C2 is a security standard for computer systems established by the National Computer Security Center (NCSC).
What is C2 (in computer networking)?
A security standard for computer systems established by the National Computer Security Center (NCSC), a U.S. government agency responsible for evaluating the security of software products. The C2 security standard is defined in the Trusted Computer Systems Evaluation Criteria manual (or Orange Book) published by the NCSC.
The NCSC rated Microsoft’s Windows NT 3.5 (with Service Pack 3) C2-compliant. The C2 designation assures that the base operating system satisfies a number of important security criteria. This designation also represents an independent, unbiased evaluation of the security of the system architecture with regard to the government’s operating and implementation standards.
A C2 rating does not indicate that a system is free of security bugs; instead, this rating certifies that the underlying architecture of the computer system is suitable for high-security environments in specific networking configurations.
It is incorrect to say that Windows NT is C2-certified or runs in C2 mode. Only a complete computer system (including hardware) can be rated C2. A rating of C2 means that in a particular implementation, in a particular networking environment and configuration, using specific hardware and software, a computer network using a Windows NT operating system can apply for and might receive C2 certification.
How it works
According to the Orange Book, in a C-level system, the security policy must be based on what is known as Discretionary Access Control (DAC), which essentially means that users of the system can own objects (files, directories, and so on) and can control access to these objects by other users.
A user who establishes control over an object is responsible for granting or denying all access rights to that object. In other words, the owner of an object grants or denies users access to the object at his or her discretion.
This is in contrast to a B-level system, in which Mandatory Access Control (MAC) specifies that all objects have security levels that are defined independently of the object’s owner.
