RE: Sun cans Trusted Solaris, was Why Easy To Use Software Is Putting You At Risk

["Al Sutton" <asutton () argosytelcrest com>]

The main reason is that there isn't really a reason for having a separate
trusted product. Trusted solaris is based on Solaris 8, Solaris 9 has EAL 4+
out of the box from patch level 8/03, and Solaris 10 is currently undergoing
certification. You should also note that Sun claim that they integrated over
80% of the functionality of trusted Solaris into Solaris 10 (see
http://www.sun.com/smi/Press/sunflash/2005-10/sunflash.20051026.4.html). 

Basically Sun have taken note that security should be part of the main
product, not an additional feature, and when Solaris 11 comes around you'll
probably see more features that will be to your liking.

Al.

-----Original Message-----
From: Craig Wright [mailto:cwright () bdosyd com au] 
Sent: 23 February 2006 23:56
To: dave kleiman; security-basics () securityfocus com
Subject: Sun cans Trusted Solaris, was Why Easy To Use Software Is Putting
You At Risk





Hello,
Many people on the list have the idea that people want secure software at
any cost.


Sun have produced a very good product - Trusted solaris for a long time. I
would like people to answer me (if they can) why they have decided to stop
producing it. To explain why, if everyone wants secure by design software
they are not willing to pay the extra cost to obtain it and thus why Sun is
going to no longer support this OS.

Trusted Solaris has an EAL 4+ rating, supports MAC and RBAC and has a
verified architecture.

Instead Sun will add ECC (elliptice curve crypto) to the existing versions
of Solaris.

Flames welcome, please explain why more people are not implementing a
provably more secure system when it is available.

Regards
Craig S Wright

See:
http://www.infoworld.com/article/06/02/13/75309_HNendtrustedsolaris_1.ht
ml

Liability limited by a scheme approved under Professional Standards
Legislation in respect of matters arising within those States and
Territories of Australia where such legislation exists.

DISCLAIMER
The information contained in this email and any attachments is confidential.
If you are not the intended recipient, you must not use or disclose the
information. If you have received this email in error, please inform us
promptly by reply email or by telephoning +61 2 9286 5555. Please delete the
email and destroy any printed copy. 


Any views expressed in this message are those of the individual sender. You
may not rely on this message as advice unless it has been electronically
signed by a Partner of BDO or it is subsequently confirmed by letter or fax
signed by a Partner of BDO.

BDO accepts no liability for any damage caused by this email or its
attachments due to viruses, interference, interception, corruption or
unauthorised access.

---------------------------------------------------------------------------
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The Norwich University program offers unparalleled Infosec management 
education and the case study affords you unmatched consulting experience. 
Tailor your education to your own professional goals with degree 
customizations including Emergency Management, Business Continuity Planning,

Computer Emergency Response Teams, and Digital Investigations. 

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------


---------------------------------------------------------------------------
EARN A MASTER OF SCIENCE IN INFORMATION ASSURANCE - ONLINE
The Norwich University program offers unparalleled Infosec management
education and the case study affords you unmatched consulting experience.
Tailor your education to your own professional goals with degree
customizations including Emergency Management, Business Continuity Planning,
Computer Emergency Response Teams, and Digital Investigations.

http://www.msia.norwich.edu/secfocus
---------------------------------------------------------------------------