NSA NCSC to Push EPL Marketing, Commercial Evaluations; IBM AS/400 rated C2

[13 Nov. 95] NSA's National Computer Security Center plans to raise the profile of its Evaluated Products List (EPL), according to an article by Paul Constance in Government Computer News (GCN). The article displays a snappy new logo that evaluated products will be able to display and reports that the NCSC plans to make the EPL available on the World Wide Web. Because it has only five NSA evaluators and sixty from federally funded R&D centers such as MITRE and Aerospace, NCSC will also become more selective about the products it chooses to evaluate, focusing on "market-leading operating systems and database software that meets industry standards for open, networked architecture and popular graphical interfaces," rather than accepting all products vendors offer for evaluation. At the same time, NCSC is cooperating with the National Institute for Standards and Technology (NIST) to study the feasibility of accrediting commercial laboratories to perform for-profit assessments of products up to the B1 level. An accreditation process could be in place as early as 1997, according to Dennis Kinch, chief of the NCSC's Trusted Product Evaluation division.

A news item in the same issue of GCN reports that IBM's AS/400 has received a C2 rating after more than three years of testing. The rating applies to AS/400 D, E, and F models which are available in special government configurations, although they are no longer in general production. An IBM representative said that the rating could apply to the current F-10 model if it runs OS/400 Version 2, Release 3. The rating also extends to the DB2 database for OS/400, according to the item.