Re: Security Level 50

["Al Barsa, Jr." <barsa2@xxxxxxx>]

At 09:39 PM 10/1/97 -0500, you wrote:
>>> I was just discussing this with someone else, and was wondering if
>anyone out there is using security level 50 on the AS/400.  What
>advantages does 50 provide over level 40?  What are the considerations
>in moving from 40 to 50?  From 30 to 50?  All insight appreciated... <<
>
>Dean,
>
>From what I remember of the level 50 announcement, it provides
>compliance with some DOD requirements that are of little or no value to
>a commercial shop, and cause a fair amount of overhead. One of the
>things that I remember it doing is modifying the delete processing so
>that if you run DLTF, it will not only remove the object definition, but
>write a constant (x'EF' I think??) to the data space not once, but
>multiple times. I haven't thought much about it since. I wonder if
>anyone knows of anything it does that is really useful. Going from 30 to
>50 will give you the aforementioned benifits also, but in addition, my
>preceived main benifit is that you'll get enforced compliance so that no
>unholy (not blessed by IBM) interfaces to system code can be run. I like
>that one.
>
Level 50 is what is necessary for C2 compliance.  Believe it or not, C2 is
the standard that many customers (particularly Eurpoeans) use as a standard
when they compare computer securioty.

Regardless, we run Level 40 which is the the shipped default.

Al

Al Barsa, Jr. - Account for Midrange-L
Barsa Consulting, LLC.  
400 > 390

Phone:  914-251-9400
Fax:    914-251-9406





Private mail should be sent to barsa@ibm.net
+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to "MIDRANGE-L@midrange.com".
| To unsubscribe from this list send email to MAJORDOMO@midrange.com
|    and specify 'unsubscribe MIDRANGE-L' in the body of your message.
| Questions should be directed to the list owner/operator: david@midrange.com
+---