Re: Penetration testing via shrinkware

["Marcus J. Ranum" <mjr () nfr net>]

Christopher Nicholls wrote:
> Have you checked out the Common Criteria model?

Yeah, it's like the orange book written by lawyers.

Clearly what happened is that the orange book specs were too
complex to implement in a timely and cost effective manner.
So the powers that be decided to implement a security
evaluation criteria model that would allow them to redefine
things so that basically anything is OK as long as you
say it's OK. Cover the problem with layers of paper. :(

mjr.
--
Marcus J. Ranum, CEO, Network Flight Recorder, Inc.
work - http://www.nfr.net
home - http://www.clark.net/pub/mjr