Computers at Risk: Safe Computing in the Information Age (1991)

Access control list

A list of the subjects that are permitted to access an object, and the access rights of each subject.

Access label

See Label.

Access level

A level associated with a subject (e.g., a clearance level) or with an object (e.g., a classification level).

Accountability

The concept that individual subjects can be held responsible for actions that occur within a system.

Accreditation

1. The administrative act of approving a computer system for use in a particular application. See Certification. 2. The act of approving an organization as, for example, an evaluation facility.

Access control in which administrators control who can access which objects. Contrast with user-directed access control (UDAC). See Mandatory access control.

Assurance

Confidence that a system design meets its requirements, or that its implementation meets its specification, or that some specific property is satisfied.

Auditing

The process of making and keeping the records necessary to support accountability. See Audit trail analysis.

Audit trail

The results of monitoring each operation of subjects on objects; for example, an audit trail might be a record of all actions taken on a particularly sensitive file.

Audit trail analysis

Examination of an audit trail, either manually or automatically, possibly in real time (Lunt, 1988).

Authentication

Providing assurance regarding the identity of a subject or object, for example, ensuring that a particular user is who he claims to be.

Authentication sequence

A sequence used to authenticate the identity of a subject or object.

Authorization

Determining whether a subject (a user or system) is trusted to act for a given purpose, for example, allowed to read a particular file.

Availability

The property that a given resource will be usable during a given time period.

Bell and La Padula model

An information-flow security model couched in terms of subjects and objects and based on the concept that information shall not flow to an object of lesser or noncomparable classification (Bell and La Padula, 1976).

Beta testing

Use of a product by selected users before formal release.

Biba model

An integrity model in which no subject may depend on a less trusted object (including another subject) (Biba, 1975).

Capability

An authenticating entity acceptable as evidence of the right to perform some operation on some object.

Certification

The administrative act of approving a computer system for use in a particular application. See Accreditation.

CESG

The Communications-Electronics Security Group of the U.K. Government Communications Headquarters (GCHQ).

Challenge-response

An authentication procedure that requires calculating a correct response to an unpredictable challenge.

Checksum

Digits or bits summed according to arbitrary rules and used to verify the integrity of data.

Ciphertext

The result of transforming plaintext with an encryption algorithm. Also known as cryptotext.

Claims language

In the ITSEC, the language that describes the desired security features of a "target of evaluation" (a product or system), and against which the product or system can be evaluated.

Clark-Wilson integrity model

An approach to providing data integrity for common commercial activities, including software engineering concepts of abstract data types, separation of privilege, allocation of least privilege, and nondiscretionary access control (Clark and Wilson, 1987).

Classification level

The security level of an object. See Sensitivity label.

Cleanroom approach

A software development process designed to reduce errors and increase productivity (Poore and Mills, 1989).

Clear text

Unencrypted text. Also known as plaintext. Contrast with ciphertext, cryptotext.

Clearance level

The security level of a subject.

CLEF

In the ITSEC, a Commercial Licensed Evaluation Facility.

CoCom

Coordinating Committee for Multilateral Export Controls, which began operations in 1950 to control export of strategic materials and technology to communist countries; participants include Australia, Belgium, Canada, Denmark, France, Germany, Greece, Italy, Japan, Luxembourg, the Netherlands, Norway, Portugal, Spain, Turkey, the United Kingdom, and the United States.

COMPUSEC

Computer security.

COMSEC

Communications security.

Confidentiality

Ensuring that data is disclosed only to authorized subjects.

Correctness

1. The property of being consistent with a correctness criterion, such as a program being correct with respect to its system specification, or a specification being consistent with its requirements.

2. In ITSEC, a component of assurance (together with effectiveness).

Countermeasure

A mechanism that reduces the vulnerability of a threat.

Covert channel

A communications channel that allows two cooperating processes to transfer information in a manner that violates a security policy, but without violating the access control.

Criteria

Definitions of properties and constraints to be met by system functionality and assurance. See TCSEC, ITSEC.

Criticality

The condition in which nonsatisfaction of a critical requirement can result in serious consequences, such as damage to national security or loss of life. A system is critical if any of its requirements are critical.

Crypto-key

An input to an encryption device that results in cryptotext.

Cryptotext

See Ciphertext.

Data

A sequence of symbols to which meaning may be assigned. Uninterpreted information. Data can be interpreted as representing numerical bits, literal characters, programs, and so on. (The term is used often throughout this report as a collective, singular noun.) See Information.

Data Encryption Standard (DES)

A popular secret-key encryption algorithm originally released in 1977 by the National Bureau of Standards.

Delegate

To authorize one subject to exercise some of the authority of another.

Denial of service

Reducing the availability of an object below the level needed to support critical processing or communication, as can happen, for example, in a system crash.

Dependability

The facet of reliability that relates to the degree of certainty that a system will operate correctly.

Dependence

The existence of a relationship in which the subject may not work properly unless the object (possibly another subject) behaves properly. One system may depend on another system.

Digital signature

Data that can be generated only by an agent that knows some secret, and hence is evidence that such an agent must have generated it.

Discretionary access control (DAC)

An access-control mechanism that permits subjects to specify the access controls, subject to constraints such as changes permitted to the owner of an object. (DAC is usually equivalent to IBAC and UDAC, although hybrid DAC policies might be IBAC and ADAC.)

DTI

Department of Trade and Industry, U.K

Dual-use system

A system with both military and civilian applications.

Effectiveness

1. The extent to which a system satisfies its criteria. 2. In ITSEC, a component of assurance (together with correctness).

Emanation

A signal emitted by a system that is not explicitly allowed by its specification.

Evaluation

1. The process of examining a computer product or system with respect to certain criteria. 2. The results of that process.

Feature

1. An advantage attributed to a system. 2. A euphemism for a fundamental flaw that cannot or will not be fixed.

Firmware

The programmable information used to control the low-level operations of hardware. Firmware is commonly stored in Read-Only Memorys (ROMs), which are initially installed in the factory and may be replaced in the field to fix mistakes or to improve system capabilities.

Formal

Having a rigorous respect for form, that is, a mathematical or logical basis.

FTLS

Formal top-level specification. (See "Security Characteristics" in Chapter 5.)

Functionality

As distinct from assurance, the functional behavior of a system. Functionality requirements include, for example, confidentiality, integrity, availability, authentication, and safety.

Gateway

A system connected to different computer networks that mediates transfer of information between them.

GCHQ

Government Communications Headquarters, U.K.

Group

A set of subjects.

Identity-based access control (IBAC)

An access control mechanism based only on the identity of the subject and object. Contrast with rule-based access control. See Discretionary access control.

Implementation

The mechanism that (supposedly) realizes a specified design.

Information

Data to which meaning is assigned, according to context and assumed conventions.

Information-flow control

Access control based on restricting the flow of information into an object. See, for example, Bell and La Padula model.

INFOSEC

Information security. See also COMPUSEC and COMSEC.

Integrity

The property that an object is changed only in a specified and authorized manner. Data integrity, program integrity, system integrity, and network integrity are all relevant to consideration of computer and system security.

Integrity level

A level of trustworthiness associated with a subject or object.

Integrity policy

See Policy.

ITAR

International Traffic in Arms Regulations (Office of the Federal Register, 1990).

ITSEC

The Information Technology Security Evaluation Criteria, the harmonized criteria of France, Germany, the Netherlands, and the United Kingdom (Federal Republic of Germany, 1990).

Kernel

A most trusted portion of a system that enforces a fundamental property, and on which the other portions of the system depend.

Key

An input that controls the transformation of data by an encryption algorithm.

Label

A level associated with a subject or object and defining its clearance or classification, respectively. In TCSEC usage, the security label consists of a hierarchical security level and a nonhierarchical security category. An integrity label may also exist, consisting of a hierarchical integrity level and a nonhierarchical integrity category (Biba, 1975).

Letter bomb

A logic bomb, contained in electronic mail, that is triggered when the mail is read.

Level

1. The combination of hierarchical and nonhierarchical components (TCSEC usage). See Security level, Integrity level. 2. The hierarchical component of a label, more precisely referred to as "hierarchical level" to avoid confusion. In the absence of nonhierarchical categories, the two definitions are identical.

Logic bomb

A Trojan horse set to trigger upon the occurrence of a particular logical event.

Mandatory access control (MAC)

1. Access controls that cannot be made more permissive by users or subjects (general usage, roughly ADAC). 2. Access controls based on information sensitivity represented, for example, by security labels for clearance and classification (TCSEC usage, roughly RBAC and ADAC). Often based on information flow rules.

Model

An expression of a policy in a form that a system can enforce, or that analysis can use for reasoning about the policy and its enforcement.

Monitoring

Recording of relevant information about each operation by a subject on an object, maintained in an audit trail for subsequent analysis.

Mutual authentication

Providing mutual assurance regarding the identity of subjects and/or objects. For example, a system needs to authenticate a user, and the user needs to authenticate that the system is genuine.

NCSC

The National Computer Security Center, part of the National Security Agency, which is part of the Department of Defense.

Node

A computer system that is connected to a communications network and participates in the routing of messages within that network. Networks are usually described as a collection of nodes that are connected by communications links.

Nondiscretionary

Equivalent to mandatory in TCSEC usage, otherwise equivalent to administratively directed access controls.

Nonrepudiation

An authentication that with high assurance can be asserted to be genuine, and that cannot subsequently be refuted.

Object

Something to which access is controlled. An object may be, for example, a system, subsystem, resource, or another subject.

Operating system

A collection of software programs intended to directly control the hardware of a computer (e.g., input/output requests, resource allocation, data management), and on which all the other programs running on the computer generally depend. UNIX, VAX/VMS, and DOS are all examples of operating systems.

Orange Book

OSI

Open Systems Interconnection. A seven-layer networking model.

Outsourcing

The practice of procuring from external sources rather than producing within an organization.

Password

A sequence that a subject presents to a system for purposes of authentication.

Patch

A section of software code that is inserted into a program to correct mistakes or to alter the program.

Perimeter

A boundary within which security controls are applied to protect assets. A security perimeter typically includes a security kernel, some trusted-code facilities, hardware, and possibly some communications channels.

PIN

Personal identification number. Typically used in connection with automated teller machines to authenticate a user.

Plaintext

See Clear text.

Policy

An informal, generally natural-language description of desired system behavior. Policies may be defined for particular requirements, such as security, integrity, and availability.

Principal

A person or system that can be authorized to access objects or can make statements affecting access control decisions. See the equivalent, Subject.

Private Key

See Secret key.

Protected subsystem

A program or subsystem that can act as a subject.

Public key

A key that is made available without concern for secrecy. Contrast with private key, secret key.

Public-key encryption

An encryption algorithm that uses a public key to encrypt data and a corresponding secret key to decrypt data.

RAMP

Rating Maintenance Phase. Part of the National Computer Security Center's product evaluation process.

Receivers

Subjects reading from a communication channel.

Red Book

The Trusted Network Interpretation of the Trusted Computer System Evaluation Criteria, or TNI (U.S. DOD, 1987).

Reference monitor

A system component that enforces access controls on an object.

Requirement

A statement of the system behavior needed to enforce a given policy. Requirements are used to derive the technical specification of a system.

Risk

The likelihood that a vulnerability may be exploited, or that a threat may become harmful.

RSA

The Rivest-Shamir-Adelman public key encryption algorithm (Rivest et al., 1978).

Rule-based access control (RBAC)

Access control based on specific rules relating to the nature of the subject and object, beyond just their identities—such as security labels. Contrast with identity-based access control. See Mandatory access control.

Safety

The property that a system will satisfy certain criteria related to the preservation of personal and collective safety.

Secrecy

See Confidentiality.

Secret

Known at most to an authorized set of subjects. (A real secret is possible only when the size of the set is one or less.)

Secret key

A key that is kept secret. Also known as a private key.

Secret-key encryption

An encryption algorithm that uses only secret keys. Also known as private-key encryption.

Secure channel

An information path in which the set of all possible senders can be known to the receivers, or the set of all possible receivers can be known to the senders, or both.

Security

1. Freedom from danger; safety. 2. Computer security is protection of data in a system against disclosure, modification, or destruction. Protection of computer systems themselves. Safeguards can be both technical and administrative. 3. The property that a particular security policy is enforced, with some degree of assurance. 4. Often used in a restricted sense to signify confidentiality, particularly in the case of multilevel security.

Security level

A clearance level associated with a subject, or a classification level (or sensitivity label) associated with an object.

Security policy

See Policy.

Sender

A subject writing to a channel.

Sensitivity label

A security level (i.e., a classification level) associated with an object.

Separation of duty

A principle of design that separates functions with differing requirements for security or integrity into separate protection domains. Separation of duty is sometimes implemented as an authorization rule specifying that two or more subjects are required to authorize an operation.

Shareware

Software offered publicly and shared rather than sold.

Signature

See Digital signature.

Simple security property

An information-flow rule stating that a subject at a given security level can read only from an object with a security label that is the same or lower (Bell and La Padula, 1976).

Smart card

Source code

The textual form in which a program is entered into a computer (e.g., FORTRAN).

Specification

A technical description of the desired behavior of a system, as derived from its requirements. A specification is used to develop and test an implementation of a system.

Spoofing

Assuming the characteristics of another computer system or user, for purposes of deception.

State

An abstraction of the total history of a system, usually in terms of state variables. The representation can be explicit or implicit.

State machine

In the classical model of a state machine, the outputs and the next state of the machine are functionally dependent on the inputs and the present state. This model is the basis for all computer systems.

STU-III

A secure telephone system using end-to-end private-key encryption.

Stub

An artifact, usually software, that can be used to simulate the behavior of parts of a system. It is usually used in testing software that relies on those parts of the system simulated by the stub. Stubs make it possible to test a system before all parts of it have been completed.

Subject

An active entity—e.g., a process or device acting on behalf of a user, or in some cases the actual user—that can make a request to perform an operation on an object. See the equivalent, Principal.

System

1. A state machine, that is, a device that, given the current state and inputs, yields a set of outputs and a new state (see State machine). 2. An interdependent collection of components that can be considered as a unified whole, for example, a networked collection of computer systems, a distributed system, a compiler or editor, a memory unit, and so on.

TCB

See Trusted computing base.

TCSEC

The Department of Defense Trusted Computer System Evaluation Criteria (U.S. DOD, 1985d). See Orange Book.

Tempest

U.S. government rules for limiting compromising signals (emanations) from electrical equipment.

Threat

The potential for exploitation of a vulnerability.

Time bomb

A Trojan horse set to trigger at a particular time.

Token

When used in the context of authentication, a physical device necessary for user identification.

Token authenticator

A pocket-sized computer that can participate in a challenge-response authentication scheme. The authentication sequences are called tokens.

Trapdoor

A hidden flaw in a system mechanism that can be triggered to circumvent the system's security.

Trojan horse

A computer program whose execution would result in undesired side effects, generally unanticipated by the user. A Trojan horse program may otherwise give the appearance of providing normal functionality.

Trust

Belief that a system meets its specifications.

Trusted computing base (TCB)

A portion of a system that enforces a particular policy. The TCB must be resistant to tampering and circumvention. Under the TCSEC, it must also be small enough to be analyzed systematically. A TCB for security is part of the security perimeter.

Trusted system

A system believed to enforce a given set of attributes to a stated degree of assurance (confidence).

Trustworthiness

Assurance that a system deserves to be trusted.

Tunneling attack

An attack that attempts to exploit a weakness in a system at a low level of abstraction.

User authentication

Assuring the identity of a user. See Authorization.

User-directed access control (UDAC)

Access control in which users (or subjects generally) may alter the access rights. Such alterations may, for example, be restricted to certain individuals by the access controls, for example, limited to the owner of an object. Contrast with administratively directed access control. See Discretionary access control.

Vaccine

A program that attempts to detect and disable viruses.

Virus

A program, typically hidden, that attaches itself to other programs and has the ability to replicate. In personal computers, ''viruses" are generally Trojan horse programs that are replicated by inadvertent human action. In general computer usage, viruses are more likely to be self-replicating Trojan horses.

Vulnerability

A weakness in a system that can be exploited to violate the system's intended behavior. There may be security, integrity, availability, and other vulnerabilities. The act of exploiting a vulnerability represents a threat, which has an associated risk of being exploited.

Worm attack

A worm is a program that distributes itself in multiple copies within a system or across a distributed system. A worm attack is a worm that may act beyond normally permitted behavior, perhaps exploiting security vulnerabilities or causing denial of service.

Yellow Book

The Department of Defense Technical Rationale Behind CSC-STD-003-85 (U.S. DOD, 1985b). Guidance for applying the TCSEC to specific environments.

ZSI

Zentralstelle für Sicherheit in der Informationstechnik. The German Information Security Agency (GISA).