, 2006-03-07
There is value in finding vulnerabilities. Yet many people believe that a vulnerability doesn't exist until it is disclosed to the public. We know that vulnerabilities need to be disclosed, but what role do vendors have to make these issues public?
Expand all |
Post comment
The value of vulnerabilities
2006-03-08
Omar A. Herrera (2 replies)
Omar A. Herrera (2 replies)
They do exist with varried degrees of assurance that they provide the security mechanisms called for in their design and deployment.
Read the following links for more information:
http://www.commoncriteriaportal.org/public/files/epfiles/CRP
170v3.pdf
http://www.commoncriteriaportal.org/public/files/epfiles/TSo
laris8_Issue3.1.pdf
http://www.commoncriteriaportal.org/public/files/epfiles/ST_
VID4025-VR.pdf
http://www.commoncriteriaportal.org/public/files/epfiles/CCE
VS_VID402-ST.pdf
The 1st two links talk about the security mechanisms Trusted Solaris attempt to provide. It also shows the level of assurance that it provides for. The 2nd two links shows the same type of information for windows 2003.
It's not just theory =).
Robert E. Lee
Dyad Security
[ reply ]
Link to this comment: http://www.securityfocus.com/comments/columns/391/33313#33313