U.S. Government agencies belatedly address information system security issues

This paper describes an evaluation of the effectiveness of two versions of Hewlett Packard's UNIX operating system, HP-UX, to protect a sensitive database set up under the ORACLE Data Base Management System, using Version 1.0 of the European Information Technology Security Evaluation Criteria (ITSEC) as the basis for the evaluation. An outline of these criteria is given, along with mention of the US Trusted Computer System Evaluation Criteria (TCSEC) for comparison purposes. The research project reported in this paper was aimed at determining the level of effort required to perform such an evaluation and also the relevance of the ITSEC to commercial environments where information systems security, incorporating authenticity, integrity and privacy, are of paramount concern. Two successive releases of the HP-UX operating system were found to be markedly different when evaluated from the ITSEC point of view, with the latter version being quite effective in maintaining security parameters. It was also concluded that evaluations are time consuming but can have positive implications for commercial systems developers.

The helminthiasis (infestation with, or disease caused by parasitic worms) of the Internet was the result of a self-replicating program that infected VAX computers and SUN-3 workstations running the 4.2 and 4.3 Berkeley UNIX code. The worm disrupted the operations of computers by accessing known security loopholes in applications closely associated with the operating system. Despite system administrators' efforts to eliminate the program, the infection continued to attack and spread to other sites across the United States.