Glossary of Computer Security Terms

Front Cover
National Computer Security Center, 1989 - Computer security - 55 pages

What people are saying - Write a review

We haven't found any reviews in the usual places.

Selected pages

Other editions - View all

Common terms and phrases

Popular passages

Page 33 - Object is defined as a passive entity that contains or receives information. Access to an object potentially implies access to the information it contains. Examples of objects are: records blocks, pages, segments, files, directories, directory trees, and programs, as well as bits, bytes, words, fields, processors, video displays, keyboards, clocks, printers, network nodes, etc.
Page 19 - A mathematically precise statement of a security policy. To be adequately precise, such a model must represent the initial state of a system, the way in which the system progresses from one state to another, and a definition of a "secure" state of the system. To be acceptable as a basis for a TCB, the model must be supported by a formal proof that if the initial state of the system satisfies the definition of a "secure...
Page 8 - The technical evaluation performed as part of, and in support of, the accreditation process that establishes the extent to which a particular computer system or network design and implementation meet a prespecified set of security requirements.
Page 49 - Trusted computing base (TCB) — the totality of protection mechanisms within a computer system ~ including hardware, firmware, and software ~ the combination of which is responsible for enforcing a security policy.
Page 28 - A means of restricting access to objects based on the sensitivity (as represented by a label) of the information contained in the objects and the formal authorization (ie, clearance) of subjects to access information of such sensitivity.
Page 43 - Code (the Privacy Act), but which has not been specifically authorized under criteria established by an Executive order or an Act of Congress to be kept secret in the interest of national defense or foreign policy...
Page 14 - English), an informal design notation, or a combination of the two. Designated Approving Authority (DAA) The official who has the authority to decide on accepting the security safeguards prescribed for an AIS or that official who may be responsible for issuing an accreditation statement that records the decision to accept those safeguards.
Page 29 - Multilevel device — a device that is used in a manner that permits it to simultaneously process data of two or more security levels without risk of compromise. To accomplish this, sensitivity labels are normally stored on the same physical medium and in the same form (ie, machine-readable or human-readable) as the data being processed. Multilevel secure — a class of system containing information with different sensitivities that simultaneously permits access by users with different security clearances...
Page 49 - ... computer system - including hardware, firmware, and software - the combination of which is responsible for enforcing a security policy. A TCB consists of one or more components that together enforce a unified security policy over a product or system. The ability of a TCB to...
Page 7 - A system state is defined to be "secure" if the only permitted access modes of subjects to objects are in accordance with a specific security policy. In order to determine whether or not a specific access mode is allowed, the clearance of a subject is compared to the classification of the object and a determination is made as to whether the subject is authorized for the specific access mode.

Bibliographic information