8.5 ═α÷Φεφαδⁿφ√Θ ÷σφ≥≡ Ωε∞∩ⁿ■≥σ≡φεΘ ßστε∩α±φε±≥Φ

┬±σ ∩≤ßδΦΩα÷ΦΦ NCSC, ≡ατ≡σ°σφφ√σ Σδ  ε∩≤ßδΦΩεΓαφΦ  Σε±≥≤∩φ√ ≈σ≡στ ±≤∩σ≡Φφ≥σφΣαφ≥α NCSC ∩ε ΣεΩ≤∞σφ≥α∞.

NCSC = National Computer Security Center
9800 Savage Road
Ft Meade, MD 20755-6000

CSC = Computer Security Center:
 ßεδσσ ±≥α≡εσ Φ∞  NCSC

NTISS = National Telecommunications and
Information Systems Security
NTISS Committee, National Security Agency
Ft Meade, MD 20755-6000

[CSC]

Department of Defense, "Password Management Guideline", CSC-STD-002-85, 12 April 1985, 31 pages.

┴στε∩α±φε±≥ⁿ, εßσ±∩σ≈ΦΓασ∞α  ∩α≡εδⁿφ√∞Φ ±Φ±≥σ∞α∞Φ, ταΓΦ±Φ≥ ε≥ ±ε⌡≡αφσφΦ  Γ±σ Γ≡σ∞  ∩α≡εδσΘ Γ ±σΩ≡σ≥σ. ╧ε²≥ε∞≤, ∩α≡εδⁿ ≤ τΓΦ∞ Ω Ωε∞∩≡ε∞σ≥α÷ΦΦ, ΩεπΣα ß√ εφ φΦ Φ±∩εδⁿτεΓαδ±  ΦδΦ ⌡≡αφΦδ± . ┬ ∞σ⌡αφΦτ∞σ α≤≥σφ≥Φ⌠ΦΩα÷ΦΦ φα ε±φεΓσ ∩α≡εδσΘ, ≡σαδΦτεΓαφφε∞ Γ └╤, ∩α≡εδΦ ≤ τΓΦ∞√ Ω Ωε∞∩≡ε∞σ≥α÷ΦΦ Φτ-τα 5 Γαµφ√⌡ α±∩σΩ≥εΓ ∩α≡εδⁿφεΘ ±Φ±≥σ∞√:1)∩α≡εδⁿ Σεδµσφ φατφα≈α≥ⁿ±  ∩εδⁿτεΓα≥σδ■ ∩σ≡σΣ φα≈αδε∞ σπε ≡αßε≥√ Γ └╤;2)∩α≡εδⁿ ∩εδⁿτεΓα≥σδ  Σεδµσφ ∩σ≡ΦεΣΦ≈σ±ΩΦ ∞σφ ≥ⁿ± ;3)└╤ Σεδµφα ∩εΣΣσ≡µΦΓα≥ⁿ ßατ≤ Σαφφ√⌡ ∩α≡εδσΘ;4)∩εδⁿτεΓα≥σδΦ Σεδµφ√ ∩ε∞φΦ≥ⁿ ±ΓεΦ ∩α≡εδΦ;5) ∩εδⁿτεΓα≥σδΦ Σεδµφ√ ΓΓεΣΦ≥ⁿ ±ΓεΦ ∩α≡εδΦ Γ └╤ ∩≡Φ α≤≥σφ≥Φ⌠ΦΩα÷ΦΦ. ▌≥ε ≡≤ΩεΓεΣ±≥Γε ε∩Φ±√Γασ≥ °απΦ ∩ε ∞ΦφΦ∞Φτα÷ΦΦ ≤ τΓΦ∞ε±≥Φ ∩α≡εδσΘ Γ ΩαµΣε∞ Φτ ±δ≤≈ασΓ.

[NCSC1]

NCSC, "A Guide to Understanding AUDIT in Trusted Systems", NCSC-TG-001, Version-2, 1 June 1988, 25 pages.

╩εφ≥≡εδⁿφ√σ µ≤≡φαδ√ Φ±∩εδⁿτ≤■≥±  Σδ  εßφα≡≤µσφΦ  Γ≥εpµσφΦ  Γ Ωε∞∩ⁿ■≥σpφ≤■ ±Φ±≥σ∞≤ Φ Γ√ ΓδσφΦ  φσ∩pαΓΦδⁿφεπε Φ±∩εδⁿτεΓαφΦ  σσ pσ±≤p±εΓ. ╧ε µσδαφΦ■ α≤ΣΦ≥εpα Ωεφ≥pεδⁿφ√σ µ≤pφαδ√ ∞επ≤≥ ∩pε≥εΩεδΦpεΓα≥ⁿ ≥εδⁿΩε ε∩pσΣσδσφφ√σ ±εß√≥Φ  ΦδΦ Γ±■ pαßε≥≤ Γ ±Φ±≥σ∞σ. ╒ε≥  ²≥ε Φ φσ ≥pσß≤σ≥±  ΩpΦ≥σpΦσ∞, ∞σ⌡αφΦτ∞ α≤ΣΦpεΓαφΦ  Σεδµσφ Φ∞σ≥ⁿ Γετ∞εµφε±≥ⁿ Ωε≥pεδ  ΩαΩ τα εß·σΩ≥ε∞, ≥αΩ Φ τα ±≤ß·σΩ≥ε∞. ╥ε σ±≥ⁿ, εφ Σεδµσφ φαßδ■Σα≥ⁿ ΩαΩ τα ≥σ∞, ΩεπΣα ─µεφ Γ⌡εΣΦ≥ Γ ±Φ±≥σ∞≤, ≥αΩ Φ τα ≥σ∞, ΩαΩ ε±≤∙σ±≥Γδ σ≥±  Σε±≥≤∩ Ω ⌠αΘδ≤ ε  Σσpφε∞ pσαΩ≥εpσ; Φ αφαδεπΦ≈φε, τα ≥σ∞, ΩεπΣα ─µεφ εßpα∙ασ≥±  Ω  Σσpφε∞≤ pσαΩ≥εp≤.

[NCSC2]

NCSC, "A Guide to Understanding DISCRETIONARY ACCESS CONTROL in Trusted Systems", NCSC-TG-003, Version-1, 30 September 1987, 29 pages.

─Φ±Ωpσ÷Φεφφα  ≤∩pαΓδσφΦσ Σε±≥≤∩ε∞ - ±α∞√Θ pα±∩pε±≥pαφσφφ√Θ ≥Φ∩ ∞σ⌡αφΦτ∞α ≤∩pαΓδσφΦ  Σε±≥≤∩ε∞, pσαδΦτεΓαφφεπε Γ Ωε∞∩ⁿ■≥σpφ√⌡ ±Φ±≥σ∞α⌡ ±σπεΣφ . ╬±φεΓεΘ ²≥επε ΓΦΣα ßστε∩α±φε±≥Φ  Γδ σ≥±  Γετ∞εµφε±≥ⁿ ε≥Σσδⁿφεπε ∩εδⁿτεΓα≥σδ  ΦδΦ ∩pεπpα∞∞√, pαßε≥α■∙σΘ ε≥ σπε Φ∞σφΦ, ≤Ωατα≥ⁿ  Γφε ≥Φ∩√ Σε±≥≤∩α, Ωε≥εp√σ Σp≤πΦσ ∩εδⁿτεΓα≥σδΦ ΦδΦ ∩pεπpα∞∞√, pαßε≥α■∙Φσ ε≥ Φ⌡ Φ∞σφΦ, ∞επ≤≥ ε±≤∙σ±≥Γδ ≥ⁿ Ω τα∙Φ∙ασ∞εΘ Φφ⌠εp∞α÷ΦΦ. ─Φ±Ωpσ÷Φεφφεσ ≤∩pαΓδσφΦσ Σε±≥≤∩ε∞ φσ  Γδ σ≥±  τα∞σφεΘ ∞αφΣα≥φεπε ≤∩pαΓδσφΦ  Σε±≥≤∩ε∞. ┬ δ■ßεΘ ±pσΣσ, Γ Ωε≥εpεΘ τα∙Φ∙ασ≥±  Φφ⌠εp∞α÷Φ , ΣΦ±Ωpσ÷Φεφφα  ßστε∩α±φε±≥ⁿ εßσ±∩σ≈ΦΓασ≥ ßεδⁿ°≤■ ≥ε≈φε±≥ⁿ Σδ  ≤∩pαΓδσφΦ  Σε±≥≤∩ε∞ Γ pα∞Ωα⌡ επpαφΦ≈σφΦΘ ∞αφΣα≥φεΘ ∩εδΦ≥ΦΩΦ.

[NCSC3]

NCSC, "A Guide to Understanding CONFIGURATION MANAGEMENT in Trusted Systems", NCSC-TG-006, Version-1, 28 March 1988, 31 pages.

╩εφ≥pεδⁿ τα Ωεφ⌠Φπ≤pα÷ΦσΘ ±ε±≥εΦ≥ Φτ ΦΣσφ≥Φ⌠ΦΩα÷ΦΦ, ≤∩pαΓδσφΦ , ∩pε≥εΩεδΦpεΓαφΦ  ±ε±≥ε φΦ  Φ α≤ΣΦpεΓαφΦ . ╧pΦ ΩαµΣε∞ Φτ∞σφσφΦΦ, ∩pεΦτΓεΣΦ∞ε∞ Γ └╤, Σεδµσφ ß√≥ⁿ ∩pσΣ±≥αΓδσφ ∩pεσΩ≥ Φ ≥pσßεΓαφΦ  Ω Φτ∞σφσφφεΘ └╤. ╙∩pαΓδσφΦσ Γ√∩εδφ σ≥±  ± ∩ε∞ε∙ⁿ■ ∩pε±∞ε≥pα Φ ≤≥ΓσpµΣσφΦ  αΓ≥εpΦτεΓαφφ√∞ δΦ÷ε∞ ΩαµΣεπε Φτ∞σφσφΦ  Γ ΣεΩ≤∞σφ≥α÷ΦΦ, εßεp≤ΣεΓαφΦΦ Φ ∩pεπpα∞∞φε∞ εßσ±∩σ≈σφΦΦ. ╧pΦ ≤≈σ≥σ ±ε±≥ε φΦ  ∩pεΦτΓεΣΦ≥±  ∩ε±δσ ΩαµΣεπε Φτ∞σφσφΦ  τα∩Φ±ⁿ εß ²≥ε∞ Φ ΣεΓσΣσφΦσ Σε αΓ≥εpΦτεΓαφφ√⌡ δΦ÷. ═αΩεφσ÷, ± ∩ε∞ε∙ⁿ■ α≤ΣΦpεΓαφΦ  ±εΓσp°σφφεσ Φτ∞σφσφΦσ ∩pεΓσp σ≥±  φα ⌠≤φΩ÷Φεφαδⁿφ≤■ ΩεppσΩ≥φε±≥ⁿ, Φ Σδ  ΣεΓσpσφφ√⌡ └╤, φα ±επδα±εΓαφφε±≥ⁿ ± ╧╨─ └╤.

[NTISS]

NTISS, "Advisory Memorandum on Office Automation Security Guideline", NTISSAM CONPUSEC/1-87, 16 January 1987, 58 pages.

▌≥ε≥ ΣεΩ≤∞σφ≥  Γδ σ≥±  p≤ΩεΓεΣ±≥Γε∞ Σδ  ∩εδⁿτεΓα≥σδσΘ, αΣ∞ΦφΦ±≥pα≥εpεΓ, ε≥Γσ≥±≥Γσφφ√⌡ τα ßστε∩α±φε±≥ⁿ Φ τα ∩ε±≥αΓΩΦ ∩pεπpα∞∞φεπε Φ α∩∩αpα≥φεπε εßσ±∩σ≈σφΦ  Γ └╤. ╬∩Φ±αφ√ ±δσΣ≤■∙Φσ Γε∩pε±√: ⌠ΦτΦ≈σ±Ωα  ßστε∩α±φε±≥ⁿ, ΩαΣpεΓα  ßστε∩α±φε±≥ⁿ, ∩pε÷σΣ≤pφα  ßστε∩α±φε±≥ⁿ, ∩pεπpα∞∞φε- α∩∩αpα≥φ√σ ∞σp√, τα∙Φ≥α ε≥ ╧▌╠╚═, Φ Ωε∞∞≤φΦΩα÷Φεφφα  ßστε∩α±φε±≥ⁿ Σδ  αΓ≥εφε∞φ√⌡ └╤, └╤, Φ±∩εδⁿτ≤σ∞√⌡ ΩαΩ ≥σp∞Φφαδ√, ∩εΣΩδ■≈σφφ√σ Ω ├┬╠, Φ └╤, Φ±∩εδⁿτ≤σ∞√⌡ Γ ╦┬╤. ╧pεΦτΓεΣΦ≥±  ΣΦ⌠⌠σpσφ÷Φα÷Φ  ∞σµΣ≤ └╤, ε±φα∙σφφ√∞Φ ═├╠─ Φ ═╞╠─.

─ε∩εδφΦ≥σδⁿφ√σ ∩≤ßδΦΩα÷ΦΦ NCSC

[NCSC4]

National Computer Security Center, "Glossary of Computer Security Terms", NCSC-TG-004, NCSC, 21 October 1988.

[NCSC5]

National Computer Security Center, "Trusted Computer System Evaluation Criteria", DoD 5200.28-STD, CSC-STD-001-83, NCSC, December 1985.

[NCSC7]

National Computer Security Center, "Guidance for Applying the Department of Defense Trusted Computer System Evaluation Criteria in Specific Environments", CSC-STD-003-85, NCSC, 25 June 1985.

[NCSC8]

National Computer Security Center, "Technical Rationale Behind CSC-STD-003-85: Computer Security Requirements", CSC-STD-004-85, NCSC, 25 June 85.

[NCSC9]

National Computer Security Center, "Magnetic Remanence Security Guideline", CSC-STD-005-85, NCSC, 15 November 1985.

▌≥ε ≡≤ΩεΓεΣ±≥Γε ∩ε∞σ≈σφε π≡Φ⌠ε∞: "╥εδⁿΩε Σδ  ε⌠⌠Φ÷Φαδⁿφεπε Φ±∩εδⁿτεΓαφΦ " ±επδα±φε ≈α±≥Φ 6 ταΩεφα 86-36( 50 U.S. Code 402). ╨α±∩≡ε±≥≡αφσφΦσ ε±≤∙σ±≥Γδ σ≥±  ≥εδⁿΩε Σδ  ∩≡αΓΦ≥σδⁿ±≥Γσφφ√⌡ απσφ≥±≥Γ ╤╪└ Φ Φ⌡ ∩εΣ≡ Σ≈ΦΩεΓ Σδ  τα∙Φ≥√ Ωεφ⌠ΦΣσφ÷Φαδⁿφ√⌡ ≥σ⌡φΦ≈σ±ΩΦ⌡, ε∩σ≡α÷Φεφφ√⌡ Φ αΣ∞ΦφΦ±≥≡α≥ΦΓφ√⌡ Σαφφ√⌡, ε≥φε± ∙Φ⌡±  Ω ≡αßε≥σ └═┴.

[NCSC10]

National Computer Security Center, "Guidelines for Formal Verification Systems", Shipping list no.: 89-660-P, The Center, Fort George G. Meade, MD, 1 April 1990.

[NCSC11]

National Computer Security Center, "Glossary of Computer Security Terms", Shipping list no.: 89-254-P, The Center, Fort George G. Meade, MD, 21 October 1988.

[NCSC12]

National Computer Security Center, "Trusted UNIX Working Group (TRUSIX) rationale for selecting access control list features for the UNIX system", Shipping list no.: 90-076-P, The Center, Fort George G. Meade, MD, 1990.

[NCSC13]

National Computer Security Center, "Trusted Network Interpretation", NCSC-TG-005, NCSC, 31 July 1987.

[NCSC14]

Tinto, M., "Computer Viruses: Prevention, Detection, and Treatment", National Computer Security Center C1 Technical Report C1-001-89, June 1989.

[NCSC15]

National Computer Security Conference, "12th National Computer Security Conference: Baltimore Convention Center, Baltimore, MD, 10-13 October, 1989: Information Systems Security, Solutions for Today - Concepts for Tomorrow", National Institute of Standards and National Computer Security Center, 1989.