NSA NCSC to Push EPL Marketing, Commercial Evaluations;
IBM AS/400 rated C2
[13 Nov. 95] NSA's
National Computer Security Center plans to raise the profile of its Evaluated Products
List (EPL), according to an article by Paul Constance in Government Computer News (GCN).
The article displays a snappy new logo that evaluated products will be able to display
and reports that the NCSC plans to make the EPL available on the World Wide Web.
Because it has only five NSA evaluators and sixty from federally funded R&D centers
such as MITRE and Aerospace, NCSC will also become more selective about the products
it chooses to evaluate, focusing on "market-leading operating systems and database
software that meets industry standards for open, networked architecture and popular
graphical interfaces," rather than accepting all products vendors offer for evaluation. At
the same time, NCSC is cooperating with the National Institute for Standards and
Technology (NIST) to study the feasibility of accrediting commercial laboratories
to perform for-profit assessments of products up to the B1 level. An accreditation process
could be in place as early as 1997, according to Dennis Kinch, chief of the NCSC's
Trusted Product Evaluation division.
A news item in the same issue of GCN
reports that IBM's AS/400 has received a C2 rating after more than three years of
testing. The rating applies to AS/400 D, E, and F models which are available in
special government configurations, although they are no longer in general production.
An IBM representative said that the rating could apply to the current F-10 model if it runs
OS/400 Version 2, Release 3. The rating also extends to the DB2 database for OS/400,
according to the item.