[Info-vax] VMS security versus other OS security, was: Re: A possible platform for VMS?

[William Pechter]

In article <65dbb773-ea27-4e2b-bc5e-3a3ecc865ff6 at googlegroups.com>,
 <johnwallace4 at yahoo.co.uk> wrote:
>On Friday, 27 February 2015 13:40:35 UTC, Simon Clubley  wrote:
>> On 2015-02-27, Bob Gezelter <gezelter at rlgsc.com> wrote:
>> >
>> > Having recently seen some research on the pervasiveness of poor
>> > implementation in other (e.g., Windows and *IX kernels, including
>Linux), and
>> > taking into account the ongoing and major problems resulting from security
>> > compromises, there could be a market opportunity in a variety of
>spaces for a
>> > far more secure platform.
>> >
>> 
>> When comparing VMS security to modern operating systems, it would be
>> a good idea to remember that while VMS security has traditionally
>> been well ahead in traditional security practices, those modern
>> operating systems have a number of security concepts built in which
>> simply don't exist in VMS.
>> 
>> A couple of examples are the MAC based security present in (for example)
>> SELinux and various forms of jails.
>> 
>> It would also be wise to remember that the Purdy algorithm is considered
>> to be way too efficient/light on resource requirements when compared to
>> modern password algorithms.
>> 
>> IOW, VMS has a very good security background it can build on, but it
>> needs some serious updating to compete with some modern security setups.
>> 
>> Simon.
>> 
>> -- 
>> Simon Clubley, clubley at remove_me.eisner.decus.org-Earth.UFP
>> Microsoft: Bringing you 1980s technology to a 21st century world
>
>Q: Are you aware that Mandatory Access Controls are nothing new to VMS
>(and, iirc, DIGITAL UNUX)?
>
>Distant memory says that both used to have Mandatory Access Control
>variants (Orange Book B1 secure for VMS, C2 for Tru64?). Documentation
>will confirm details for anyone who's that interested (not me right now).

I believe they were in the 3.5-3.6 up through 4.2 IIRC on VMS.

>
>Both fell out of favour over time - "cheap" generally used to trump
>"secure", and the extra work involved in the security enhanced variants
>was hard to justify when the major customers had decided that "cheap"
>was preferable to "secure". And even for the customers who wanted
>"secure", the first choice was frequently "Trusted Solaris" because it
>was what they knew.

Also, VMS met the C class on its own and B1 was pretty much used only for
Military/Intelligence sites.

Never saw it at Fort Monmouth in my time there up through 1990 or so.
But I'm sure the boys at Ft. Meade area did.

AT&T had a SysV version 3.x or 4 variant with Manditory Access Controls
around the early 1993 timeframe IIRC.

>
>In many cases "cheap" still does win against "secure", despite recent
>history, but some folks might have more motivation than others.

Still another issue is ease of admin.
I'm still getting my head around custom modules for SELINUX.

>
>Maybe the VMS mandatory access controls and such could be resurrected
>if "the market" has decided it's interesting again, possibly even worth
>paying for. "Paying for" may not mean paying VSI for, it may mean
>investing time+money in moving off legacy vulnerability-prone OSes in
>places that care about these things.

It should be integrated into the base OS if you ask me.
>
>Correction/expansion welcome - it's going back a loooong time.
>
>Whether an OS like VMS needs a concept like jails, and if so how much
>investment is needed, is another discussion. I'm not sure what underlying
>capabilities might be missing from VMS in order to implement something
>comparable with what the industry now calls 'jails', but it seems highly
>likely the ease of management of such stuff on VMS could be improved.
>
>VSI: resurrecting 1980s/1990s technology for a world that's finally
>realised it did actually need it sometimes :)
>
>Or, in short:
>
>DIGITAL had it *when*?

Bill

-- 
-- 
Digital had it then.  Don't you wish you could buy it now!
pechter-at-gmail.com  http://xkcd.com/705/