1. TCSEC: The Orange Book

2. TCSEC Purpose Trusted Computer System Evaluation Criteria Purpose:
Provides the basic requirements for assessing the effectiveness of computer security controls built into a computer system.
Used to evaluate, classify, and select systems being considered as platforms for computing resources.

3. TCSEC: Orange Book
Metrics – provides a metric (classification) for determining the level of trust assigned to a computing system.
Guidance – provides guidance on how to design a trusted computing system along with their associated data and services

4. Orange Book: Metrics
Measurement of a system's security is quantified using a classification system.
The Classes are:
D -
C1 & C2
B1, B2, B3 A1
A is more secure than D
2 is more secure than 1.

5. Orange Book: Metrics
D applies to any system that fails to meet any of the higher level security classes.
The other levels have increasing security requirements.
A1 systems are rare.

6. Metrics: C1 Identification and authentication (user id & password)
Separation of users and data
DAC – capable of enforcing access controls
Example: Basic Unix/Linux OS

7. Metrics: C2 C1 plus More sophisticated DAC Audit trails
System documentation and user manuals.

8. Metrics B1 C2 plus Use of hierarchical sensitivity labels
Discovered weaknesses must be mitigated

9. Metrics B2 B1 plus Security policy must be defined and documented
Access controls for all subjects and objects

10. Metrics: B3
B2 plus
Automated imminent intrusion detection, notification and response.

11. Metrics: A1
B3 +
System is capable of secure distribution (can be transported and delivered to a client with the assurance of being secure)

12. Orange Book Security Criteria
Security Policy
Accountability
Assurance
Documentation

13. 1. Security Policy
The set of rules and practices that regulate how an organization manages, protects, and distributes information.

14. 1. Security Policy The policy is organized into subjects and objects.
Subjects act upon objects
Subjects – processes and users.
Objects – data, directories, hardware, applications
A well defined protocol determines if a subject can be permitted access to an object.

15. 2. Accountability
The responsibilities of all who come in contact with the system must be well defined.
Identification (… the process to identify a user)
Authentication (… as in, authenticated to access specific resources)
Auditing (...accumulating and reviewing log information and all actions can be traced to a subject)

16. 3. Assurance
The reasonable expectation that the security policy of a trusted system has been implemented correctly.
Assurance is organized into
Operational assurance
Life-cycle assurance

17. 3a. Organizational Assurance
Security policy is maintained in the overall design and operation of the system.
Example: Users of the system have an assurance that access controls are enforced

18. 3b. Life-cycle Assurance
Insuring the system continues to meet the security requirements over the lifetime of the system.
Updates to the software and hardware must be considered
The expectation that the system remains operational (is available) over its lifetime

19. 4. Documentation Requirements
Security Features User's Guide
Trusted Facility Manual
Test Documentation
Design Documentation

20. Documentation: Security Features User's Guide
Aimed at the ordinary (non-privileged) users.
General usage policy
*Instructions on how to effectively use the system
Description of relevant security features

21. Documentation: Trusted Facility Manual
Aimed at the S.A. Staff
How the system is configured and maintained
Includes the day-to-day required activities

22. Documentation: Test Documentation
Instructions on how to test the required security mechanisms

23. Documentation: Design Documentation
Define the boundaries of the system
A complete description of the hardware and software.
Complete system design specifications
Description of access controls

24. The Orange Book
The Orange book has been superseded by the Common Criteria