From rpl@dsg.npl.co.uk Tue Jan 17 17:19:16 1995 Received: from mgate.npl.co.uk by dkuug.dk with SMTP id AA06283 (5.65c8/IDA-1.4.4j for ); Tue, 17 Jan 1995 18:18:56 +0100 Received: from vivaldi.dsg.npl.co.uk by mgate.npl.co.uk; Tue, 17 Jan 1995 17:18:40 GMT Message-Id: <3898.9501171718@vivaldi.dsg.npl.co.uk> Received: from elgar by vivaldi.dsg.npl.co.uk; Tue, 17 Jan 95 17:18:36 GMT X-Sender: rpl@vivaldi Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Date: Tue, 17 Jan 1995 17:19:16 +0000 To: sc22wg15@dkuug.dk From: rpl@dsg.npl.co.uk (Richard Lampard) Subject: POSIX Apps Conformance X-Mailer: X-Charset: ASCII X-Char-Esc: 29 Dr Cannon, I have read you email (containing material by Robert Smith of the NHS) on the NHS requirement for POSIX compliant products, hence POSIX conformance testing (it was in the latest POSIX mailing). At the NPL, we are looking at ways of augmenting conformance test suites in order to gain some degree of assurance (i.e. confidence in the security provided by the application). Our approach (called strict conformance testing) still relies on standardised, black box test suites so cannot provide the same level of assurance as a formal security evaluation. Nevertheless, the tests attempt to demonstrate the behaviour of an implementation in response to threats, and also demonstrate the presence or otherwise of well known vulnerabilities. Despite the limitations of the approach, we were able to detect two serious non-conformances (leading to vulnerabilities) in a modem product design which implemented ISO 9798 (entity authentication). This was done by a manual application of the augmented test suite to the design. The developer estimates that he has saved 10% of his development costs as a result, since the flaws were discovered early on in the development. Given the privacy requirements for medical data, it seems to me that organisations such as the NHS need secure as well as POSIX compliant products. Do you think they would be interested in our approach? Regards, Richard Lampard National Physical Laboratory Queens Road Teddington Middlesex TW11 0LW UK Tel: +44 (0)181-943 7060 Fax: +44 (0)181-977 7091