ࡱ> gif7 bjbjUU ߔ7|7|l0000000D8 D#: 4$ 8 $ /0D "D D 00D 00D 00 DJ 0# $DD0000Argus Systems Group HYPERLINK "http://www.argus-systems.com" \t "blank" (www.argus-systems.com) PitBull.comPackTM Executive Summary The SEWPSC is a SEWP-sponsored facility that evaluates IT security products and components of commercial off-the-shelf (COTS) products to determine their usability as well as to assess the vendor claims. The SEWPSC demonstrates security features of commercial, public domain, and Government products that can support dependable security architectures. The testing outlined in this document was conducted to assess ARGUS SYSTEMS GROUP, Inc. claims of performance, technical security, functionality and interoperability for their PitBull Foundation TM and PitBull.comPack TM product in an environment modeling typical user architecture(s), NASA constructed an environment reflecting their own other typical environments. During the period 23-25 August 00, the staff of NASA's SEWPSC tested PitBull.comPack, a high-security web/transaction software product for Sun Microsystems' Solaris 2.7 servers (NOTE: Versions of this product are also available for IBM's AIX 4.33). The testing was conducted under the auspices of DoD's Security-Proof of Concept-Keystone (SPOCK) consortium and was supported by members of the SPOCK management office as well as the vendor, Argus Systems Group, Inc. The purpose of this initial report is to provide the results of this test relative to whether or not the vendor-provided product claims were successfully demonstrated to the NASA/SEWP's satisfaction. Representatives from NASA SEWPSC, DoD, and Argus Systems Group conducted an extensive array of tests against 10 vendor-provided and 3 NASA-requested product claims (see result matrix on the following page). On all claims tested, it was concluded that PitBull.comPack successfully demonstrated the product's ability to meet all claims tested (See Preliminary Result Matrix). Claim 8a was the only claim not tested due to the lack, at NASA, of a PAM-compliant biometric authentication product. Interested government agencies should note that the Argus product is now available via the NASA SEWP II procurement vehicle. Additional information on the product, the testing process, and the testing methodology can be found within the PitBull.comPack SPOCK Claims Package dated August 00 and the Argus White Paper: PitBull Security-The solution Set for Secure Systems, dated July 00. see  HYPERLINK "http://www.coact.com" \t "blank" www.coact.com for points of contact and information on the NSA/V2 sponsored SPOCK consortium. SPOCK is scheduled to conduct additional testing on the:PitBull.comPack Product and compile a summarized SPOCK report containing details and combined input of the SEWPSC and follow-on exercises. The complete SEWPSC Argus report is available to authorized US government employees. To request a copy, send an email to:  HYPERLINK "mailto:sewpsc_reports@sewp.nasa.gov" sewpsc_reports@sewp.nasa.gov. Please include a contact name, Agency name, phone number, and fax number in your email. PRELIMINARY RESULTS MatrixSUBSTANTIATEDNOT SUBSTANTIATEDTESTEDClaim 1:PitBull.comPack 2.1 installs onto operational Solaris 2.7 (recommended release date of 8/99 or later) hosts running standard applications without requiring the removal/ reintegration of the existing operating system or application software.XClaim 2: When users of Argus systems install applications conforming to commercial Solaris API(s), these applications will function in the same manner that they would on standard Solaris 7.2.Internet-centricXClaim 3: PitBull.comPack will provide a secure interface between unauthorized users and sensitive internal applications and systems.In so doing, it can also segregate multiple networks and create virtual networks.XClaim 4: PitBull.comPack enforces the integrity of network transactions through separation of duties and the two-person rule (See 4a and 4b):4.Transparent/Dependable 4a:PitBull.comPack provides a mechanism for controlling user authorizations of both users and administrators via operating system-enforced security.X4b: Enforces Two-Person Rule and Administrative Roles of Information System Security Officer, System Administrator, and System OperatorX5.Protects Web Pages against unauthorized modificationX6.Provides operating system enforced Mandatory Access Controls (MAC) (to data, applications, network devices, and/or users)X7.Least Privilege is enforced upon users and applicationsX8.Flexible and configurable security to include (See 8a and 8b):8a:Enhanced password/authentication mechanisms utilizing Pluggable Authentication Modules (PAM).X8b:Secure Remote SSH Administration X9.Value Added (NASA Originated) Demonstrations (See 9a and 9b):9a: Monitors and records subsystem security-relevant events.X9b: Provides threat protection via compartmentalization (labeling)/ safeguards X9c. Examine Command Center GUI for applicability to system security administration functions X      IJabrt< C  M b c ./`a}~jUmHnHu jU0J\ jU\ 6\] 6>*\]H*\\5H*0J5 j5U5+uV $If@&$a$ cYPJJ$If $$Ifa$ $If`$$Ifl\@ ! e 8 t0,"44 laa\[R[[ $$Ifa$$If$$Ifl \@ ! e 8 t0,"44 laat[R[[ $$Ifa$$If$$Iflf\@ ! e 8 t0,"44 lay{}a[[[[$If$$Ifl\@ ! e 8 t0,"44 laapWNHH$If $$Ifa$ $If^$$IflK\@ ! e 8 t0,"44 laa<WNHH$If $$Ifa$ $If^$$Ifl \@ ! e 8 t0,"44 laa[R[[ $$Ifa$$If$$IflJ\@ ! e 8 t0,"44 laegika [R[[ $$Ifa$$If$$Ifl\@ ! e 8 t0,"44 lakla[R[[ $$Ifa$$If$$IflJ\@ ! e 8 t0,"44 laa [[[[$If$$Ifl\@ ! e 8 t0,"44 laVXZ\aWQQH $$Ifa$$If $If^$$Iflz\@ ! e 8 t0,"44 la\]aWNHH$If $$Ifa$ $If^$$Ifl\@ ! e 8 t0,"44 laa[[[[$If$$Ifl\@ ! e 8 t0,"44 la aWNHH$If $$Ifa$ $If^$$Ifl.\@ ! e 8 t0,"44 ladfhja\WNHH$If $$Ifa$ $If^$$Ifl\@ ! e 8 t0,"44 lajkaWNHH$If $$Ifa$ $If^$$IflJ\@ ! e 8 t0,"44 laa_________$$Ifl\@ ! e 8 t0,"44 la $a$$&P1h/ =!"#$%nRIu=4@PNG  IHDR6bKGD#2 cmPPJCmp0712`RAIDATx^wegyw{ۜuTi@W\B\5q㸀 &$`MG I#M3s~9׵W]gFXNyH{wcW\ |C$< s"0|"80߅KpE8;cac>"D/%}bІ[zcC^Ъ$\ȅ'5>y'}4hc(x5t%Qh |x̅V.# 8jчA%hF`yk>'QGAo_C }n=<3|i98 (41 `px4`^]܇N> fmhh୷̅ Kk 1Ft + ]_} $~=njtO{t#qL`Ck`#jHF Eɚ6S虶1^9 [JFC=g=幣*NЄ 'ŒM'XSCLR=< w&"fEs!0D2Be~Ff51FèaB KOPR}6'q74A lZ)*dјLce:q78B<1 >q;)9nrT8;^$"`e,IJ]m21:=)ɂ!r9ٚ7v_2{tUnƤp1f㤊P:.F:c&aQ?0$`1 z-Nѵ &H=R"eؒ4 'щBt M<\zd.(]RA«(EkYDA=fz=9?ͳ$lQGYzu8X,0—8%p_(fZ{TFO..G6]r.246M qQQK1!ep;x:t:\p< mhs0]8 xЁOB;˄מAРP6G,~(#`ЇQn( A~o7)†Ldi}9]4}$sO@8W/>򳑹~ %ֳBkw;am4f<cϭ^}?@֙p}hW³GA"HkE6Ah!uQF_؀6/)㤲غGn\ϥa%6= i2؃ApY\+|C"/h(7IH{׮oǎ;O6UkVpZuI'0O"}`3E6Hkd)uaKbs=l쒁mRg#!^[) M ; "A9 ~?K~?zv|5?SaėnּGEA80v,DɈE`y䮕:an<wI`;M5G*ʛMBrZ8u&9(6)l$Peasˇ=zTL>nc'}Ĕ6#jԪE1|##>mxN ӍTB0VrB uўKrp42'jS~jI$VH"ROXrbM2:u-דh(qoĤ_Br K uwHN5&aqTb8> VC.Fk pmHű[.&}ѿ'`uT7Tz. _JOރЧ)>I qm;_/֟BƧޞLƞ5bx7ԬL"[d8u51vwFmD/NMklD_E^{!HS߾\$RK& $2cѩ 4jqHC{TbF )>>7_ӭM5&pTF\֣}s͛3y]5iKEhw}`II]qHǽ-hK =8(yv9G.ѕ}v&Y`ߓ?i 3úspr@q t @l7JFZZ~:98fjuH#a&ڂ(Bow/5~OvEE # )p v}WF& x\3LP t0bju[^bstYCr= k{Ӡ}F![;p~FF E]*"j`or*tvÁ͍ϱ/txl70B( AoXܳ3ɖ4Anн~";]YH ӿxw\cxCBO3y l8uǷ/^D{z~W?!T3ˎetR7q9Ĺd1[$P;ٝ~)#J"q ǪezOq MNm Y.,qW=]'MB^z3ю8n8CZe ر+ ;"`´&OԘKBk<_^cOfn"P0ҤfTLܶ ꋡ-guПd>x}Fpsz{{'4ޅpOBVQ}[~#ڱ1Ԏ&&ٚfbkn!Z$DJT`9LľOpI8p^4)+; Էg_@.:$π؉G#뵩GF Cu}KXQQKFэD"6tX)Yx\R#>iL(Ɠ4 ,`0p %]"* *D;q#qwDc>1<ݎIŒȕYK.`'$:ģ#ऻX8& E`uї~FkDOȇ#4z>z>d<> b/е }Cmc.V*YdƍFSH6v֗e/0Vӂ}f/Nr5]Y啻eSl1 ;gN-IQ+׉MŝOc͛I"9}:voJ׫ :ؒN˃*.ϤkV{˴oEqTVN-e yfi '\KǾ%(XI ұ$/k-b =Se@\M+ns]ܨG+h%NMW@!Gfp$/ግfxۘQsI1K'B BOGH;9pdo8fPzia03oBJ4/op۞(XR1d]f44ntJ&*,ioi|{3c@s ̅pY L#Lߦ.D`Cj>&0UKRG{pD⡉swvSru׏^GΨ߮DW"o,KAq7#u `mX<: @؁8Z>;>]TyeK9;rIg.*tI 8pwυ1GLR8y.' swSwzdT}u>K}Kx4/-C*HjMz8NL䡙ښ9"JB^hADphRocp]r">B_*,9Y|R ې09a)PgwaUpƝ sɥ%"bNWG_qDlwcqn98hod#ٶY̎jJup`yЬ Vc`J`a$Viw3#6\[8z.$ i[#6Wrpu_b)p9Q01Bz=6R L{&l^z=<}Xtf)+e]q'Qa[%DtRkGNmࢲ9.&qkoCH naή/ŽMEQZW<{ @V/ eQV`XC, tNGmhn.:gt*ʱȠᐙ"yX$# vjܦ Z (tD4"ѨJ Hƥb>J!J4Hϼq;c_䃿xu&8:&c}GЍ<>? ߡmZ+M䐹hk69K&ǮgD%)]m!ٗXg;(&ØqKY\`f'/ڿ16OѨ]9R̊L]ÜgOce_}# 2y*ms#6 w2w*oE-zAji]}][%Sn8Ootz&{V tmA2"dhaEgn"?oݳts2P9M$u0T]q[%X#vGCy 1^4g{bh-{7^i4!Tzפ5jf$U} t_DoJ_b(;פuA°"fõ?A?4|E~?ߺ@?6|ZsGm:_Gf}= ЎAi@bqY!y˪- "3A, ;~BrN;'LشQRj0a:Ê; :whÔh D 7o5!螠| \[G{V7 HJvflp ]? !XYR#Xh N q"XKa8[n1gNaMte)hIDAM+A#A"*509FqEcÎϐl4q8,=xk &M b.>Y}m @]f 3S! wK.xSSP_V'JV}@?~ ~=זTbx?7ܓ$s޿xm3+ZqhjG KfKP=l%]@WzgbUI9K+0dZ[:a bGli0!M@G1WRd(/\ ˞M\Rl: E\TQK@Ba%#5pQ15(q9I-FFB⅀Gi *DnmT&FYDA pR:X =ܱKMNHܛiInup*vG Ӻ\6N޽ta=0ٳg.'qƭy8|2H$[(0:zH\d1RkIإ hB: {^w}iu?~իOW޳g{5J=jl:PA,pl (sQDV(˺_4j4m5z&- =#Оm+K@d".ۦ:v\C)p5kD,Tc#2!٥ !%#%PA'] E_}}$D\At Gv [Ї%Uԣh9Fh ef!RR9lPM0i$/a2yr}`BXu>7r2ڼG{Q\;* hg|Mui9W8ElI8nQ婺ncT3p̨ OfGv!ml&Aߩcx^V@{$($*gawU\8Dk7ᕻgqß}K{_RFO +g:l89&8*жREkn3Wvͻ1:DŽ>A(xkN\VQoxP>oe5z}o+Z6̶u eMUv)ۻkDwIw[[\!r#OSAd r i7p:`)plwfFk‘SNH6oqڽT<0%1g m|Ur]*e$@п7[g_2Xs3A Bv*&9U$x3LPb Hzן;gLJ{y,8z>ifp4HiLbqh0>EWt>|1 o"OX':z>~rNއρw/mF NFv0&y~l3&><:p%xq B3 T(uJ<]^8%bNo\N ܮF6X8*tb8վ1v?>*z8eV0דU4͠j\w᫫/Dí<`z)#P -Ah~M3 4,끌(Pr%X#Iψ/_[p(mYl'qdcra H ' Z6Ꮔ L?ov)#gy n,5WK=7x*h޼>SL5pǶ^*zu0C[X`%#;~p=vKo>3A!Uw73{ӓ[G3K]z_}ّ8#A2phWa=\./49r(`anG1+8L)au؜Tt",٦ \2MOwVOt{[>tu;lQ&E yC{ػD8@I̵u L2 N$bNvSԥH) 5FaOXH0G_=Ie:> :M>+=$%xAÞk{j٥]I4ia*R$t k7(d'r)RIKJ nLiZǥ(p"0 wk3 "1\Fx_!tc~&ԇ_95Suعgk+?Z;D²<#_򱙙b>{ݍ_Om=w|RZYF)Rt6)L tB UsvdflS{<|l `z9b gm'%4F&sVљUȉnE`|`'Z-؜ -]S쉁L nS37.i;I As6m> [/  fJ* G ag|Y& ivtڑˉ*z-tpЋ0:YY8Ƭ 污2P Bǽ\* 6)SKKNL<ܘf8ND"!%xw]bnIt4S S8:þb/u5wQpI}Q&',T(gEp'^iK1%qt* #'N <0kxV0{(V5(<# Wy%YxRԔmoԦƀȦ)݊ak3h(F?E%_Gѻ=c~=L3?iÃ}Gu//Z k__ܖ뱸7 xһswȗX, Žx2ODnC&Z}J1K];Ly8 a@-X!f+NTQ(Vkøp9"l wa32Y9Hi *GSUՁ$}waC987`mC\B@)k=QpcD/"z@ƘrsUU]Pjm 78UnAb4xSKHmu-j vwp$z!R1!TC-2` ,<G, 41CiUxq:1a*U <;Im+u(wGn V`\3'7zlaهvg.+ܛs5$~in}s/~,{Xb0hn"Gh{ ljqa縶s̞Zi ; k:ó)Nu. dBsIye:Hr]v*n8~B%,,5/qC/5K9'25 ,bíT4WpNwdRm?VD*ɵj'5ƽFI!rFGkNNtGμؒj2Ah| *}Bv F=x$37 ^!Ovc5F}!"aBf#l&h2S7$Byfثe&EΆZ-ÀD!Ap@5t #q6۰pAC"yq*G Tr܆'92%#v$FnL^O ΈcIuғ=g\THǸO38@CATGz Hc kdF  r*yaU3 ;23Sha ud冑 (r W W L[x(BAzE(d~iD,ZU?6t01@w3ML V=HKVYSi" :@}.]ir{@|B"l,#4dhp*ւ?!CXȲ#ЗUHZhDr os.y:(H0dH)x&O5`Q<>U vwߞ/k7?7>55ޗj4eΓ-w]6QH;db&H9nق`Oppk$Nf2\}\-C?S .FmSd巀~k&,.:ѓ 2IT(d=3Qvʴ׀ :ńEa$)2lŝ.3<(_UO ?<352n ^MGm INlàѠx@{ȫ&N@6T .D1ŪZ& F6Bl&|P2(&iJHkd2pش:~J 0J ZZ?k_eeJO'Чܯ!Z~p,ݿgQMEWyPA# @:pMk| :)P%8P?s s<~T^* 𩠘 V N` j#S QV샠NU=j>@*t+GiJ}20 *@̠/WE $e"A?]Wx#eK H%?p2=S^}ǃ:G H>`9%zQ ,(kPSpv/A8ց9W=;Ǯne:4L6$|9nxעDiuZ~g(^,$5nAGiÃ#^K1 ʘM -:`N?Ֆƍ1]Kmj#0 m3%3fFh,`E&ؠA0wl~܁It\v<75r^fPEFtR-X;ӧ`rK5߂iYLCzPƠ3&6£;hC4 qdv #>R.l۰g=v*T0%pѨ$69Af(?96kؽx% qR`Uh>UI,~N~o`Dў8 %ů(ϸ'UH{䙤;kgֈfdNS{@@tJt c)ww7ͪ'ix]19)LV5TXV}cKFT}ˬX؃h2Lhe@Cb5p&fxt w`|&< IGo|4ydSn{yڏ#k|g^oo֧[ϣ13z@kg)h :~_n7wJ}q{G-}8 ߾z_[w輷0[{ -G%`nO}-fos~u̷Wo~(\ūc~07Ro?jKÍk;rjխ`,G:~a9گTGa Kg>T/敷FO^]vh̍GgWϚߙ/{͘o(uY݋vqq^ )Cp!{sN`)Cװ)0q(#HDp.TYzc}%<61>Ӆx M g+ d?qEC$4DMI&ב6Eu<>*yU4- Ʋ1՗{#Y})ȩxksXeAs*@ECFeOvW!9 2@ۻ;0q)ӃW[!ʩ[*&u +2Åe8XNϸp8qjE<2X9zȡ\{,i[7L2 ؿ]aN" $35Vw"lA \I}={a/ANQxi~FO\\މ'􎧘kjcNƧG`R. i"#Ep! KPeW5b`je۫2#U L >綱 u<$1.MUt0STRGK^TʻrRK"-Gu!hOc**^mr~GKF}t@q\w3t±F)̇WUut=:45 S5y rד:>Rwsj9:u w+^F=i,"~&:!XiC. EGX]Vy<9mOCi$h)JIIBx,cg&x]:=!>! ` SHQU!ul2BAy gtljS.%Lu:Ce(lIH:,ñ\~eYĥH4,$JD$gmpU' AQ&HJnC6k<\M*NEHC,6͛t21Q+x۪_ǒ4e2{ ܨ\r{{KJz^W.ɕK˽ˠ6WugU8ϥ]`ec{bvU;StvUpNkk$KBjdg۵ՁZBjmobv3 EyndwNoR1F'4IT 648d~-{qiMvvD$Bkmf ` !ʻDFām5SHBL5([FnOtyzL\k6ź5,TVD-=2PqI7 )Ab>&0Y!Z,$,E֓!oκku˓v1r1~hpQ9͚N@~h R [Y~KӨs~(6$>ۖsxAe7@e~ج !WLMmŠu ȗ>` % C g Ϛ-"1I)ek,oV[y6 PQ妨ξ?Nm5 }̅!@=ʖæR! A^ed8atzPن-vL&d`(e ȭ]|P`7U;#j.j3w_T0D˧"WTOsF(TXņ'ⳣeJgXRbXWK#{i^ wz晒ul4_I5"S(oIjr;hP7H"  m;qߝS,%'I *5JYj}uJ*&+5}35(d¶:oU'O?^ICN$(-AMe|K@:551&ViNaLq"9vLJj(vw6֯ 6/d5TkVJȞ!Fq\Wc9,OyťLC|_"yopI0iRX - q߀p6Ԙ)t[6)E-/1V d#kB@]3!Dʕz4%M!\XW:.]S\){BN7MNr=n ~든DETf1'(l fx}$`Q{_dd_o[oa#6Xրlc$#DBQj=&-f6B [ BDLWX_ґn׆ŀ->I)Q0c )zij"CXݎbP2z/SiŚLii%)v*b WֹO HBA,?[ڥjlQRFg,Lܓzf_Z2aAtq{EOtPm ,[n)&Dէ& R"7@v1m<i՟ǘ-"/'ͶW9g{GgɊPO`{]Yh`TKv+>(Tpϩ5(94/?`- X ~(À7T@5zd. UvP++c9x9V(+&}}֝ؠNJ/_Y,QbU?jGXiŨRUQn(AAbƳW0Ƈgqk4 .M7:|"I\ۙdc{:O~k] kmxB Es*%b'VٜoN'@əruU&4/E;ƺ1=XNr m %3vk]͆% ~ M(-bPϒtpF-) e(M"$|5$am̄:L,$T';B"f?:ܼ$Rx\@i_klخQKeXԩG2xb$, r߅" +̯lSs M#7_w[˭,FPU1>M7J3iUPޥWX,qQ{0/SiZQ M'{,޺2f"~S}CJeo4ުt9jLLPb#ORᛏW(j6(dwEh7´ 4C&MLEVWO[{DҒyIRƈ5RٞjWl6]0Q|SsX%yG (ʋWz#U5g|Xvo@"τ }J-II kvH5IPZ"J-.L٠4)F>d Cg9:d~|4H"k(˕*3V7fSu@ uĢ<(ЌGr%X\e3&Ai1ڲ(쓑h}U=w nGL}F#hk7=i,R Q:y}gOi&r!* Brˢbq6_a掑xء!lT iU^@ca`ma ?èr$Ʃ7c}"qC)cq$8PnߧSj9IENDB` i8@8 NormalCJ_HaJmH sH tH >@B> Heading 4dd@&[$\$5\<A@< Default Paragraph Font@@  Balloon TextCJOJQJ^JaJ,U@, Hyperlink >*ph:^@: Normal (Web)dd[$\$>V@1> FollowedHyperlink >*B* ph,@B, Header  !, R, Footer  !BegiklVXZ\] dfhjk0000000000000000000000000000000000000000000000000000000000000@0   k\j  Iab . ` } XXXt  ,b$Iu=4@R&B@ 0(  B S  ?(  p  S ,A`header#" ` -t"*T _Hlt36866740 OLE_LINK3Q @R ct $ 7 q{^ a ' 7 q{^l33333    yelV] dktadepojueC:\Documents and Settings\tadepoju\My Documents\Dev\documents\Argus Systems Group PitBull.comPack.doc          y{}egiklVXZ\] dfhjk@`p@UnknownGz Times New Roman5Symbol3& z Arial5& zaTahoma"1h tF tFts&W"#!0d2HPArgus Systems Group(www Ilya BurdmantadepojuOh+'0  , H T ` lxArgus Systems Group(wwwrgu Ilya Burdman GrlyalyaNormalr tadepojuman2deMicrosoft Word 9.0(@G@V@ H΄@ H΄W՜.+,D՜.+,D hp|   r" Argus Systems Group(www Title 8@ _PID_HLINKSAr=$mailto:sewpsc_reports@sewp.nasa.govShttp://www.coact.com/[Fhttp://www.argus-systems.com/lsheader  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJLMNOPQRSTUWXYZ[\]_`abcdehRoot Entry F3%j1TableKWordDocumentߔSummaryInformation(VDocumentSummaryInformation8^CompObjjObjectPool3%3%  FMicrosoft Word Document MSWordDocWord.Document.89q