SNARE and C2 auditing under 2.5.x
Quoted 2 lines
I may be repeating this question, but is there an effort to brigning snare code to 2.5.x?
Nah, auditing isn't needed to run a secure system. ;)
Quoted 1 line · In article <[email protected]> you wrote:
Nah, auditing isn't needed to run a secure system. ;)
Besides C2 is totally anachronistical, anyway.
Even Windows 2000 now offers some Protection Profiles from the Common Criteria EAL4+FLR für ControledAccessProtectionProfile(CAPP).
Greetings
Bernd
Signature · 2 lines
eckes privat - http://www.eckes.org/ Project Freefire - http://www.freefire.org/
Quoted 7 lines · Bernd Eckenfels
Quoted 1 line · In article <[email protected]> you wrote:
Nah, auditing isn't needed to run a secure system. ;)
Besides C2 is totally anachronistical, anyway.
Even Windows 2000 now offers some Protection Profiles from the Common Criteria EAL4+FLR für ControledAccessProtectionProfile(CAPP).
EAL4 if you read it is not for a hostile environment, so its not even good enough for a typical university lab 8)
Quoted 5 lines · Bernd Eckenfels
Quoted 1 line · In article <[email protected]> you wrote:
Nah, auditing isn't needed to run a secure system. ;)
Besides C2 is totally anachronistical, anyway.
Logging is *not* anachronistical.
Quoted 1 line
From C2: "2.2.2.2 Audit"
"The TCP shall be able to create, maintain, and protect from modification or unauthorized access. The audit data shall be protected by the TCB so that read access to it is limited to those who are authorized for audit data. The TCB shall be able to record the following types of events: use of identification and authentication mechanisms, introduction of objects into a user's address space (e.g., fileopen, program initiation), deletion of objects, actions taken by computer operators and system administrators and/or system security officers, and other security relevant events. For each recorded event, the audit reord shall identify: date and time of the event, user, type of event, and success or failure of that event. For identification/authentication events the origin of request (e.g., terminal ID) shall be included in the audit record. For events that introduce an object into a user's address space and for object deletion events the audit record shall include the name of the object. The ADP system administrator shall be able to selectively audit the actions of any one or more users based on individual identity."
Quoted 2 lines
Even Windows 2000 now offers some Protection Profiles from the Common Criteria EAL4+FLR für ControledAccessProtectionProfile(CAPP).
EAL4 means "we're pretty sure the system does X"
It does not say that X is anything remotely related to security. The "AL" in EAL is for "Assurance Level", how certain you are that the system behaves according to specification. It's not about the security features of your specification.
Ever wondered why Solaris 8 and Trusted Solaris 8 both have EAL4 ?
You say C2 auditing is anachronistical - but NOT EVEN having THAT is most certainly not a mark of distinction.
And in fact, your average syslog setup is NOT guaranteed to store the log events as required by C2. Some information is missing, and you do not have guarantees that events that *are* generated by the system, actually reach the log.
This is very very far from being impressive. C2 is not the end all and be all, but it's auditing requirements are pretty good (for systems that only have discretionary access controls) and efforts to bring this kind of auditing to Linux should certainly not be frowned upon.
That's my 0.02 Euro at least
Signature · 6 lines
................................................................ : [email protected] : And I see the elder races, : :.........................: putrid forms of man : : Jakob Østergaard : See him rise and claim the earth, : : OZ9ABN : his downfall is at hand. : :.........................:............{Konkhra}...............: