Systems going back to the first one, SCOMP (1985), NSA certified as secure had to mediate and pentest all software in the system. That includes firmware with SC

Systems going back to the first one, SCOMP (1985), NSA certified as secure had to mediate and pentest all software in the system. That includes firmware with SCOMP also having an IOMMU. The typical practice of high-assurance security in the 2000's was using separation kernels or ASIC's to force all input from untrusted subjects to be mediated on every access to a privileged component against a precise, security policy. From Orange Book onto Common Criteria, the fears about malicious management meant they usually put in a dedicated serial port for local, authenticated access to admin functions. Remote admin would need a serial or kvm switch with some security on it depending on what remote meant. If it was long-distance, there would likely be a Type 1 encryptor for link or IP layer. Yeah, they've known it was a vulnerability for some time. Such a thing wasn't even allowed in secure systems with so-called "High Assurance Platform" being an attempt to mitigate risks in insecure boxes they know market will buy anyway. Stuff like SELinux Trusted Solaris, and so on go here. Recently, for SIGINT and/or politics, NSA is doing 90-day evaluations of COTS products to replace secure, Type-1 gear. The Assurance part that I saw had same requirements as EAL1: so low nobody certified to it to avoid being laughed at. I can only assume bringing in lowest grade stuff across whole DOD when medium assurance is already marketed is a BULLRUN-style subversion to boost surveillance. We don't need smart enemies with these kind of "Defense" policies.