Planning a GNUe Security Framework proposal update

[Stanley A. Klein]

I took a look at the GNUe Security Framework proposal that I last updated
in May 2001.  I think most of the ideas there are still valid, mainly (1)
that GNUe can't provide any security by itself but needs to use the
security capabilities of the operating system and database on which it
runs, and (2) that different enterprises will have different security
requirements that GNUe will need to be able to accommodate.    

There have been developments in areas such as Linux security that would
need to be updated in the document.  Also, GNUe has more detailed
functionality and a more mature design.  It is time to think about updating
the document.

In looking over the document, I think I may be able to identify some fairly
simple improvements in GNUe functionality that would help a user configure
a security structure using the capabilities provided by the operating
system and database.

Of course, each operating system and each database provide different
capabilities.  The best we can do is to provide some guidelines to help a
user develop a security structure to meet the particular requirements of
the enterprise involved.

At one time my draft proposal had been posted on Neil Tiffin's part of the
GNUe web page.  I don't know where it is now.  It might have gotten lost
somewhere in the web server shuffle.

What I'm planning to do now is to import it to OpenOffice.org, update it,
fill in some of the TBD's, and run it back up the flagpole to see what
people think of it.


Stan Klein