Checklist for Generating a C2 System

Is all hardware in your configuration listed on the evaluated hardware list? (See Final Evaluation Report, Digital Equipment Corporation, OpenVMS VAX and SEVMS Version 6.0.)

Have you excluded the following software products: DECdns, LASTport, LASTport/DISK, LAT?

Do system files have the same protection as when HP delivered them to you? (See Appendix B “Protection for OpenVMS System Files”.)

Did you avoid installing DECwindows software or other privileged layered products?

Have you trained privileged users so they understand the effect of operations they may perform?

Does each user have a unique UIC?

Do all accounts have passwords of nonzero length?

Does each user have a separate account?

Have you eliminated any guest accounts?

Have you disabled all autologins?

Does each user have a unique proxy?

Are all proxy accounts nonprivileged?

Do you log operators' HSC activities on a hardcopy printer?

Does the HSC console have a sign-in log, and are your operators trained to use it?

Did you ensure that users are familiar with the restrictions on the use of access control strings in the evaluated configuration?

Are the audit server and OPCOM processes running?

Do you have one audit log file for the entire cluster?

Are you using a hardcopy terminal as the security operator terminal?

Is the security operator terminal accessible only to authorized personnel?

Do you have a procedure for reviewing the audit log file on a regular basis?

Does the audit log file have both Audit and Alarm ACEs?

Are the Authorization and ACL event classes enabled?

Did you put Audit ACEs on all captive login command procedures and their home directories?

Is high-water marking enabled on system disk volumes?

Are users trained to shut off their terminals after logging out?

Do you have a procedure for erasing tapes before they are used again?

Does your cluster have only one copy of the following files?

Are all nodes in the cluster part of the C2 configuration?

Did you set security-sensitive parameters to the following values?

Is the CONNECT CONSOLE command disabled? (On VAX 9000 systems, is the SET SPU_UPDATE_OFF command in effect?)

Have you excluded FYDRIVER from your system?