Re: SNARE and C2 auditing under 2.5.x

[Jakob Oestergaard]

On Wed, May 21, 2003 at 09:26:15PM +0200, Bernd Eckenfels wrote:
> In article <[e-mail]> you wrote:
> >  Nah, auditing isn't needed to run a secure system.  ;)
> 
> Besides C2 is totally anachronistical, anyway.
> 

Logging is *not* anachronistical.

"The TCP shall be able to create, maintain, and protect from
modification or unauthorized access. The audit data shall be protected
by the TCB so that read access to it is limited to those who are
authorized for audit data. The TCB shall be able to record the following
types of events: use of identification and authentication mechanisms,
introduction of objects into a user's address space (e.g., fileopen,
program initiation), deletion of objects, actions taken by computer
operators and system administrators and/or system security officers, and
other security relevant events. For each recorded event, the audit reord
shall identify: date and time of the event, user, type of event, and
success or failure of that event. For identification/authentication
events the origin of request (e.g., terminal ID) shall be included in
the audit record. For events that introduce an object into a user's
address space and for object deletion events the audit record shall
include the name of the object. The ADP system administrator shall be
able to selectively audit the actions of any one or more users based on
individual identity."

> Even Windows 2000 now offers some Protection Profiles from the Common
> Criteria EAL4+FLR für ControledAccessProtectionProfile(CAPP).

EAL4 means "we're pretty sure the system does X"

It does not say that X is anything remotely related to security.  The
"AL" in EAL is for "Assurance Level", how certain you are that the
system behaves according to specification. It's not about the security
features of your specification.

Ever wondered why Solaris 8 and Trusted Solaris 8 both have EAL4 ?

You say C2 auditing is anachronistical - but NOT EVEN having THAT is
most certainly not a mark of distinction.

And in fact, your average syslog setup is NOT guaranteed to store the
log events as required by C2. Some information is missing, and you do
not have guarantees that events that *are* generated by the system,
actually reach the log.

This is very very far from being impressive.  C2 is not the end all and
be all, but it's auditing requirements are pretty good (for systems that
only have discretionary access controls) and efforts to bring this kind
of auditing to Linux should certainly not be frowned upon.

That's my 0.02 Euro at least

-- 
................................................................
:   [e-mail]   : And I see the elder races,         :
:.........................: putrid forms of man                :
:   Jakob Østergaard      : See him rise and claim the earth,  :
:        OZ9ABN           : his downfall is at hand.           :
:.........................:............{Konkhra}...............: