SNIP

>Only NT 3.5 was given a C2 security clearance, and only because the floppy was removed and there were no network cards in the box, and the lid to the box was locked. One would have to install the software and then remove the floppy and lock the box. No connection to a network. That scenerio has only limited usefulness. But, it didn't stop MS's PR department from fudging the truth to exploit most consumers ignorance and make implications that all NT configurations were C2 secure, which they were not.

FYI here is an UPDATE:

From: http://www.radium.ncsc.mil/tpep/epl/entries/TTAP-CSC-EPL-99-001.html

The SAIC evaluation team has determined that Windows NT 4.0 with Service Pack 6a and the C2 Update as configured by the Trusted Facility Manual satisfies all the specified requirements of the criteria at class C2. The Trusted Facility Manual, entitled "Administrator's and User's Security Guide," is available on the Microsoft web site at http://www.microsoft.com/security/issues/deployingc2.exe. For a complete description of how the Windows NT satisfies each requirement of the Criteria, see Final Evaluation Report, Microsoft Corporation, Windows NT 4.0 with Service Pack 6a and the C2 Update.

C2 certified information: http://www.radium.ncsc.mil/tpep/epl/epl-by-class.html#C2

Note that Microsoft is not and has NEVER been C2 certified as a network, only under apps and OS. (I memorized this stuff while I was one of the Information Assurance Security Managers for a major military installation).

The ONLY C2 certified networks are:

Novell, Incorporated NetWare 4 Network System Architecture & Design
Novell, Incorporated NetWare 4.11
SISTex, Incorporated (developed by Tracor Information Systems, formerly Cordant, Inc.) Assure EC 4.11 for Novell

However, there are some B1, B2, and A1 certified networks...(but NOT Microsoft).

Tracy