When C2 Is on the PO
In the Public Interest Doing Business with Governments When C2 is on the PO If you sell to the federal government, Orange Book was issued first in August 1983 and in December 1985 was reissued there is a good chance that your as a Department of Defense standard product will have to run on a (DOD 5200.28-STD). The Orange Book then became refer- trusted system. enced as a mandatory requirement for operating systems delivered to DOD. Once that happened, anyone who sold an operating system to DOD had to implement a trusted system. This forced firms, such as DEC, Hewlett-Packard, IBM onsider this scenario: Your firm’s Taken together, there are seven levels (in and others, to develop trusted versions of marketing efforts have finally suc- decreasing order of security): A1, B3, B2, their respective operating systems. This Cceeded in penetrating a large fed- B1, C2, C1 and D. The technical attribut- concept has moved beyond DOD, and eral agency. The potential for significant es of each are detailed in the Orange currently many civilian agencies, such as sales from this organization is large. Just Book, which is described below. the IRS, the Department of Agriculture, as you begin to count your revenue (or U.S. Customs and others, require a trust- your commission check if you’re the sales By the Book ed operating system on many if not all of person for this account), your prospect The National Computer Security Center their operating system purchases. While asks, “Your software does run on a C2 sys- (NCSC) evaluates the security features of this often does not include desktop oper- tem, doesn’t it?” trusted products against established tech- ating systems such as DOS and Windows, You answer, “Huh?” This might not be nical standards and criteria.
[Show full text]