Orange Book Links

Online and hardcopy Rainbow Books and related topics:

A comprehensive site on The NSA Rainbow Series is held at the Federation of American Scientists (FAS) including information on how to get hardcopy Rainbow books
The "official" Rainbow Series Library held at the NCSC's Trusted Product Evalutation Program site.
Ground Zero Books specialize in military, historical and related books. They sometimes have copies of Rainbow Series books in stock.
Another Rainbow Series Library at NIST's Computer Security Resource Center
A copy of the Orange Book at JIST3 (site currently offline)
The UK's ITSEC scheme run by CESG is a close relative of the DoD's Rainbow Series crtieria.
Computers: Security: Publications at dmoz
The Microsoft Technet guide to Defending Your Web Server
The MITRE Corporation have been involved for many years in Trusted Systems Evaluation.
Information on the B2-compliant Multics system at the Multicians web site.
C2 Security Evaluations for Windows NT at Microsoft.
US Federal employees should contact the NSA Helpdesk for guidance on the Rainbow series.

Notable TCSEC certified systems:

Getronics Government Solutions (formerly Wang Federal) produces the B3-certified XTS-300 Operating System.
Gemini Computer Incorporated is the vendor for the A1-certified Gemini Trusted Network Processor
Cryptek produce B2-certified network products.
UTS/MLS (originally a B1-certified OS from Amdahl) is now provided by UTS Global
CA-ACF2 MVS is a B1-compliant product from Computer Associates
SEVMS is the B1 security-enhanced version of OpenVMS (itself a C2 product), formerly of Digital Equipment Corporation, bought up by Compaq and now owned by HP.
The B1-certified Harris CX/SX OS is based on the CX/UX product now offered by Concurrent Computer Corporation
HP/UX BLS is a B1-certified derivative of HP-UX running on HP9000 systems.
Trusted IRIX is a B1-version of the IRIX OS from SGI.
UNICOS is a B1-certified network component running on Cray supercomputers.
IBM's iSeries or AS/400 systems running OS/400 are C2-compliant.
Microsoft's Windows NT 4.0 OS received C2-certification in November 1999. Windows NT 3.5 was certified in July 1995. As of May 2002, Windows 2000 or XP are not yet certified.
Tandem's C2-rated Guardian 90 product is now HP's NonStop OS with Safeguard
Novell NetWare 4.11 is a C2-compliant network component.

Selected Security-related sites:

AntiOnline - a diverse and quite interesting security-related site.
C4I.org covers security and intelligence issues with a focus on military and governmental affairs.
CERT is probably the most well know incident repsonse organisation on the Internet.
CIAC is the security response team for the US Department of Energy.
InfoSec News is a newsletter covering security news, reviews and product information with an emphasis on military and national security.
IWS - The Information Warfare Site has diverse information relating to military aspects of computer security and other issues.
Infowar is another independent information security site.
@stake now holds the knowledge base from L0pht Heavy Industries.
Security Software Technologies provide L0phtcrack and other L0pht products.
Back Orifice is an infamous intrusion product from the Cult of the Dead Cow

Recommended titles at Amazon.com:
Hacking Exposed: Second Edition (US) / (UK)
Computer Security Basics (US) / (UK)
Information Security Management Handbook (US) / (UK)
The Information Systems Security Officer's Guide (US) / (UK)
Mastering Network Security (US) / (UK)
Computer Security Handbook (US only)

Contact dynamoo@spamcop.net for any amendments to this list.