of which directly addresses your topic. Further, this animated movie: http://cisr.nps.edu/cyberciege/movies/02CIEGE.html helps the layman understand why the problem of malicious software is so hard to solve. The link includes a free evaluation version of the game.
Right, the gnashing of teeth is not the DRM crowd, it is the government sponsored high assurance computing platform proponents. Today, low assurance systems like Linux and Solaris sit between SECRET networks and the Internet. Some hoped to use TxT to create high assurance replacements. But I'm sure they'll conclude this is the "last bug" and plow forward.
Have you never heard of Cross Domain Solutions?
How do you feel about Linux sitting between SECRET data networks and UNCLASSIFIED data networks? There was a time when "high assurance" systems were needed for such connections. Now, B1 or "EAL4" will do.
http://www.gcn.com/online/vol1_no1/46648-1.html?topic=security
Whenever this topic comes up, someone always incorrectly says that an "air gap" separates SECRET networks from unclassified networks. "Cross Domain Solutions" connect SECRET networks to uclassified networks. And these include "low assurance" solutions like SELiux and Trusted Solaris.
And these CDS machines also connect TOP SECRET networks to SECRET networks. Thus, two copies of SELinux sit between TOP SECRET networks and the Internet.
This should be mod'd up, it is the only post that gets close to the email issue. The fact that the email was sent over the internet is colossaly besides the point. How did the information get onto a computer that has an internet connection? It suggests people are doing classified work on unclassified computers. Not a "mistake". Rather it is a deliberate choice.
Just the other day I updgrade to 1.5 so I can use an extention. Unknow to me that turns on automatic updates. Turn my box on today and am told update is ready. Grumble, OK. Enter endless loop of Firefox unable to complete update (because I don't run as admin). Can't EVEN LOG OFF. Have to kill firefox from process list. I guess I'll run IE for an hour to feel better about Firefox again.
The author should have observed that the profile from which he drew the damning summary of "what it is good for" includes assurance of EAL3. I'm not suggesing that an EAL4 system would materially change "what it is good for", but a review of the protection profiles at http://www.iatf.net/protection_profiles/operating_ systems.cfm suggests that our gov't thinks EAL4 is good enough to protect SECRET data from uncleared users. I think that is plain nuts, but it does differ from the quoted summary.
Again, not true. A B2 system can have single level devices and multilevel devices as described in the Orange Book. A single level connection to a untrusted system is quite simple and practical, and consistent with taking the Orange Book seriouisly. Yes, a multilevel connection would require labels and a basis for believing labels (e.g,. connection to another evaluated system). If you need help with the engineering of it, refer to the TNI.
"A B2 O/S cannot be connected to any sort of network and remain B2 secure, still interested?"
Not true. The network connections simply must be part of the defined security architecture. The DOCKMASTER system ran B2 Multics with Internet connections and was trusted by many commercial vendors to protect proprietary information they were sharing with Government evaluators.