Re: Level 50

[John Earl <johnearl@xxxxxxxxxx>]

Steve Glanstein wrote:

> Al and others:
>
> You ask why anyone would run on level 50?  Several reasons:
>
> 1.      Software designers who test their products at level 50 will have a 
>much
> greater
>         certainty that they will run at lower security levels.

Verily!  If my customers run under Level 50, I durn well better be able to run 
under
it.

<snip>

> 3.      I sure would like somebody to prove to me that there is a "great"
> performance
>         degradation with level 50.  Most of our RISC clients are on 50 and 
>they
> don't
>         know the difference, aside from the fact that they originally 
>approved it.

At the San Antonio COMMON, Patrick Butz from the IBM Security team refuted the 
notion
that Level 50 exacts a 15% performance hit.  He asserted that their testing 
showed
that the  performance price was closer to 3-4%.

> >Secondly, why is anyone (other than DOD) running at L50?  (This is a
> >serious, not a rhetorical question.)

Many people confuse Level 50 with DOD C2 security.  In order to run under C2
compliance, one of the numerous things oyu have to do is get your AS/400 to 
Security
Level 50.  But just changing QSECURITY=50 does not make you C2 compliant.

(You also have to remove all compilers, query tools, any network connections 
including
PC's.  All tape and diskette drives must be under lock and key, and your third 
grade
teacher must sign an affadavit swearing that you were not the person who shot 
all
those spitballs on the ceiling).

jte


--
John Earl Lighthouse Software Inc.
8514 71st NW Gig Harbor, WA 98335
253-858-7388 johnearl@lns400.com

Without Lighthouse Network Security/400, your AS/400 is wide open.
--



+---
| This is the Midrange System Mailing List!
| To submit a new message, send your mail to MIDRANGE-L@midrange.com.
| To unsubscribe from this list send email to MIDRANGE-L-UNSUB@midrange.com.
| Questions should be directed to the list owner/operator: david@midrange.com
+---