IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Hardware & Software Remarks
____________________________________________________________________ .........................................
S 4.102 C2 security under Novell 4.11
Initiation responsibility: Head of IT Section, IT Security
Management
Implementation responsibility: Administrators
Certain standardised evaluation criteria have become established for the
assessment of IT products and IT systems: the US criteria known as TCSEC
(Trusted Computer System Evaluation Criteria) and the European version,
ITSEC (Information Technology Security Evaluation Criteria), which in the
meantime have been further developed to become the CC (The Common
Criteria for Information Technology Security Evaluation). In the autumn of
1997 Novell Netware 4.11 received a certification in accordance with
functionality class C2 of the TCSEC from the National Computer Security
Center (NCSC); this corresponds to ITSEC class F-C2/E2.
The use of a certified product provides a guarantee that the security
functionality of the product has been independently tested and does not fall
below the standard specified in the evaluation level (see also S 2.66
Consideration of the contribution of certification to procurement).
Frequently encountered standard cases are grouped together as functionality
classes in these security criteria. The requirements of functionality classes F-
C2 are essentially intended for operating systems. They include definitions of
the following features, for example:
- Adoption of the C1 specifications
- Existence of mechanisms for restricting access by users to certain
documents
- Identification of users
- Refinement of access rights
- Auditing of all security-related events with time stamp, user name, object
and message indicating whether successful or unsuccessful
- Administration of audit files (access protection, control of size, etc.)
- Delimitation of resources (access protection)
- Delimitation of data from different processes with respect to other
processes even after sharing
The observance of these specifications is checked with special test procedures.
However, acquiring a C2-certified product is not sufficient in itself to achieve
C2 security. The key factor for actually putting a C2 system into practice is
the precise implementation of the specifications of the certification report.
The security options necessary for achieving C2 security with Netware 4.11
were summarised in the file named SECURE.NCF. The following sections
look more closely at the SECURE.NCF file and explain the individual
options.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000