Re: C2 vs Common Criteria [was: RE: Is this mail list dead?]

[Crispin Cowan <crispin@wirex.com>]

LA Walsh wrote:

>         Secure = I've made my system a complex enough puzzle put off most
> people.

I have a problem with that one.  The above spec. describes security through
obscurity.  Here's my take:

Secure:  system architected such that only proper presentation of authentication
and authorization credentials permits access, and forging said credentials
requires solving intractable problems (e.g. factoring 1000 bit primes).

Apparently Secure:  no method is *known* to allow an attacker to violate
security.  Obscurity makes it hard to find such means to violate security, so
obscurity enhances Apparent Security(tm:-)

Trusted:  no method is known to allow an attacker to violate security, and some
fairly qualified people have looked really hard, and documented the places they
looked.

"Trusted", as in, "some folks trust this thing because they checked it out real
good." :-)

Crispin

--
Crispin Cowan, Ph.D.
Chief Research Scientist, WireX Communications, Inc. http://wirex.com
Security Hardened Linux Distribution:                http://immunix.org



-
Securedistros: A common list for all secured Linux distributions
Archive:       http://humbolt.nl.linux.org/lists/