Power Tools 1993 November - Disc 2/Power Tools Plus (Disc 2 of 2)(November 1993)(HP).iso/hotlines/gsyhl/secwp.txt

Text File | 1993-04-23 | 40KB | 827 lines

General Systems Division
Series 800 System Security White Paper

1.  INTRODUCTION

Information, stored in computers as data, is a vital resource which has
become increasingly difficult to protect in today's computing
environments.  Among the most significant trends in computing are the
proliferation of distributed, desktop computing architectures, local-
area and global network access, multi-vendor solutions, and computer
literacy.  HP recognizes the threat that all of these trends represent
in increasing the vulnerability of its computer systems to security
failures. Moreover, HP believes that its continued success in the
computing solutions business depends on its ability to address these
threats.  In fact, In order to continue to be viewed as a strategic
partner to customers, HP must take a leadership role in solving the
global enterprise-wide security problem

This paper describes the HP strategy for addressing this challenge and
the role that HP 9000 Series 800 family business servers is playing.
Additionally, it covers the key security features and customer benefits
of both the HP-UX operating environment and an enhanced-security
version of HP-UX called HP-UX BLS.  Third-party software packages are
described which enhance HP-UX security in areas such as security
assessment and management.  Finally, an update is provided on GSY's
strategy to address the special security challenges associated with the
client-server paradigm of computing.

2.  BACKGROUND

A trusted system or network is a computing environment that is trusted
by its owner to process data in a well understood manner.  With the
knowledge of what a particular system or network can and cannot be
trusted to do, a system security administrator can assess the risks
associated with using a system or network in a particular installation
and make the appropriate tradeoffs between data security, data
accessibility, and system functionality.

Within the U.S. government the DoD "Trusted Computer System Evaluation
Criteria" (TCSEC or "Orange Book") is used as a standard metric for
evaluating and comparing operating systems.  Based on a lengthy
evaluation by the National Computer Security Center (NCSC), an
operating system running on a particular hardware platform is assigned
one of the following ratings in order of increasing level of trust:
C1, C2, B1, B2, B3 and A1 (see also Appendix A).  The NCSC is beginning
to conduct network evaluations based on the "Trusted Networking
Interpretation" of the Orange Book called the TNI or "Red Book."

Because the Orange and Red Books are widely accepted and understood
criteria, they have represented useful tools for evaluating systems for
use in commercial environments as well as federal government and
defense-related markets.  For this reason, they have served as
important product development models for trusted operating system
development at Hewlett-Packard.  However, since the Orange Book does
not address many commercial and non-U.S. sector needs, HP is supporting
efforts to develop more global and commercially-focused criteria which
complement previously established U.S.  metrics.  For example, HP is
participating in NIST and X-Open efforts to develop a standard criteria
for commercial security.  HP is also supporting U.S. federal government
efforts to develop more global evaluation criteria by harmonizing
"Orange Book" metrics with those subsequently developed for Europe (eg,
Germany's IT Security Criteria).

3.  STRATEGY AND VISION

Hewlett-Packard has a strategic framework for providing secure open
computing and services and GSY's Series 800 family of business servers
is the strategic open systems platform in this company-wide program.
Based on international standards, this strategy focuses on providing
easy-to-manage, interoperable, computing solutions.  As HP continues to
deliver on its secure open computing strategy, HP will provide
integrated security solutions across the broadest range of scalable
systems and devices as well as providing excellent pre- and post-sales
security consulting and support.

This strategy is being implemented through the ongoing development of a
security reference model which was launched at HP's Research
Laboratories in Bristol, England.  HP's model integrates a
comprehensive and modular family of current and planned security
solutions allowing customers to tailor HP's offering to meet the
particular needs of their environment.  The model integrates HP, OSF
and other third-party offerings so that customers have a degree of
choice to select best-in-class solutions.  Based on the emerging
standard OpenView network management technology, HP's security model
integrates a common security management framework.

Securing global, open computing environments is an aggressive goal to
pursue. HP has technology building blocks such as B1-level secure
servers and workstations available today. These capabilities provide a
foundation upon which to build. These existing and planned S800 server
capabilities are the subject of the remainder of this paper. Please see
Appendix B to find out how to learn more about HP's strategic framework
for delivering secure open computing.

4.  OPERATING SYSTEM, NETWORKING, AND DATABASES

This section details the features and benefits of HP's commercial
security offering based on the HP-UX operating environment, including
secure networking and third-party security application support.  Future
directions for enhancing HP-UX commercial security are also described.
Further, it describes the key features and customer benefits of the
enhanced security version of HP-UX called HP-UX BLS.

4.1 HP-UX

With the implementation of available security enhancements to HP-UX
described below, HP-UX offers an operating environment which meets the
majority of commercial customer security requirements.  HP-UX is
designed to exceed the US Department of Defense (DoD) "Orange Book"
criteria for a C2 rating.  Currently, HP has no plans to pursue an NCSC
evaluation of HP-UX at the C2 level of trust since commercial customers
typically rely on their own internal certification processes.
Nevertheless, some customers request a statement of functional
compliance in lieu of a formal NCSC evaluation (see Appendix C).

4.1.1 Auditing.  HP-UX maintains an audit log of security relevant
events.  For maximum accountability auditing can be set to log every
time any user on the system issues a system call.  For customers
concerned with maximizing performance, auditing can be configured to
audit a subset of users for particular events such as failed attempts
to login or access files and printers.  Auditing provides customers
with two primary benefits.  First, Auditing improves user
accountability and deters unauthorized actions.  Second, it provides a
tool for assessing damage from security failures.

4.1.2 Access Control Lists.  ACLs give the end-user increased
flexibility in authorizing or restricting file access on the basis of
"need to know".  By default the Access Control List for any given file
initially consists of the user group assigned by the system
administrator when the user was added to the system.  The file owner
can add or delete individuals from that list by issuing a simple
command. To accomplish the same result in generic UNIX implementations
would require some clumsy manipulation of user groups by the system
administrator.  Through the implementation of ACLs--a B3-level feature-
-HP-UX exceeds the discretionary access control requirement for C2-
level systems.

4.1.3 Protected Password Database.  It is important to protect
passwords in order to prevent unauthorized file access, copy,
modification, or capture of privileges.  Also, failure to properly
authenticate users on the system foils user accountability.  In HP-UX
the encrypted password data field can be relocated to a file which is
only accessable by the superuser.  In generic versions of UNIX, the
"etc/passwd" file containing the encrypted password field is publicly
readable.  Users can then copy the encrypted passwords into a personal
file and run a program designed to crack easy passwords.

4.1.4 Documentation.  HP-UX includes a special chapter in the "Guide to
HP-UX" which educates the end-user on security policy and user
responsibility, security features of the operating system, and how to
use new features like ACLs.  In addition, a special system
administrator guide called "HP-UX System Security" is provided which
explains how to set up and maintain a secure system.  It describes, for
example, how to configure the auditing parameters and interpret the
audit log data and how to control user access to directories and files.

4.1.5 Networking.  Today LAN Link and ARPA Services running on the
currently available HP-UX operating system are designed to meet the C2-
level of trust.

4.1.6 Third-party Security Management Software.  The success of the
S800 in the marketplace has attracted a host of developers of system
administration packages for the HP-UX operating environment in general.
New security software packages which augment HP-UX functionality in the
areas of security management and security assessment include "Security
Toolkit" from Raxco, "Usecure" from System Center, "CA-Unicenter" from
Computer Associates, and "Security Audit" from Interactive Systems.
Appendix D provides company contact information as well general product
overviews and detailed feature descriptions.

4.1.7 HP-UX Commercial Security Direction

Commercial security will be a major design theme in upcoming HP-UX
releases.  While HP-UX currently offers a solid base of security
functionality for Unix environments, more robust functionality is
desirable in environments where the Series 800 serves as a mainframe
alternative.  Enhancements to HP-UX commercial security functionality
will be primarily in the areas of password management, login
restrictions or system access control, and system administrator roles.

Password management features include password generation, password
selection/screening, and password aging functionality.  Login
restrictions include time-of-day access control, unattended terminal
time-out, and terminal ID access control.  Many of these features are
available today from third-parties.  However, GSY's direction is to
offer these as standard features administered through a consistent
easy-to-use system administrator interface (SAM).

The roles capability provides pre-packaged system administrator
accounts such as security administrator, system manager, and system
operator. This avoids the necessity to assign the superuser privilege
to users which are only responsible for a narrowly defined set of tasks
such backing-up and restoring a system.  Password management, login
restriction, and roles are features which are currently available on
HP-UX BLS described next.  Thus, the HP-UX implementation may leverage
heavily from the code already developed for HP-UX BLS.

4.2 HP-UX BLS

HP-UX BLS (B-Level Security) is an enhanced security version of the HP-
UX operating system.  HP-UX BLS addresses the more complex "multi-
level" security needs typical in federal government and defense-related
communities which process sensitive information.  HP-UX BLS is
currently under evaluation by the NCSC targeting a B1 rating.  HP is
currently in the Design Analysis phase which is the second phase of a
three-step evaluation process.  Upon completion of the evaluation
process, HP-UX BLS will be placed on the NCSC Evaluated Products List
(EPL).

The HP-UX BLS system strategy is based on a commitment to implementing
industry standards to facilitate application portability and multi-
vendor interoperability.  Accordingly, HP-UX BLS integrates de facto
standard secure system technology selected by OSF with HP-UX Release
8.0.  Thus, because both HP-UX BLS and OSF trusted systems strategies
are consistent, HP-UX protects customers investment in security for
customers which migrate between or interoperate within OSF-based
security environments.  In addition, HP-UX BLS complies with the System
V Interface Definition, Issue 2 (SVID2) and will comply with IEEE's
POSIX (1003.6) once the definition is established for operating system
security extensions.

Since HP-UX BLS security enhancements are built into the software
architecture described below, unless restricted by the security policy,
off-the-shelf commercial applications will run without modification.
Similarly, many of the value-added applications, tools, and features,
developed for HP-UX will function in a secure fashion.  For example,
HP-UX BLS inherits from HP-UX support for Autoconfig; C, Pascal, COBOL,
and FORTRAN; and new end-user tools such as Terminal Session Manager.

B1-level security is a superset of the requirements at the C2 level.
As a result, some feature and benefit descriptions reference the
discussion of HP-UX above.  However, while HP-UX and HP-UX BLS share
common security features, their implementations vary since HP-UX BLS
incorporates third-party (OSF) security technology.  As a result,
depending on the previous level of customer investment in implementing
standard HP-UX security features (e.g., ACLs, Auditing) there may be
some migration issues in moving to HP-UX BLS with respect to
application portability and user/system administration interface
consistency.

4.2.1 Security Architecture.  The core of the HP-UX BLS secure system
design is the Trusted Computing Base (TCB), the set of mechanisms
responsible for enforcing the system's security policies.  These
policies transparently protect information from disclosure to
unauthorized individuals.  HP-UX BLS supports sensitivity labeling in
conjunction with mandatory and discretionary access control policies to
control access to system information.

      Sensitivity Labeling.  Sensitivity labels are assigned to all
system subjects (e.g., users, processes) and objects (e.g., files,
devices).  The system supports a virtually unlimited number of labels
which can be hierarchical (e.g., secret, unclassified) and/or
categorical (e.g, NATO, personnel).  The initial assignment of labels
is the responsibility of the Systems Administrator.  These labels are
subsequently inherited by all files created in the user's session.

      Mandatory Access Control (MAC).  When users attempt to access
objects their sensitivity labels are compared using the Bell-LaPadula
model of computer security to determine access privileges.  This model
supports the concepts of read-down and write-up.  Users can read
objects at their own level and lower and write only to objects of the
same level.  This policy is referred to as "mandatory" since users can
not alter these access permissions at their own discretion.

      Discretionary Access Control (DAC).  This policy allows users to
grant or deny access at their own discretion within the limits of MAC.
Like HP-UX, HP-UX BLS enforces this policy through the implementation
of Access Control Lists (ACLs) which grant or deny a single user access
to files.

In combination these policies ensure that users have both the proper
clearance to access data as defined by MAC, and a user-controlled
"need-to-know" defined by DAC.  Since these security policies are built
into the software architecture, unless restricted by these policies,
commercial applications will run without modification.  It is the
responsibility of the System Administrator to determine whether or not
a given application can be trusted to run in a particular installation.

4.2.2 Password Management.  HP-UX BLS supports an elegant password
management mechanism that meets the objectives and recommendations of
the Department of Defense Password Management Guideline ("Green Book").
This mechanism supports password generation, screening, and aging
functionality in order to reliably identify and authenticate users.

4.2.3 Authentication Database.  The Authentication database consists of
a number of separate, secure databases designed to:  protect passwords;
control terminal access; ensure system file correctness; keep track of
device sensitivity and privilege assignment; and maintain system-wide
defaults for some of the entries in other databases so that a global
security policy is easy to define and change.

4.2.4 Least Privilege.  HP-UX BLS supports the principle of least
privilege which states that each subject should be given no more
privileges than absolutely required to perform its intended function.
In HP-UX BLS, the privileges that had been associated with the
superuser are divided up into a number of different authorizations.
Each privileged operation is associated with a set of authorizations.
Only users possessing the required authorization can run the privileged
operation.

Administrative tasks can be separated into a number of distinct roles.
This reduces the probability that an inadvertent administrator error
compromises security.  More importantly, it is no longer necessary to
tolerate the risk associated with super-user privilege on the system.
HP-UX BLS pre-defines three roles.  The "auth" administrator role
establishes and manages all user accounts.  The "audit" administrator
controls access to the security auditing mechanism, selects parameters
for audit, and assigns MAC labels.  The "sysadm" role is responsible
for most other general administration tasks (e.g, backup).

4.2.5 Trusted Path.  This B-2 Level mechanism provides a direct and
distinct communication path between HP-UX BLS and users.  It prevents
malicious attempts to capture a users password through the use of
programs designed to spoof users into typing passwords at fake login
prompts.

4.2.6 Auditing.  Like HP-UX, HP-UX BLS can maintain an extensive audit
log of all security relevant actions beginning with login.  The Audit
Administrator can select from a menu the event types, individual users,
user groups, sensitivity levels, and time intervals to be audited.

4.2.7 Import/Export.  This feature enables secure importation and
exportation of data so that B1-level of system security is not
compromised by the introduction of unlabeled data.

4.2.8 Multi-level Directories.  This allows processes with different
sensitivity labels to access files securely in public directories.

4.2.8 Documentation.  HP-UX BLS includes a "Security Features User
Guide" (SFUG) which educates the end-user on B-level security policy,
features, and user responsibility.  In addition, an administrator guide
called the "Trusted Facilities Manual" (TFM) is provided which explains
how to set up and maintain a multi-level secure system using the
intuitive menu-driven security interface to perform tasks.

4.2.9 BLS Networking.  HP-UX BLS is currently generally available in
only a stand-alone Series 800 environment since a multi-vendor standard
for B1-level security had not emerged in the planning window for this
release.  A second-phase trusted systems release is planned for
availability in the second-half 1992 timeframe.  This release will
support an emerging standard implementation of multi-vendor B1
networking spearheaded by supporters of the SecureWare/OSF operating
system technology.  It will feature secure ARPA/Berkeley services,
TCP/IP, LAN and NFS.  These networking components will be submitted for
Red Book evaluation.

4.2.10 BLS RDBMS Support.  The "Trusted Database Interpretation", which
is currently in draft form, interprets the requirements of the Orange
Book as they apply to databases.  HP has formulated agreements with the
leading relational database vendors to provide support for trusted
database products at the B1 level.  B1-level versions of Oracle and
Informix are available on the HP-UX BLS platform at this time.

Leading database vendors are working directly with the NCSC to obtain
an evaluation for their products.  Oracle has selected HP-UX BLS and
the Series 800 as their reference platform to base their NCSC
evaluation. As a result, HP will be among the first to market with
support for a B1 trusted version of the Oracle relational database
management system.

5.  SECURE CLIENT-SERVER COMPUTING BASED ON OSF/DCE

OSF's Distributed Computing Environment (DCE) is an integrated set of
services that supports the development and implementation of
distributed, client-server applications.  Security represents a
fundamental component of DCE.  HP was a primary technology contributor
and architect of the DCE security solution.  The current plan is to
support the DCE Developer's Toolkit in the 1992 timeframe and to
support the full end-user environment in 1993.  This section describes
the key features and benefits of DCE security services including
authentication, authorization, user account management, and secure
communications.

5.1 Kerberos Authentication

DCE incorporates an encryption based authentication service based on
the Kerberos system from MIT's Project Athena.  Kerberos has been
endorsed by Unix International (UI) as well as OSF.  DCE Kerberos is
based on MIT's Kerberos Version 5.  Due to known incompatibilities with
previous versions of Kerberos, HP has chosen not to provide general
support for non-DCE versions and recommends that most customers wait
for the availability of DCE Kerberos before implementing.

5.1.1 Need for Kerberos.  The security functionality supported by HP-UX
and HP-UX BLS (described in Section 4) is sufficient for controlled
network environments with well understood network connections and well
policed users.  These environments are typically characterized by
stand-alone or networked host-terminal configurations.  However,
increasingly computing environments are characterized by explosive,
out-of-control growth of networks, workstation nodes, local and remote
entry points, and unauthorized users or hackers.

In these type of environments it is critical to keep sensitive
information such as passwords from being transmitted over the network.
The common use of broadcast based network technologies make the
interception of network traffic by novice hackers simple.

Another critical vulnerability of today's networks is the reliance on
the Berkeley trusted hosts "R" commands (rlogin, rcp, etc.)  which
permits the trusting of one host by another.  The "R" commands
facilitate cracking by making it easy for a cracker, having broken into
one host, to break into other hosts which trust it.  In a highly
distributed environment, it is difficult for system administrators to
know which hosts their own system trusts and to determine where the
trust stops.

Finally, in a client-server environment in which a user may wish to
access several specialized servers to perform various services (e.g.,
compute, file, print services), it is necessary for administrators to
maintain several password databases and for users to remember multiple
passwords.  This can become unmanageable for both users and
administrators.

5.1.2 Kerberos Benefits.  Kerberos allows network users to authenticate
themselves to network service providers without the use of a trusted
host relationship or by transmitting a password in plain text over the
network.  Moreover, Kerberos enables a user to provide a password to
the network only once.  It is not necessary to maintain a separate
password database for every server on the network.

5.1.3 Kerberos Requirements.  Kerberos requires the use of a dedicated
physically-secured authentication server.  The authentication server
communicates with the client by generating and authenticating tickets
for network services.  Tickets are encrypted in a private key which is
a function of the user's password.  The encryption algorithm used is
the Data Encryption Standard (DES).  Tickets have limited lifetimes.
This limits the damage that could be done by a user attempting to
capture and replay kerberos tickets, a threat sometimes referred to as
"masquerading".

Kerberos requires that every application or service (e.g., network
services) that needs to authenticate a user before granting access to
that service be modified or "kerberized" to function securely in a
kerberos authentication environment.

5.2 Authorization Services

After users are authenticated, they must receive authorization to use
resources, such as files. The authorization service gives applications
the tools they need to determine whether a user should have access to
resources. It also provides a simple and consistent way to manage
access control information.

DCE authorization services are integrated with the authentication
service described above.  Access control information is packaged in a
kerberos ticket.  The DCE authorization model currently only supports
identities and group membership information to be used in conjunction
with the ACL mechanism of a DCE server.  However, the model is
extensible and can evolve to accommodate other authorization attributes
or privileges such as MAC labels (e.g, HP-UX BLS sensitivity labels;
"top secret, project x").

5.3 User Registry Services

The User Registry Service provides a single, scalable mechanism for
dynamically managing user account information in distributed, multi-
vendor networks. This component was developed and submitted by HP and
is marketed separately as the PassWd Etc registry system (available now
on HP/Apollo Domain Servers).

The User Registry ensures the use of unique user names and passwords
across a distributed network of systems and services and ensures the
accuracy and consistency of this information at all sites.  It also
provides security for updates and changes.  Instead of storing account
information on multiple files residing on machines throughout the
network, it maintains a single, logical database of user account
information including user and group naming information, login account
information, and general system properties and policies.  It is well
integrated with Kerberos to provide a secure, reliable user account
management system.

5.4 Secure RPC

The integrity of all communications must be protected in order to use
authentication and authorization services effectively. HP's NCS
technology is used to support secure communications in distributed
environments by providing message corruption, detection, and privacy of
confidential information. Secure RPC uses the Kerberos mechanism to
provide secure communications.

APPENDIX A: TRUSTED SYSTEM LEVELS AND NCSC EVALUATION PROGRAM

The NCSC supports a commercial product evaluation program.  The
objective of the program is to work with vendors and evaluate trusted
systems to help determine whether a given system is sufficient for a
given application.  While a vendor's development effort focuses on
enhancements or modifications to the operating system, the scope of an
Orange Book evaluation is not limited to an examination of the
operating system code.  Rather, it is the interaction of a particular
operating system with a particular hardware/firmware architecture that
is the subject of an evaluation.

The Orange Book includes requirements for DoD security policy,
sensitivity labeling of objects for access control, user
identification, auditing, and system assurance.  The Orange Book
provides a list of metrics upon which the level at which the above
requirements are met can be evaluated.  The possible ratings in order
of increasing level of trustedness are: C1, C2, B1, B2, B3,  and A1.
Generally higher levels are supersets of the requirements of lower
levels.  The NCSC publishes an Evaluated Products List (EPL) that lists
all products that have been formally evaluated and assigned a rating.

The major characteristics of each level of classification are as
follows:

C1:  Discretionary Security Protection.  C1 systems provide rudimentary
protections in environments of cooperating users processing data at the
same level of sensitivity.  C1 systems have discretionary access
control (DAC) policy--which at the file owners discretion, grants or
denys file access to the granularity of an individual user rather than
group of users.  Most Unix systems could be evaluated at class C1.

C2:  Controlled Access Protection.  C2 adds auditing of security
relevant events for individual users.

B1:  Labeled Security Protection.  B1 augments C2 with sensitivity
labels and Mandatory Access Control (MAC).  In essence MAC policy
compares the sensitivity label of the user (e.g., top secret) to that
of the file or device (e.g., sensitive/unclassified) in order to
determine access. Since this policy is enforced by the system and not
left up to the users discretion it is called "Mandatory."

B2:  Structured Protection.  B2 systems have a system architecture
criterion that requires the core of the trusted computing base (TCB)--
the collection of system elements responsible for implementing the
security policy--be a modular kernel that implements only security-
relevant features and the basic protection aspects of the system.  This
modular kernel structure would be difficult to retrofit on to an
existing system.

B3:  Security Domains.  B3 adds requirements for security policy,
accountability, and assurance, the most significant of which is an
architectural requirement that the trusted system be small enough to be
subjected to thorough analysis and test.

A1:  Verified Design.  A1 requires formal methods to verify that the
trusted system implements its stated security policy.

In order to maintain evaluated product ratings in future releases, HP
participates in the Rating Maintenance Program (or RAMP) defined by the
NCSC.  RAMP integrates a rigorous set of procedures into the the
product development process to ensure the system continues to meet the
requirements for a given rating across operating system revisions.

APPENDIX B: C2 FUNCTIONAL COMPLIANCE STATEMENT

The security elements of HP-UX have been written to the specifications
of the U.S.  National Computer Security Center (NCSC) class C2 level
per the U.S.  Department of Defense Trusted Computer Evaluation
Criteria (DoD 5200.28-STD).  Previously, HP-UX has been submitted for
evaluation. However, HP has chosen not complete the formal evaluation
process, electing instead to re-deploy its NCSC evaluation resource on
the evaluation of a currently available class B1 version of the HP-UX
operating system called HP-UX BLS.  HP-UX BLS is currently in the
Design Analysis phase of evaluation.

Although the HP-UX operating system has not been formally evaluated by
the NCSC, users have certified that the functionality in the system is
sufficient for their use.  As with all Hewlett-Packard products, the
security sections of HP-UX have been subjected to the rigorous quality
and assurance testing which is carried out on all Hewlett-Packard
software and hardware products.  The functional requirements of the
class C2 level which have been summarily addressed in the security
design enhancements to HP-UX are described below.

1.    Security Policy

1.1   Discretionary Access Control

C2 requires that the Trusted Computing Base (TCB) define and control
access between users and objects (e.g, files).  The enforcement
mechanism must protect objects from unauthorized access and be capable
of including and excluding access to the granularity of a single user.

HP-UX meets the C2 Discretionary Access Control criterion through an
advanced (B-3 level) implementation called Access Control Lists (ACLs).
ACLs give the end-user increased flexibility in authorizing or
restricting file access on the basis of "need to know".

1.2   Object Reuse

C2 requires that all authorizations to information contained within a
storage object be revoked prior to initial assignment, allocation or
reallocation to a subject from the TCB's pool of unused objects.
Additionally, no information produced by a prior user is to be
available to any subject that obtains access to an object that has been
released back to the system.

HP-UX ensures that no residual data left on a storage object--as a
result of writes to and reads from storage media--is available to
users.  Unused fragments of storage space are zeroed out.

2.    Accountability

2.1   Identification and Authentication

C2 requires users to identify themselves to the TCB using a protected
mechanism (e.g, passwords) to authenticate the user's identity.  The
TCB must protect authentication data from unauthorized access.
Finally, the system must uniquely identify each user and associate this
identify with all auditable actions taken by the individual.

HP-UX provides a login and password mechanism so that users can be
reliably identified and authenticated.  Authentication data is
encrypted and at the administrator's option can be removed from a
publicly readable file and placed in a protected file accessible to
only privileged users.

2.2    Audit

The DoD criteria for a C2 level operating system includes a requirement
that the system maintain an audit log of security relevant events.  The
Audit Administrator can select from a menu the event types, individual
users, groups of users, sensitivity levels, and time intervals to be
audited.  Auditing can be configured to audit a subset of users for
particular events such as failed attempts to login or access files and
printers or use of particular system calls and commands.

3.    Documentation

3.1   Security Features User's Guide

C2 requires special user and systems administrator documentation.  HP-
UX includes a special chapter in the "Guide to HP-UX" which educates
the end-user on security policy and user responsibility, security
features of the operating system, and how to use new features like
ACLs.

3.2   Trusted Facility Manual

As required, a special systems administrator guide called "HP-UX System
Security" is provided which explains how to set up and maintain a
secure system.  It describes, for example, how to configure the
auditing parameters and interpret the audit log data and how to control
user access to directories and files.

APPENDIX C: HP SECURITY COUNCIL

An NSG-wide Security Council (SC) has been formed to coordinate the
development of a global enterprise-wide security solution.  Working
closely with the SC, GSY will provide a security reference model for
implementing secure open computing and services.  For more information
on SC plans contact:

Keith Klemba   SC Worldwide Program Coordinator    US 408-447-7513

or

Doug McGowan   SC Coordinator Europe               (49) 7031-141757

or

Wayne Caccamo  GSY Planning/SC Marketing             US 408-447-4020

APPENDIX D: THIRD-PARTY SECURITY SOFTWARE

1.  Company: RAXCO
    Product: Security Toolkit
    Order    RAXCO (US Headquarters)
    Infor:   2440 Research Blvd.
             Rockville, MD 20850
    Tel:     US [phone]
    Fax:     US [phone]

Security Toolkit menu-driven security reporting software is used by the
system security managers and auditors to assess and manage the security
of standalone or networked HP-UX systems.  Its purpose is to facilitate
regular and systematic security checks, and to ensure proper system
security implementation on one or more HP-UX systems, thus avoiding the
countless hours that would otherwise be required to perform security
tasks by manually executing Unix commands.  Security Toolkit collects,
interprets and reports on the following areas of HP-UX security:

*  Password safety checks

*  File system security

*  Known Unix vulnerability checks

*  Network set-up

*  Virus, Worm, Trojan Horse detection

*  User environment security (file permission, start-up file, and
variable validation)

Features:

*  Executes requests interactively as background or batch mode process

*  Generates shell scripts to automatically correct identified problems

*  Provides easy-to-use GUI implemented according to OSF/MOTIF style
guide

*  Includes context sensitive help

*  Implemented in "C" using X/Open's XPG3 interface

2.  Company: System Center
    Product: USECURE
    Order    1800 Alexander Bell Drive
    Infor:   Reston, VA 22091
    Tel:     [phone]
    Fax:     [phone]

USECURE is a system security administration package that delivers a
unique combination of user account management, disk utilization
management, and file usage reporting with full-screen ease of use.
Usecure provides the following security functionality:

*  Limits command access by user (USHELL)

*  Forces specific path name (USHELL)

*  Provides detailed audit trail of command access, logins, and all
system changes made with USECURE

*  Notifys administrator after specified number of of unsuccessful
logins

*  Sets login time limits on per user basis; can limit after hour login
sessions

*  Provides automatic password generation

*  Supports secondary login/password

*  Logs out unattended terminals

*  Provides key admin features without requiring administrator to have
superuser privilege

*  Reports on how resources are being used and by whom

*  Lists executable commands by user and vice versa

*  Lets users move or copy their own directories or files in one
process rather than one file at a time

*  Performs error checks, user account set-up, password generation,
file initialization by menu-driven selection

*  Can automatically clean up system on a regular basis Features:

*  Audit trails information is provided in full-screen format

*  Reports can be run immediately or as background or batch tasks

*  Provides set of tools with menu-driven package so that extensive
knowledge of Unix is not required

*  Common interface across different Unix vendor machines

3.  Company:  Computer Associates
    Product:  CA-Unicenter
    Order     711 Stewart Ave
    Infor:    Garden City, NY 11530
    Tel:      [phone]

CA-Unicenter is an integrated system management solution that addresses
fundamental requirements in Security, Control and Audit as well as
Performance Management, Storage Management, Data Center Administration,
and Production Control.  The Security module is not available as a
standalone component.  The integration of these otherwise discreet
modules makes the complete system a more powerful tool.  The Security,
Control and Audit (SCA) module provides the following security
functionality:



*  Provides system entry validation

*  Provides resource and facility access control

*  Provides user registration

*  Provides user audit

*  Provides system integrity

*  Enforces system entry policies and asset access control

*  Enforces periodic user password change and account suspension

*  Provides security for all system management functions Features:

*  Provides Single-point system administration for all users and
systems in the network (for defining and removing user IDs and
privileges)

*  Offers Graphical User Interface (Motif and text mode, command line
interface

4.  Company:  Interactive Systems Corporation
    Product:  Security Audit
    Order     1901 N.  Naper Blvd.
    Infor:    Naperville, IL 60540
    Tel:      [phone] (x384)
    Fax:      [phone]

Security Audit is an integrated software product designed to identify
security violations and security problems in the HP-UX environment.
Major security features are as follows:



*  Performs password guessing to prevent intruder breakins

*  Assures Trusted Path

*  Corrects user file permissions to prevent trojan horse attacks

*  Provides setuid/setgid file control

*  Monitors critical system file permissions owner, group, and contents

*  Detects unauthorized superusers

*  Detects idle terminals

*  Provides UUCP security analysis

*  Performs remote login configuration analysis

*  Detects bugs which allow security breaches