http://www.zdnet.com/zdnn/stories/news/0,4586,2140612,00.html
|
New security flap over Windows NT |
|
|
By Mary Jo Foley,
Sm@rt Reseller September 23, 1998 11:06 AM PT Ed Curry is a man on a mission. Curry says he is out to warn the government that Windows NT is not secure, and will soon meet with the Secretary of Defense staff. Microsoft Corp. says he is on a personal vendetta against the company. The issue over which the two sides are at odds is C2 certification of NT. C2 is a basic security rating that is one of several evaluations awarded by the National Security Agency (NSA), based on its Trusted Computer System Evaluation Criteria (TCSEC), or "Orange Book" criteria.
From this point, Curry's and Microsoft's respective accounts diverge on what happened next.
SAIC to take over certification efforts To date, Microsoft has not obtained C2 certification for any release of NT beyond version 3.5, the company acknowledges. Curry, meanwhile, says he was forced out of business when Microsoft ceased working with him. In recent months, Curry stepped up his campaign to alert the government and the public in general about "the government's procurement of millions of copies of non-evaluated versions of Windows NT that fail to meet the C2-level security requirements of the Department of Defense and other agencies."
Curry wouldn't lie about MS violations "Microsoft has knowingly and willfully concealed information regarding security flaws in computer hardware from the NSA out of fear that revealing such flaws would reduce the number of copies of its products that would be purchased by the government," Curry's letter to Cohen says. "I have raised this issue internally with Microsoft, and in return have been the subject of both bribes and threats." Microsoft's response: "Ed's making a mountain out of a molehill," in the words of a Microsoft spokesperson. Will NT remain on the government's buy list? Stay tuned. | ||||||||||||||