-- How many
computer security experts
-- does it take to change a light bulb?
"That depends on the TCSEC rating of the object light bulb.
If it's a C2 bulb (or below), one. If a B1 bulb, just one,
but he/she must document the potential covert channel. If a
B2 bulb, he/she must also audit the covert channel. If a
B3/A1 bulb, none, since covert channels are not allowed. [See
also the "Orange Book"]
How many
laboratory heads (senior researchers, etc. )
-- does it take to
change a light bulb?
Five; one to change the light bulb, the other four to stand
around arguing whether he/she is taking the right approach....
