Re: Practical Firewall Metrics

[Leonard Miyata <leonard () geminisecure com>]

Considering the near universal rejection of NCSC 'Red Book'
network security standards, is this not surprising.

To be realistic, we can't expect to have our cake and eat it too.
To impose goverment mandated and regulated security standards on
the booming networking industry would bring the WARP SPEED advancement
of networking technologies to a screeching halt.

There are other examples I can point out as well. ALL of the networking
texts still claim that ISO OSI networking standards are TECHNICALLY
far superior to TCP/IP and with a much more formal OSI standards
process when compared to the informal IESG/IETF draft/RFC processs.
The proof is in the pudding so to speak.. where is ISO OSI today?

If the (pick one: networking industry, Internet, Free Market) was
willing to freeze development to a single set of standards, it MAY
be possible to establish REAL security standards. But with the
constant MARKETING demand for chrome plated shiny new features and
new markets (Voice over IP, Network Video, E-Comerce, etc.) this
will never happen.....

Personal Opinions Provided by
Leonard Miyata
aka leonard () geminisecure com
Gemini Computers Inc.

On Fri, 20 Feb 1998, Marcus J. Ranum wrote:
> Even NIST and NSA have hopelessly dropped the ball on this one,
> preferring to go down the common criteria "if we produce an unreadable
> standard, no one will read it" rathole. :(
>
> mjr.
> --
> Marcus J. Ranum, CEO, Network Flight Recorder, Inc.
> work - http://www.nfr.net
> home - http://www.clark.net/pub/mjr