3 ms·

> If a developer claims to do security, ask to see the Covert, Channel Analysis of their product. > You'll find that most developers and "security professionals

> If a developer claims to do security, ask to see the Covert, Channel Analysis of their product. > You'll find that most developers and "security professionals" don't build secure stuff using methods proven to work in the past. Could you tell which security professionals actually offering such in depth analysis? I have the feeling that most penetration tests or security assessments offered aren't that deep, rather mostly of low-quality. Could you also tell how the NSA is doing their security evaluations exactly? I know there is Common Criteria, but these documents are so high-level that you can't derive the techniques on how to conduct thorough evaluations.

nickpsecurity 8y ago
Almost none. Most people in the security industry don't use techniques like that which proved out in older evaluations. My own framework for looking at things was heavily based on those methods. Common Criteria got too political where people might try to dodge requirements with hand-waiving. So, I'll give you that plus the VAX Retrospective since the design, layering, and assurance sections show you what methods were in use in 1990's high-assurance security. Also, the covert channel analysis was how they found cache-based, timing channels in it in 1992. Mainstream security ignored that for a long time, too. Most still don't give them credit. It's a social or clique thing that I can tell. http://lukemuehlhauser.com/wp-content/uploads/Karger-et-al-A-retrospective-on-the-VAX-VMM-security-kernel.pdf http://lukemuehlhauser.com/wp-content/uploads/Karger-et-al-A... https://pastebin.com/y3PufJ0V https://pastebin.com/y3PufJ0V For covert channels, you want to look up Kemmerer's Shared Resource Matrix for storage channels and Wray's method for timing channels. Those got early results. There's a lot of newer ones under banner of "information flow security." Google variations of those terms with "PDF" since they're PDF's to find lots of answers. Throw the word "survey" in with information flow since I think there was a survey paper. Finally, I'll throw in below my summary of assurance techniques I found over time: https://pastebin.com/uyNfvqcp https://pastebin.com/uyNfvqcp
- irundebian 8y ago
  Thank you very much! You're pastebin were really interesting to read.

nickpsecurity 8y ago

Almost none. Most people in the security industry don't use techniques like that which proved out in older evaluations. My own framework for looking at things was heavily based on those methods. Common Criteria got too political where people might try to dodge requirements with hand-waiving. So, I'll give you that plus the VAX Retrospective since the design, layering, and assurance sections show you what methods were in use in 1990's high-assurance security. Also, the covert channel analysis was how they found cache-based, timing channels in it in 1992. Mainstream security ignored that for a long time, too. Most still don't give them credit. It's a social or clique thing that I can tell. http://lukemuehlhauser.com/wp-content/uploads/Karger-et-al-A-retrospective-on-the-VAX-VMM-security-kernel.pdf http://lukemuehlhauser.com/wp-content/uploads/Karger-et-al-A... https://pastebin.com/y3PufJ0V https://pastebin.com/y3PufJ0V For covert channels, you want to look up Kemmerer's Shared Resource Matrix for storage channels and Wray's method for timing channels. Those got early results. There's a lot of newer ones under banner of "information flow security." Google variations of those terms with "PDF" since they're PDF's to find lots of answers. Throw the word "survey" in with information flow since I think there was a survey paper. Finally, I'll throw in below my summary of assurance techniques I found over time: https://pastebin.com/uyNfvqcp https://pastebin.com/uyNfvqcp

irundebian 8y ago
Thank you very much! You're pastebin were really interesting to read.