Handbook of Infosec Terms 2.0/Handbook_of_Infosec_Terms_Version_2.0_ISSO.iso/text/dacum/dacumiii.txt

Text File | 1996-09-12 | 205KB | 9,634 lines

DACUM III

Center for Decision Support

Idaho State University
Center Report 184

Edited by
Corey D. Schou
The Center for Decision Support
and
James Frost, Nathan Wingert, Herb LaFond
Simplot Decision Support Center




January 1994
Draft








Preface

As a result of the Computer Security Act of 1987 , government agencies have identified over 50,000
sensitive systems. Individuals who are operationally involved with these systems are required by the
1987 act to receive security training. The National Institute of Standards and Technology (NIST) is
entrusted with the major program responsibilities for government wide computer security and their
initiatives have increased the awareness and improved management and application of technology to
government security. Many companies have recognized the need to meet the spirit of this require-
ment. One conservative estimate based on numbers of systems is that the private sector need for in-
formation and computer security is at least twice the governmental need.

As we all know, the United States Federal Government is characterized by a large number of com-
peting agencies with complex agendas. An example of this complexity is shown by a recent Office of
Personnel Management (OPM) regulation that outlines the training requirement of the Computer
Security Act.

The December 4, 1991, edition of the Federal Register announced that effective January 3, 1992 , the
heads of Federal agencies are to provide computer security training as outlined in the National
Institute of Standards and Technology (NIST Computer Security Training Guidelines).



The mandated training is to be provided:
1.    to all new employees who fit one of five categories of computer users, within 60 days of their appointment
2.    whenever there is a significant change in the agency information security environment or procedures or
when an employee enters a new position which deals with sensitive information.
3.    as computer security refresher training as determined by the agency, based on the sensitivity of
information that the employee uses or processes.

This training must be provided by all agencies and many Federal contractors. The spectrum of end
users extends from the United States Postal Service to the Department of Defense Ñ The Department
of Education to the Department of Energy.

How should one go about identifying and resolving the critical training issues? These issues were de-
fined in NIST Special Publication 500-172, Computer Security Training Guidelines, by Mary Anne
Todd and Constance Guitan. During 1992 NIST and the NCSC convened a meeting at the Simplot
Decision Center at Idaho State University.

Todd Model NIST 500-172
The Todd model had been reviewed as part of DACUM I. The original model had five categories:
¥    Executives
¥    Program/Functional Managers
¥    IRM, Security, and Audit Personnel
¥    ADP Management, Operations and
    Programming Staff
¥    End Users
The objective was to review the Todd model and to develop awareness materials for use by FISSEA .
As a result of experience in working with the NIST publication and subsequent technological
development, updating the document was recommended in terms of security awareness, training
content, and target audience categories.

Todd Model as Revised by DACUM I
Based on the consensus reached during DACUM I, the granularity of target categories was modified.
The new categories were
¥    Executives
¥    Program Managers
¥    Functional Managers
¥    IRM
¥    Security and Audit
¥    ADP Management and Operations
¥    End Users

The DACUM I team decided that the changes were appropriate for the awareness level activities. As
the DACUM II team addressed the training activities, they decided that a category set that dealt with
function performed rather than management level made more useful.

Creation of New AT&E Matrix
After the team had identified the areas that needed change, they developed a new approach that
combined the best of the Todd, McCumber, and NSTISSC models. After reviewing the Todd model,
the team decided that the awareness materials and categories as modified by the DACUM 1.5
meeting would be adequate.

At the training level the team then decided to create categories based on functions. These categories
were:
Manage    Acquire    Design and Implement    Operate     Use
The team realized that others may define new categories; therefore, they created a category called
Other  to provide extensibiility.

To provide transition from Awareness to Training, the team decided to prescribe a common knowl-
edge base that would be expected for each of the functional categories. This element has been called
Literacy and INFOSEC Basics. This is envisioned as a common course (above the Awareness level)
across all Federal agencies. If an employee were to have had this background, he/she could be ex-
pected to enter any of the appropriate functional courses.

The preliminary results of the second Design a Curriculum (DACUM  II) sessions held at Idaho State
University were published in August 1993 as Center For Decision Report 154. The DACUM was
conducted over a six-day period during August 1993.

The meetings were conducted by the staff of the Center for Decision Support in the Simplot Decision
Center. All data were collected using the Paradigm software package (v 1.5.8). All materials from
DACUM I (1992), DACUM II (1993) and the OGreen BookO  (Center Report 162), were available
to all participants as on-line documents. In addition there were over 33Mb of documents for
participant use. As the teams worked on the various aspects of the project, all related pervious writing
was made available to the entire team.





Introduction

A Unified Taxonomy for INFOSEC Professionals

The taxonomy presented in this report represents a compilation, distillation, and enhancement of ex-
isting attempts by a variety of organizations to define a Common Body of Knowledge (CBK) for
INFOSEC practitioners and professionals.. For definitional purposes, a Common Body of Knowledge
represents that body of knowledge that is integral to the manner in which an INFOSEC professional
performs his/her job. A CBK also represents a relatively stable body of knowledge, encompassing the
axioms, lore, and methods of the trade. The CBK outlined in this report condensed over nine hundred
individual items  into a listing of 384 behavioral descriptions. Those descriptions are partitioned into
two major categories:
¥    things you need to know, and
¥    things you need to do.

The resulting Unified Taxonomy can be used as a reference point by both curriculum developers and
authors. This taxonomy codifies, for the moment , those knowledges, skills and abilities (KSA)
which define the core information for all practitioners, regardless of individual areas of expertise. The
Unified Taxonomy also serves as a guide to job classification, career development, and profes-
sionalization activities.

Using a model developed by Dr. Gary Smith as part of a contract with the Center for Information
Systems Security, INFOSEC topic areas were divided into OEncyclopedic KnowledgeO and
OProcess KnowledgeOÑ where Encyclopedic Knowledge describes facts, technologies, and
principles. and Process Knowledge describes how encyclopedic knowledge is used.


Figure 1: Smith Model

Building on this conceptual framework, the group developed a model that is able to account for all
the behavioral descriptions. The two major categories are subdivided into 6 partitions as follows:

    THINGS YOU NEED TO KNOW    THINGS YOU NEED TO DO

    Laws and Regulations    Designing and Engineering
        AIS to be Secure
    Fundamental Security Elements
        Using and Operating AIS Securely
    Technology Oriented Security Elements

    Organization Specific Security Elements

Figure 2: Unified Taxonomy Model

The Unified Taxonomy was developed a continuation of work done previously to update NIST
Special Publication No. 500-172 (Computer Security Training Guidelines (CSTG)). In that July 1993
initiative  professionals identified
(a) The need for a unified taxonomy and
(b) The existence of several taxonomies which had been developed by government, industry
and academia.
The Unified Taxonomy presented in this document represents the uppermost level of operations in the
proposed update to the CSTG, as shown below.

The following figure depicts the relationship of the elements defined by DACUM II.



Figurte 3: DACUM II Model with DACUM III Modifications

The basis of the DACUM II model is the awareness material developed at DACUM I. It provides
minimum compliance with U.S. Code 5 CFR Part 930 subpart C.

After Federal employees have been made aware of their security responsibilities, they should take part
in the second-level Literacy and INFOSEC Basics courses. This course or courses could be de-
veloped as an agency independent training element. This should represent savings to the government.

The third component of the DACUM II model is Function Specific training. It is intended to be spe-
cific to agency needs.

The final component of the model is for security Experts. This is more of an Education rather than a
training or awareness element. Both here and in the Function Specific Training, one would be ex-
pected to demonstrate performance and knowledge. It is expected that future work will be done to
establish the knowledge and performance criteria in each category.

The DACUM II model was designed to be extensible by adding functional categories in the OOther
AreasO of the Function Specific Training. The authors and FISSEA expect suggestions for additions
to this area and suggestions for further refinement of the Literacy and INFOSEC training content ar-
eas. Upon receipt and incorporation of suggestions, FISSEA will submit a working draft revision of
the Computer Security Training Guidelines to NIST for further revision and issuance, and will be
available to coordinate development of the agency independent Basics courses(s)

Integrating DACUM II and DACUM III Results
This Unified Taxonomy presents a model that requires the addition of details. For example, under the
partition labeled "Laws and Regulations,O the authors listed several behavior expectations of
INFOSEC practitioners. One such label is, ORegulations and Public Policies.O It is incumbent upon
course developers and authors to research and list the specific items under this label. Such items
might include entries such as:

    Privacy Act of 1974 (PL 93-579)
    The Computer Security Act of 1987 (PL 100-235)
    Computer Fraud and Abuse Act of 1986 (PL 99-474)
    Management of Federal Information Resources (OMB Circular No. A-130)

When this additional activity is completed, a working OCommon Body Of KnowledgeO will be es-
tablished. At the same time, we recognize that such research will be an ongoing effort -- especially
considering the very dynamic and ever-growing nature of our profession. This fact simply reflects the
extent to which our profession is evolving in response to changes in technology

It appeared to the group that no one final structure of the results of DACUM III would ever satisfy
all end users. Therefore, the final materials will be developed as an interactive Hypertext document.
This strategy will enable all users of the materials to fit the contents of the taxonomy to their organi-
zational needs







THE PROCESS

In November 1993 a group of experts from within the INFOSEC community gathered at The Center
for Decision Support at Idaho State University. These experts representing leaders from government,
industry and academia, employed a process now referred to as ETCORP or an Electronic DACUM .
The purpose of this session was to produce a behaviorally based taxonomy that describes the KSAs
required of an INFOSEC professional. The resulting Unified Taxonomy would then be ready for:

a.    adding specific data/points of information
b.    use by:
1. Job analysts
2. Educators
3. Authors

The steps used to produce this document were:

a.    Agree upon common Knowledges, Skills, and Abilities (KSAs), based on research into the
existing CBK's and professional knowledge of the participants .
b.    Agree on a taxonomic model;
c.    Identify appropriate verbs to agreed-upon KSAs;
        NOTE: This step equates to a Desk Audit type Job Task Analysis.
d.    Group the behavioral statements into an agreed-upon taxonomic model; and
e.     Categorize the behavioral statements into an educational industry standard taxonomy of
learning. The learning hierarchy of that model is divided into three domains: Cognitive,
Psychomotor, and Affective. Each domain is further separated into levels of opera-
tion/complexity. There are commonly accepted verbs that have been associated with each of
those levels.

A by-product of this DACUM is the verification of a hypothesis that topics are not associated with
only one area or category of thinking or behaving. Thus, the treatment of topics such as OthreatO
may realistically be expected to be treated in discussions in several areas (e.g., Organization-Specific
Security Elements and Designing and Engineering AIS).







PARTICIPANTS


Patti Black
Treasury Department
1500 Penn. Ave., N.W.
Room 3090 Annex
Washington, D.C. 20220
Genevieve Burns
Monsanto Co.
800 No. Lindbergh Blvd.
M/S G2EE
St. Louis, MO 63167
Ken Cutler
Information Security Institute
MIS Training Institute
7022 W. Oraibi Drive
Glendale, AZ 85308
Joe Daniel
GSA
1500 Bannistar Rd.
KVIS-6
Kansas City, MO. 64131
Dorothea E. de Zafra, MPIA
Federal Information Systems Security Educators
5600 Fishers Lane
Rm. 17-45, Parklawn
Rockville, MD 20857
Partick Gallagher
National Computer Security Center
9800 Savage Road, ATTN: X64
Ft. George G. Meade, MD 20755-6000
Dennis M. Gilbert
National Institute of Standards and Technology
Building. 225, Rm. A216
Gaithersburg, Md 20899-0001
F. Lynn McNulty
National Institute of Standards and Technology
Building. 225
Gaithersburg, Md 20899-0001
W. Vic Maconachy
National Computer Security Center
9800 Savage Road, ATTN: X64
Ft. George G. Meade, MD 20755-6000
Ramiro A. Montalvo
NESSEC, 3801 Nebraska Ave, NW, Code B40A,
Washington, DC 20393-5454
Cinthia F. Pickett, MPA
National Computer Security Center
9800 Savage Road, ATTN: X64
Ft. George G. Meade, MD
Joan M. Pohly
1415 Lakeside Drive West, Canyon Lake, TX 78133-
5823
Corey D. Schou
Center for Decision Support
Idaho State University
P.O. Box 4043 Pocatello, Idaho 83205-4043
John D. Tressler
Director, ADP Security Oversight Staff
US Dept. of Education
Hal Tipton
ISC2
Director Computer Security
Information Systems Center
Rockwell International Corporation
P. O. Box 2515, Seal Beach, CA 90740, M/C SL64


In addition to these direct participants, the group used the input from the NIST workshops held dur-
ing the summer of 1993.  We have relied heavily on hard work of R. Koenig, Bill Murrary, and their
working groups in building this integrated taxonomy.






Laws and Regulations

From the Unified Taxonomy Model, Laws and Regulations represents one of the areas where indi-
viduals are expected to know details about the specific items. Laws and Regulations established by all
levels of government form the basis for most of the information security requirements. Issues not
specifically covered in existing statutes are usually addressed in the "principles of due care" category
which should be followed to avoid adverse judgments under tort law. The knowledge areas are re-
ported here with the appropriate verbs that should be used to develop the behavioral objectives and
instruction.


Access Control Policies
Apply, Cognizant-Of, Comply-With, Compose,
Defend, Discuss, Explain, Evaluate, Implement,
Revise, Write
Administrative Security Policies And Procedures
Apply, Cognizant-Of, Comply-With, Compose,
Defend, Discuss, Explain, Evaluate, Implement,
Revise, Write
Communications Security Policies And Guidelines
Apply, Cognizant-Of, Comply-With, Compose,
Defend, Discuss, Explain, Evaluate, Implement,
Revise, Write
Computer Matching Responsibilities
Cognizant-Of, Define, Explain, Identify, Perform,
State
COMSEC Accounting
Cognizant-Of, Describe, Perform
COMSEC Material Destruction Procedures
Cognizant-Of, Complies-With, Define, Demonstrate,
Describe, Evaluate, Identify, Use
Contingency Planning
Cognizant-Of, Complies-With, Assist, Define,
Describe, Evaluate, Influence, Initiate, Interpret,
Perform, Use, Verify
Continuity Planning
Cognizant-Of, Complies-With, Assist, Define,
Describe, Evaluate, Influence, Initiate, Interpret,
Perform, Use, Verify
Copyright Protection And Licensing
Cognizant-Of, Complies-With, Assist, Define,
Describe, Evaluate, Monitor, Perform, Use,
Verify
Criminal Prosecution
    Prepare, Propose, Support
Delegation Of Authority
Cognizant-Of, Complies-With, Explain, Use
Disaster Recovery
Cognizant-Of, Complies-With, Define, Describe,
Evaluate, Plan, Support, Test, Report, Use, Write
Disposition Of Classified Information
Cognizant-Of, Complies-With, Describe, Explain,
Organize, Perform, Use, Verify
Education. Training And Awareness
Cognizant-Of, Assist, Develop, Evaluate, Explain,
Initiate, Integrate, Perform, Plan, Prepare,
Present, Select, Support, Use
Electronic Funds Transfer
    Cognizant-Of, Describe, Evaluate, Support, Use,
Verify
Electronic Monitoring
Cognizant-Of, Defend, Define, Describe, Evaluate,
Explain, Initiate, Justify, Perform, Report, Use
Development (Life Cycle)
Apply, Cognizant-Of, Complies-With, Define,
Describe, Initiate, Use
Electronic Records Management
Apply, Cognizant-Of, Complies-With, Describe,
Perform, Report, Use, Verif






Fundamental Security Elements

From the Unified Taxonomy Model, Fundamental Security Elements represents one of the areas
where individuals are expected to know details about the specific items. The Fundamental Security
Elements are the basic building blocks of information security working knowledge (e.g., threats,
vulnerabilities, safeguards, countermeasures, security tools). They are addressed in generic terms so
as to be independent of the technology. That is, they should remain constant through changes in
technology or in the way we think about systems. As an example, specific mechanisms are described
instead of products that may contain multiple mechanisms. The knowledge areas are reported here
with the appropriate verbs that should be used to develop the behavioral objectives and instruction.


Access Control Models
Compare, Define, Explain,
Identify, Evaluate
Access Control Policies
Defend, Explain, Evaluate,
Interpret
Access Controls
Choose, Identify, Justify,
Evaluate, Recommend
Access Privileges
Determine, Evaluate, Recommend
Accountability
Define, Support, Recommend,
Verify
Accountability For Sensitive Data
Defend, Define, Outline, Verify
Administrative Security
Defend, Define, Evaluate,
Interpret
Administrative Security Policies
And Pro
Defend, Explain, Evaluate,
Interpret
Aggregation
Define, Discuss, Evaluate,
Identify
Applications Security
Defend, Define, Evaluate, Verify,
Recommend
Assessments (E.G.. Surveys.
Inspections)
Assist, Review, Perform, Report,
Verify
Assurance
Define, Explain
Audit
Assist, Evaluate, Explain,
Interpret
Audit Trails And Logging
Defend, Define, Interpret, Select
Audit Trails And Logging Policies
Defend, Explain, Evaluate,
Interpret
Authentication
Define, Discuss, Verify
Availability
Define, Discuss, Verify
Background Investigations
Define, Justify
Backups(Data. Software. Etc.)
Define, Initiate, Justify, Verify
Careless Employees
Identify, Influence
Change Control Policies
Defend, Explain, Evaluate,
Interpret
Change Controls
Define, Identify, Justify, Evaluate,
Recommend
Communications Center Security
Define, Evaluate
Communications Security
Define, Evaluate, Identify, Justify,
Plan
Communications Security Policies
And Guidelines
Defend, Explain, Evaluate,
Interpret
Communications Systems Abuse
Define, Evaluate, Identify, Verify
Computer Abuse
Define, Evaluate, Identify, Verify
Computer Matching Responsibilities
Define, Describe, Discuss
Computers At Risk
Read, Describe
Confidentiality
Define, Discuss, Verify
Configuration Management
Define, Discuss, Evaluate, Verify
Consequences
Define, Explain, Examples
Contingency Planning
Define, Describe, Evaluate, Verify
Continuity Planning
Define, Describe, Evaluate, Verify
Contracting For Security Services
Discuss, Evaluate, Justify
Contracts. Agreements. & Other
Obligation
Appraise, Describe, Discuss,
Evaluate, Specify
Coordination With Related
Disciplines
Discuss, Identify, Influence
Copyright Protection And Licensing
Define, Discuss, Enforce, Support
Corrective Actions
Define, Defend, Discuss,
Evaluate, Initiate, Plan,
Recommend, Report, Select,
Verify
Cost/Benefit Analysis
Define, Explain, Verify
Countermeasures
Define, Compare, Defend,
Evaluate, Explain, Identify,
Integrate, Justify, Verify
Criminal Prosecution
Define, Discuss
Critical Systems
Define, Compare, Defend,
Evaluate, Explain, Identify,
Integrate, Justify
Cryptography
Define, Compare, Evaluate,
Explain, Identify, Integrate,
Justify, Verify
Data Access Control
Choose, Compare, Identify,
Justify, Evaluate,
Recommend
Data Processing Center Security
Define, Evaluate, Identify, Justify,
Plan, Verify
Database Integrity
Define, Evaluate, Identify, Justify,
Plan, Verify
Delegation Of Authority
Define, Explain, Verify
Denial Of Service
Define, Evaluate, Explain,
Identify, Justify, Verify
Detective Controls
Define, Evaluate, Interpret,
Recommend, Verify
Development (Life Cycle)
Define, Describe, Evaluate, Verify
Dial-Up Security
Define, Compare, Evaluate,
Explain, Identify, Integrate,
Justify, Verify
Disaster Recovery
Define, Compare, Evaluate,
Explain, Identify, Integrate,
Justify, Verify
Disclosure Of Sensitive Data
Define, Evaluate, Identify, Plan,
Report, Verify
Disgruntled Employees
Define, Identify, Report, Verify
Disposition Of Classified
Information
Define, Evaluate, Discuss, Verify
Disposition Of Media & Data
Define, Evaluate, Discuss, Verify
Document Labeling
Define, Evaluate, Discuss, Verify
Documentation Policies
Defend, Explain, Evaluate,
Interpret
Due Care
Define, Evaluate, Example,
Interpret, Verify
Education. Training And Awareness
Define, Evaluate, Identify, Justify,
Plan
Electronic Monitoring
Define, Discuss, Evaluate, Justify,
Report
Electronic Records Management
Define, Discuss, Evaluate, Verify
Electronic-Mail Privacy
Define, Evaluate, Identify, Justify,
Plan, Verify
Electronic-Mail Security
Define, Evaluate, Identify, Justify,
Plan, Verify
Emanations Security
Define, Evaluate, Identify, Justify,
Plan, Verify
Emergency Destruction
Define, Evaluate, Identify, Justify,
Plan, Verify
End User Computing Security
Define, Evaluate, Identify, Justify,
Plan, Verify
Environmental Controls
Define, Evaluate, Identify, Justify,
Plan, Verify
Environmental/Natural Threats
Define, Discuss, Evaluate,
Identify
Ethics
Define, Discuss, Follows
Evaluated Products
Define, Compare, Evaluate,
Explain, Identify, Integrate,
Justify, Plan, Verify
Export Controls
Define, Identify, Verify
Facilities Planning
Define, Describe, Evaluate, Plan,
Verify
Facility Management
Define, Discuss, Evaluate, Plan,
Verify
Fax Security
Define, Evaluate, Identify, Justify,
Plan, Verify
Fire Prevention And Protection
Define, Evaluate, Identify, Justify,
Plan, Verify
Fraud
Define, Identify, Report, Verify
Fraud. Waste And Abuse
Define, Identify, Report, Verify
Generally Accepted Systems
Security Principles
Cognizant-Of, Complies-With,
Describe, Identify, Influence,
Interpret, Use
Hackers And Unauthorized Users
Define, Discuss, Identify, Report
Hardware Asset Management
Define, Discuss, Evaluate, Verify
History Of Information Security
Discuss, Example
Hostile Overseas Intelligence
Sources(Ho
Define, Discuss, Evaluate,
Identify, Report
Housekeeping Procedures
Define, Verify
Human Threats
Define, Discuss, Evaluate,
Identify, Report
Identification & Authentication
Define, Evaluate, Identify, Justify,
Plan, Verify
Implementation (Life Cycle)
Define, Identify, Verify
Incident Response
Define, Evaluate, Identify, Justify,
Plan, Verify
Industrial Espionage
Define, Discuss, Evaluate,
Identify, Report
Industrial Security
Define, Evaluate, Identify, Justify,
Plan, Plan, Verify
Info Sys Security Program
Budgeting
Define, Discuss, Evaluate, Justify,
Report, Verify
Info Sys Security Program Planning
Define, Describe, Evaluate, Verify
Information Availability
Define, Evaluate, Identify, Justify,
Plan, Verify
Information Categorization
Define, Evaluate, Outline, Verify
Information Classification
Define, Evaluate, Outline, Verify
Information Confidentiality
Define, Evaluate, Outline, Verify
Information Criticality
Define, Discuss, Evaluate
Information Security Policy
Defend, Explain, Evaluate,
Interpret
Information State
Define, Evaluate, Outline, Verify
Information Systems Security
Officer
Define, Verify
Information Valuation
Define, Evaluate, Outline, Verify
Insurance
Define, Evaluate, Outline, Verify
Integrity
Define, Evaluate, Outline, Verify
Internal Controls And Security
Define, Evaluate, Identify, Justify,
Plan, Verify
International Espionage
Define, Discuss, Evaluate,
Identify, Report
International Security
Considerations
Cognizant-Of, Compare,
Describe, Explain, Identify,
Study
INTERNET Security
Define, Evaluate, Identify, Justify,
Plan, Verify
Intrusion Detection
Define, Evaluate, Identify, Justify,
Plan, Verify
Intrusion Deterrents
Define, Evaluate, Identify, Justify,
Plan, Verify
Is/It Asset Valuation
Define, Evaluate, Identify, Justify,
Plan, Verify
Key Management
Define, Evaluate, Identify, Justify,
Plan, Verify
Keystroke Monitoring
Define, Evaluate, Identify, Justify,
Plan, Verify
Law Enforcement Interfaces
Evaluate, Identify, Plan, Verify
Lessons Learned
Define, Discuss, Evaluate,
Outline
Life Cycle System Security Planning
Define, Describe, Evaluate, Verify
Local Area Network Security
Define, Evaluate, Identify, Justify,
Plan, Verify
Low Power
Define, Discuss, Evaluate,
Identify, Report
Magnetic Remanance
Define, Discuss, Evaluate,
Identify, Report
Malicious Code
Define, Discuss, Evaluate,
Identify, Report
Management Of The Security
Function
Define, Outline, Verify
Marking Of Media
Define, Evaluate, Justify, Plan,
Verify
Marking Of Sensitive Information
Define, Evaluate, Justify, Plan,
Verify
Masquerading
Define, Discuss, Evaluate,
Identify, Report
Media Convergence
Define, Discuss, Explain, Plan
Mobile Workstation Security
Define, Evaluate, Identify, Justify,
Plan, Verify
Modems
Define, Evaluate, Select,
Recommend, Verify
Monitoring
Define, Discuss, Evaluate,
Outline,
National Information Infrastructure
(NII
Define, Describe, Discuss
Need-To-Know Controls
Define, Evaluate, Identify, Justify,
Plan, Verify
Network Security
Define, Evaluate, Identify, Justify,
Plan, Verify
Network Topology
Define, Discuss, Evaluate,
Outline
Non-Repudiation
Define, Evaluate, Outline, Verify
Object Reuse
Define, Discuss, Evaluate,
Identify, Report
Off-Site Security (Information.
Processing)
Define, Evaluate, Identify, Justify,
Plan, Verify
Operating Systems
Define, Discuss, Evaluate
Operations Security
Define, Evaluate, Identify, Justify,
Plan, Verify
Optical/Imaging Systems Security
Define, Evaluate, Identify, Justify,
Plan, Verify
Oversight
Define, Discuss, Verify
Password Management
Define, Discuss, Evaluate, Verify
Personnel Security Policies And
Guidance
Defend, Explain, Evaluate,
Interpret
Physical Security
Define, Evaluate, Identify, Justify,
Plan, Verify
Policy Development
Defend, Discuss, Outline, Justify,
Verify
Policy Enforcement
Define, Evaluate, Identify, Justify,
Plan, Verify
Position Sensitivity
Define, Evaluate, Identify, Justify,
Plan, Verify
Power Controls (Ups. Emergency
Power)
Define, Evaluate, Identify, Justify,
Plan, Verify
Preventive Controls
Define, Evaluate, Identify, Justify,
Plan, Verify
Principles Of Control
Define, Discuss, Evaluate
Privacy
Define, Describe, Evaluate, Verify
Private Branch Exchange (PBX)
Security
Define, Evaluate, Identify, Justify,
Plan, Verify
Professional Interfaces
Build, Define, Outline
Protected Distributed System
Define, Evaluate, Identify, Justify,
Plan, Recommend, Select,
Verify
Protected Services
Define, Evaluate, Identify, Justify,
Plan, Recommend, Select,
Verify
Protection From Malicious Code
Define, Evaluate, Identify, Justify,
Plan, Recommend, Select,
Verify
Quality Assurance
Define, Discuss, Verify
Redundancy
Define, Evaluate, Identify, Justify,
Plan, Recommend, Select,
Verify
Reference Monitor
Define, Evaluate, Identify, Justify,
Plan, Recommend, Select,
Verify
Remanance
Define Discuss, Evaluate,
Identify, Report
Risk Acceptance Process
Define, Evaluate, Identify, Justify,
Plan, Recommend, Select,
Verify
Risk Assessment
Define, Evaluate, Identify, Justify,
Plan, Recommend, Select,
Verify
Risk Management
Words Define, Evaluate, Identify,
Justify, Plan, Recommend,
Select, Verify
Risks
Define Discuss, Evaluate,
Identify, Report
Safeguards
Define Discuss, Evaluate,
Identify, Report, Verify
Safety
Define Discuss, Evaluate,
Identify, Report, Verify
Secure System Operations
Define, Evaluate, Identify, Justify,
Plan, Verify
Security Architecture
Define, Evaluate, Identify, Justify,
Plan, Verify
Security Awareness
Define, Evaluate, Identify, Justify,
Perform, Plan
Security Education
Define, Evaluate, Identify, Justify,
Plan
Security Products
Define, Evaluate, Identify, Justify,
Plan, Recommend, Select,
Verify
Security Reviews
Define, Evaluate, Identify, Justify,
Plan, Verify
Security Training
Categorize, Define, Evaluate,
Identify, Justify, Plan, Verify
Sensitive System
Define, Evaluate, Explain,
Identify, Integrate, Justify
Separation Of Duties
Define, Evaluate, Identify, Justify,
Plan, Verify
Social Engineering
Define, Defend, Discuss,
Evaluate, Initiate, Plan,
Recommend, Report, Select,
Verify
Software Asset Management
Define, Evaluate, Identify, Justify,
Plan, Verify
Software Licensing
Define, Discuss, Evaluate, Verify
Software Piracy
Define, Discuss, Verify
Software Security
Define, Evaluate, Identify, Justify,
Plan, Verify
Spoofing
Define, Evaluate, Identify, Verify
Standards
Define, Describe, Summarize,
Verify
Standards Of Conduct
Define, Evaluate, Identify, Justify,
Plan, Verify
Storage Media Protection And
Control
Define, Evaluate, Identify, Justify,
Plan, Verify
Technical Surveillance
Countermeasures
Define Discuss, Evaluate,
Identify, Verify
Technological Threats
Define, Discuss, Evaluate,
Identify, Report
Technology Trends
Define, Identify, Discuss
Third-Party Evaluation
Define, Evaluate, Identify, Justify,
Plan, Verify
Threat
Define, Discuss, Evaluate,
Identify, Report
Transportation Of Media
Define, Evaluate, Identify, Justify,
Plan, Verify
Trust
Categorize, Define, Discuss
Trusted Comp Sys Eval.
Criteria(Orange Book)
Describe, Read
Trusted Network Interpretation
(Red Book
Describe, Read
Unauthorized Disclosure Of
Information
Define, Discuss, Evaluate,
Identify, Report
Voice Communications Security
Define, Evaluate, Identify, Justify,
Plan, Verify
Voice Mail Security
Define, Evaluate, Identify, Justify,
Plan, Verify
Vulnerability Analysis
Define, Evaluate, Identify, Justify,
Plan, Verify
Warranties
Define, Discuss, Evaluate, Verify
Wide Area Network Security
Define, Evaluate, Identify, Justify,
Plan, Verify
Witness Interviewing/Interrogation
Define, Discuss
Workstation Security
Define, Evaluate, Identify, Justify,
Plan, Verify
Certification
Assist, Define, Evaluate, Plan,
Verify






Technology Oriented Security Elements

From the Unified Taxonomy Model, Technology Oriented Security Elements represents one of the
areas where individuals are expected to know details about the specific items. The Technology
Oriented Security Elements provide a technological perspective both on how Fundamental Security
Elements are packaged in major parts of systems (e.g., operating systems, networks) and other tech-
nology-based considerations (e.g., architecture issues). Information about security designs, con-
straints, issues, features and examples are provided. The knowledge areas are reported here with the
appropriate verbs that should be used to develop the behavioral objectives and instruction.


Access Authorization
Define, Verify, Evaluate
Access Control Models
Define, Compare, Contrast,
Explain, Select, Evaluate
Access Control Policies
Defend, Explain, Evaluate,
Interpret
Access Control Software
Define, Evaluate, Justify,
Recommend
Access Controls
Define, Describe, Evaluate, Select
Access Privileges
Define, Describe, Evaluate
Alarms. Signals And Report
Define, Select, Evaluate, Verify
Acquisitions
Define, Evaluate, Recommend
Asynchronous & Synchronous
Communication
Define, Compare, Contrast,
Verify, Examples
Attenuation
Define, Describe, Verify,
Examples
Binding/Handshaking
Define, Evaluate, Explain
Biometrics
Define, Compare, Contrast,
Evaluate, Justify
Burst Transmission
Define, Describe, Evaluate,
Justify, Plan
Cabling
Define, Compare, Contrast,
Recommend, Verify
Call-Back Security
Define, Describe, Evaluate,
Justify, Plan
Caller Id
Define, Describe, Evaluate,
Justify, Plan
Circuit-Switched Networks
Define, Compare, Defend,
Evaluate, Integrate, Justify,
Verify
Client/Server Security
Define, Explain, Compare,
Contrast, Justify, Evaluate,
Integrate, Verify
Common Carrier Security
Define, Explain, Compare,
Defend, Integrate, Justify,
Verify
Communications Security
Define, Evaluate, Identify, Justify,
Plan
Compartmented/Partitioned Mode
Define, Compare, Justify,
Evaluate, Verify
Computer Emergency Response
Team(CERT)
Define, Describe, Justify, Plan
Computer Science & Architecture
Define, Discuss, Evaluate
COMSEC Accounting
Define, Describe
COMSEC Custodian
Define, Describe, Identify
COMSEC Material Destruction
Procedures
Define, Describe, Evaluate, Verify
COMSEC Material Identification &
Invent
Define, Describe, Comply, Verify
COMSEC Testing
Define, Describe, Evaluate,
Report, Verify
Configuration Management
Define, Discuss, Evaluate, Verify
Conformance Testing
Define, Describe, Evaluate,
Report, Verify
Contingency Plan Testing
Define, Describe, Evaluate,
Report, Verify
Corrective Actions
Define, Defend, Discuss,
Example, Evaluate, Initiate,
Plan, Recommend, Report,
Select, Verify
Covert Channels
Define, Describe, Compare,
Evaluate, Report
Cryptographic Techniques
Define, Compare, Describe,
Evaluate, Integrate, Justify,
Verify
Cryptovariable
Define, Describe, Examples
Dedicated Line
Define, Compare, Defend,
Evaluate, Integrate, Justify,
Verify
Dedicated Mode
Define, Compare, Defend,
Evaluate, Integrate, Justify,
Verify
Dial Number Indicator
Define, Describe, Compare,
Verify
Dial-Up Security
Define, Explain, Compare,
Defend, Integrate, Justify,
Verify
Digital/Analog Technology
Define, Compare, Contrast,
Evaluate, Justify, Verify
Diskless Workstations
Define, Describe, Examples
Disaster Recovery
Define, Describe, Defend,
Evaluate, Integrate, Justify,
Verify
Disaster Recovery Plan Testing
Define, Describe, Evaluate,
Justify, Verify
Disaster Recovery Planning
Define, Describe, Integrate,
Evaluate, Verify
Discretionary Access Control
Define, Describe, Evaluate,
Justify, Verify
Disposition Of Media & Data
Define, Evaluate, Discuss, Plan,
Verify
Distributed Systems Security
Define, Evaluate, Identify, Justify,
Plan
Document Labeling
Define, Evaluate, Describe,
Justify, Verify
Documentation
Define, Categorize, Outline,
Verify, Evaluate, Justify,
Examples
Drop-Off/Add-On Protection(Piggy
Backing
Define, Describe, Identify,
Report, Verify
Electromagnetic Countermeasures
Define, Defend, Describe,
Evaluate, Justify, Plan, Verify
Electromagnetic Interference
Define, Describe, Evaluate,
Report, Verify
Electronic Data Interchange
Define, Describe, Example,
Evaluate, Integrate, Interpret,
Verify
Electronic Funds Transfer
Define, Describe, Example,
Evaluate, Integrate, Interpret,
Verify
Electronic Key Management System
Define, Compare, Describe,
Evaluate, Identify, Integrate,
Justify, Verify
Electronic Monitoring
Define, Discuss, Evaluate, Justify,
Report
Electronic Records Management
Define, Discuss, Evaluate, Verify
Electronic Sources Of Security
Information
Define, Discuss, Evaluate,
Recommend, Verify
Electronic-Mail Privacy
Define, Example, Evaluate,
Identify, Justify, Plan, Verify
Electronic-Mail Security
Define, Example, Evaluate,
Identify, Justify, Plan, Verify
Emanations Security
Define, Example, Evaluate,
Identify, Justify, Plan, Verify
Encryption Modes
Define, Describe, Compare,
Contrast, Examples
Error Logs
Define, Discuss, Evaluate, Verify
Evaluated Products
Define, Discuss, Evaluate, Justify,
Example, Identify, Plan,
Verify
Evaluation Techniques
Define, Discuss, Evaluate, Justify,
Example, Identify, Plan,
Verify
Expert Security/Audit Tools
Define, Describe, Evaluate,
Justify, Example, Identify,
Plan, Verify
Expert Systems
Define, Describe, Evaluate,
Justify, Example, Identify,
Plan, Verify
Fault Tolerance
Define, Explain, Evaluate, Justify,
Example, Identify, Plan,
Verify
Fax Security
Define, Explain, Evaluate, Justify,
Example, Identify, Plan,
Verify
Filtered Power
Define, Explain, Evaluate, Justify,
Example, Identify, Plan,
Verify
Firmware Security

Formal Methods For Security
Design
Define, Describe, Summarize
Frequency Hopping
Define, Explain, Evaluate, Justify,
Example, Identify, Plan,
Verify
Grounding
Define, Compare, Contrast,
Describe, Evaluate, Identify,
Plan, Verify
INTERNET Security
Define, Evaluate, Identify, Justify,
Plan, Verify
Intrusion Detection
Define, Compare, Contrast,
Describe, Evaluate, Identify,
Plan, Verify
Intrusion Deterrents
Define, Compare, Contrast,
Describe, Evaluate, Identify,
Plan, Verify
Isolation And Mediation
Define, Compare, Contrast,
Describe, Evaluate, Identify,
Plan, Verify
Jamming
Define, Compare, Contrast,
Describe, Evaluate, Identify,
Plan, Verify
Kernel
Define, Demonstrate, Describe,
Evaluate, Example, Integrate,
Interpret, Verify
Key Certificate Administration
Define, Describe, Evaluate,
Report, Verify
Keystroke Monitoring
Define, Compare, Contrast,
Describe, Evaluate, Identify,
Plan, Verify
Labeling
Define, Describe, Evaluate,
Example, Justify, Plan,
Verify
Leased-Line Networks
Define, Compare, Defend,
Evaluate, Integrate, Justify,
Verify
Least Privilege
Define, Describe, Evaluate,
Example, Justify, Plan,
Verify
Line Authentication
Define, Describe, Evaluate,
Example, Justify, Plan,
Verify
Line Of Sight
Define, Evaluate, Example,
Explain, Identify, Verify
List-Based Access Controls
Define, Compare, Contrast,
Describe, Evaluate, Example,
Justify, Plan, Verify
Local Area Network Security
Define, Evaluate, Example,
Explain, Identify, Verify
Logs And Journals
Define, Describe, Evaluate,
Example, Identify, Verify
Low Power
Define, Discuss, Evaluate,
Identify, Report
Magnetic Remanance
Define, Discuss, Evaluate,
Identify, Report
Malicious Code
Define, Discuss, Evaluate,
Identify, Report
Mandatory Access Control
Define, Describe, Evaluate,
Justify, Verify
Marking Of Media
Define, Describe, Evaluate,
Justify, Verify
Marking Of Sensitive Information
Define, Describe, Evaluate,
Justify, Verify
Memory (Non-Volatile)
Define, Describe, Evaluate,
Justify, Verify
Memory (Random)
Define, Describe, Evaluate,
Justify, Verify
Memory (Sequential)
Define, Describe, Evaluate,
Justify, Verify
Memory (Volatile)
Define, Describe, Evaluate,
Justify, Verify
Message Authentication Codes
Define, Describe, Evaluate,
Justify, Verify
Microwave/Wireless
Communications Security
Define, Explain, Evaluate, Justify,
Example, Identify, Plan,
Verify
Mobile Workstation Security
Define, Explain, Evaluate, Justify,
Example, Identify, Plan,
Verify
Modems
Define, Evaluate, Select,
Recommend, Verify
Modes Of Operation
Define, Contrast, Evaluate,
Identify
Monitoring (E.G.. Data. Line)
Define, Discuss, Evaluate,
Outline
Multilevel Processing
Define, Describe, Evaluate,
Justify, Verify
Multilevel Security
Define, Describe, Evaluate,
Justify, Verify
Network Communications Protocols
Define, Demonstrate, Describe,
Evaluate, Example, Integrate,
Interpret, Verify
Network Firewalls
Define, Describe, Evaluate,
Justify, Verify
Network Monitoring
Define, Describe, Evaluate,
Justify, Verify
Network Security
Define, Evaluate, Example,
Explain, Identify, Verify
Network Security Software
Define, Explain, Evaluate, Justify,
Example, Identify, Plan,
Verify
Network Switching
Define, Compare, Defend,
Evaluate, Integrate, Justify,
Verify
Network Topology
Define, Discuss, Evaluate,
Outline
Object Labeling
Define, Describe, Evaluate,
Justify, Verify
Object Reuse
Define, Discuss, Evaluate,
Identify, Report
Off-Site Security (Information.
Processing)
Define, Evaluate, Identify, Justify,
Plan, Verify
One-Time Passwords
Define, Describe, Evaluate,
Justify, Verify
Open Systems Interconnect (OSI)
Model
Define, Describe, Summarize,
Verify, Relate
Operating System Integrity
Define, Evaluate, Outline, Verify
Operating System Security Features
Define, Compare, Evaluate,
Explain, Identify, Integrate,
Justify, Verify
Operating Systems
Define, Discuss, Evaluate
Operations Security
Define, Evaluate, Identify, Justify,
Plan, Verify
Optical/Imaging Systems Security
Define, Evaluate, Identify, Justify,
Plan, Verify
Packet Filtering
Define, Describe, Evaluate,
Justify, Verify
Packet-Switched Networks
Define, Compare, Defend,
Evaluate, Integrate, Justify,
Verify
Password Management
Define, Discuss, Evaluate, Plan,
Verify
Peer-To-Peer Security
Define, Evaluate, Identify, Justify,
Plan, Verify
Penetration Testing
Define, Evaluate, Identify, Justify,
Plan, Verify
Platform-Specific Security
Define, Evaluate, Identify, Justify,
Plan, Verify
Power Controls (Ups. Emergency
Power)
Define, Evaluate, Identify, Justify,
Plan, Verify
Private Branch Exchange (PBX)
Security
Define, Evaluate, Identify, Justify,
Plan, Verify
Private Key Cryptology
Define, Evaluate, Identify, Justify,
Plan, Verify
Private Networks
Define, Compare, Defend,
Evaluate, Integrate, Justify,
Verify
Privileges (Class. Nodes)
Define, Evaluate, Identify, Justify,
Plan, Verify
Protected Distributed System
Define, Evaluate, Identify, Justify,
Plan, Verify
Protected Services
Define, Evaluate, Identify, Justify,
Plan, Recommend, Select,
Verify
Protection From Malicious Code
Define, Evaluate, Identify, Justify,
Plan, Recommend, Select,
Verify
Protective Technology
Defend, Define, Evaluate,
Identify, Justify, Select,
Verify
Public Key Encryption
Define, Evaluate, Identify, Justify,
Plan, Recommend, Select,
Verify
Redundancy
Define, Evaluate, Identify, Justify,
Plan, Recommend, Select,
Verify
Remote Terminal Protection
Devices
Define, Evaluate, Identify, Justify,
Plan, Recommend, Select,
Verify
Role-Based Access Controls
Define, Evaluate, Identify, Justify,
Plan, Recommend, Select,
Verify
Rules-Based Access Control
Define, Evaluate, Identify, Justify,
Plan, Recommend, Select,
Verify
Safeguards
Define, Evaluate, Identify, Justify,
Plan, Recommend, Select,
Verify
Satellite Communications Security
Define, Evaluate, Identify, Justify,
Plan, Verify
Security Architecture
Define, Evaluate, Identify, Justify,
Plan, Verify
Security Domains
Define, Evaluate, Identify, Justify,
Plan, Recommend, Select,
Verify
Security Product Integration
Define, Evaluate, Identify, Justify,
Plan, Recommend, Select,
Verify
Security Product Testing/Evaluation
Define, Evaluate, Identify, Justify,
Plan, Recommend, Select,
Verify
Security Products
Define, Evaluate, Identify, Justify,
Plan, Recommend, Select,
Verify
Shielded Enclosures
Define, Evaluate, Identify, Justify,
Plan, Recommend, Select,
Verify
Single Sign-On
Define, Evaluate, Identify, Justify,
Plan, Recommend, Select,
Verify
Smartcards/Token Authentication
Define, Evaluate, Identify, Justify,
Plan, Recommend, Select,
Verify
Software Asset Management
Define, Discuss, Evaluate, Verify
Software Engineering
Define, Discuss, Evaluate, Verify
Space Systems Security
Define, Evaluate, Identify, Justify,
Plan, Verify
Spoofing
Define, Evaluate, Identify, Verify,
Report
Spread Spectrum Analysis
Define, Evaluate, Identify, Justify,
Plan, Recommend, Select,
Verify
Standalone Systems And Remote
Terminals
Define, Compare, Evaluate,
Explain, Identify, Integrate,
Justify, Verify
System Software Controls
Define, Evaluate, Identify, Justify,
Plan, Verify
System Testing And Evaluation
Process
Define, Evaluate, Identify, Justify,
Plan, Recommend, Select,
Verify
System-High Mode
Define, Evaluate, Identify, Justify,
Plan, Verify
Systems Security Engineering
Define, Discuss, Evaluate, Verify
Technology Trends
Define, Identify, Discuss
Tempest
Define, Evaluate, Identify, Justify,
Plan, Verify
Validation (Testing)
Define, Evaluate, Identify, Justify,
Plan, Recommend, Select,
Verify
Value-Added Networks
Define, Evaluate, Identify, Verify,
Report
Verification And Validation Process
Define, Evaluate, Identify, Verify,
Report
Voice Communications Security
Define, Evaluate, Identify, Justify,
Plan, Verify
Voice Mail Security
Define, Evaluate, Identify, Justify,
Plan, Verify
Wide Area Network Security
Define, Evaluate, Identify, Justify,
Plan, Verify
Wide Area Networks
Define, Evaluate, Identify, Verify,
Report
Workstation Security
Define, Evaluate, Identify, Justify,
Plan, Verify






Organization Specific Security Elements

From the Unified Taxonomy Model, Organization Specific Security Elements represents one of the
areas where individuals are expected to know details about the specific items. Organization Specific
Security Elements identify major elements of the operational environment that must be known to ef-
fectively implement and operate information systems securely. The major elements include both
knowledge about the organizational environment and the security properties of the installed base of
information technology.

Prerequisite knowledge includes management techniques, organizational budgeting and planning, and
organizational policies and procedures used in the management and operation of information and
telecommunications systems.

The knowledge areas are reported here with the appropriate verbs that should be used to develop the
behavioral objectives and instruction.

Access Authorization
Verify, Assign, Maintain
Access Control Policies
Develop, Explain, Revise,
Access Controls
Choose, Justify, Explain
Access Privileges
Evaluate
Account Administration
Evaluate, Define
Accountability For Sensitive Data
Defend, Define, Verify
Administrative Security Policies
And Procedures
Change, Defend, Define, Explain,
Evaluate, Follows, Influence,
Initiate, Integrate, Interpret
Agency-Specific Security Policies
Change, Defend, Define, Explain,
Evaluate, Follows, Influence,
Initiate, Integrate, Interpret
Audit Trails And Logging Policies
Change, Defend, Define, Explain,
Evaluate, Follows, Influence,
Initiate, Integrate, Interpret
Background Investigations
Request, Use
Basic/Generic Management Issues
Explain, Identify, Interpret,
Assist, Present, Integrate
Business Aspects Of Information
Security
Explain, Identify, Illustrate,
Interpret
Change Control Policies
Change, Defend, Define, Explain,
Evaluate, Follows, Influence,
Initiate, Integrate, Interpret
Classified Materials(E.G. Handling
And Shipping)
Define, Evaluate, Labels, Report,
Communications Security Policies
And Guidelines
Change, Defend, Define, Explain,
Evaluate, Follows, Influence,
Initiate, Integrate, Interpret
Communications Center Security
Evaluate, Influence, Points Out
Computer Emergency Response
Team(CERT)
Describe, Directs, Use, Evaluate,
Initiate
Computer Matching Responsibilities
Explain, Points Out, Report
COMSEC Custodian
Describe, Identify, Listens,
Support
COMSEC Material Destruction
Procedures
Change, Defend, Define, Explain,
Evaluate, Follows, Influence,
Initiate, Integrate, Interpret,
Report
COMSEC Material Identification &
Inventory
Describe, Perform, Use, Report,
Labels
Configuration Management
Define, Describe, Evaluate,
Influence, Justify, Propose
Contingency Plan Testing
Describe, Evaluate, Outline,
Directs, Initiate,
Demonstrate, Design, Drills,
Estimate, Perform, Plan,
Prepare, Propose,
Summarize, Use, Verify,
Report, Integrate
Contingency Planning
Assist, Define, Describe, Develop,
Evaluate, Influence, Initiate,
Use, Verify
Continuity Planning
Assist, Define, Describe, Develop,
Evaluate, Influence, Initiate,
Use, Verify
Contracting For Security Services
Assist, Discuss, Evaluate,
Influence, Justify, Perform,
Propose, Revise, Use
Contracts, Agreements & Other
Obligations
Arrange, Describe, Discuss,
Evaluate, Influence,
Integrate, Interpret, Prepare,
Revise, Use, Verify
Corrective Actions
Assist, Defend, Design, Discuss,
Evaluate, Follows-Up,
Identify, Initiate, Perform,
Plan, Propose, Report, Select,
Support
Cost/Benefit Analysis
Assist, Defend, Define, Evaluate,
Explain, Initiate, Interpret,
Orders, Perform, Support,
Use, Verify
Criminal Prosecution
Request, Choose, Influence,
Initiate, Prepare,
Recommends, Support
Critical Systems
Define, Differentiate, Example,
Identify, Monitor
Customer It Security Needs
Categorize, Compile, Contrasts,
Define, Describe, Discuss,
Estimate, Generalize,
Identify, Influence, Interpret,
Justify, Listens, Plan,
Predicts, Questions, Relate,
Report, Study, Support,
Verify, Weighs, Prioritizes
Customer Service Orientation
Answers, Assist, Demonstrate,
Discuss, Evaluate, Explain,
Helps, Influence, Initiate,
Interpret, Listens, Plan,
Points Out, Points To,
Responds, Support
Data Processing Center Security
Assist, Builds, Defend, Describe,
Design, Discuss, Evaluate,
Identify, Influence, Initiate,
Integrate, Interpret, Operate,
Organize, Plan, Estimate,
Present, Propose, Report,
Support, Use
Delegation Of Authority
Comply, Defend, Define, Explain,
Interpret, Verify
Disaster Recovery Plan Testing
Describe, Evaluate, Outline,
Directs, Initiate,
Demonstrate, Design, Drills,
Estimate, Perform, Plan,
Prepare, Propose,
Summarize, Use, Verify,
Report, Integrate
Disaster Recovery Planning
Assist, Define, Describe, Develop,
Evaluate, Influence, Initiate,
Use, Verify
Disposition Of Classified
Information
Destroys, Store, Comply, Explain,
Organize, Perform, Verify,
Plan,
Disposition Of Media & Data
Destroys, Store, Comply, Explain,
Organize, Perform, Verify,
Plan,
Distributed Systems Security
Define, Describe, Evaluate,
Identify, Integrate, Justify,
Operate, Plan, Report
Documentation
Assemble, Assist, Categorize,
Create, Describe, Discuss,
Example, Identify, Outline,
Paraphrase, Produce,
Organize, Reproduce, Write,
State, Use. Integrate.
Documentation Policies
Change, Defend, Define, Explain,
Evaluate, Follows, Influence,
Initiate, Integrate, Interpret
Due Care
Use, Verify
Education. Training And Awareness
Plan, Perform, Evaluate
Electronic Records Management
Comply, Demonstrate, Evaluate,
Explain, Identify, Integrate,
Justify, Perform
Electronic-Mail Privacy
Comply, Defend, Describe,
Evaluate, Perform, Plan,
Points To, Verify
Emergency Destruction Procedures
Assist, Demonstrate, Describe,
Perform, Produce,
End User Computing Security
Perform, Plan, Evaluate, Assist
Ethics
Practice, Promotes
Evidence Collection And
Preservation
Assist, Perform, Evaluate,
Support
Expert Security/Audit Tools
Choose, Use
Facilities Planning
Assist, Define, Describe, Develop,
Evaluate, Influence, Initiate,
Use, Verify
Facilities Management
Evaluate, Influence, Assist
Fraud. Waste And Abuse
Identify, Report, Assist
Hackers And Unauthorized Users
Identify, Report, Describe, Assist
Guidelines
Change, Defend, Define, Explain,
Evaluate, Follows, Influence,
Initiate, Integrate, Interpret
Hardware Asset Management
Assemble, Categorize, Comply,
Define, Estimate, Explain,
Perform, Produce,
Inventories
Housekeeping Procedures
Plan, Evaluate, Practice
Identification & Authentication
Words Discuss, Assist, Perform
Implementation (Life Cycle)
Define, Discuss, Distinguish,
Example, Plan
Incident Response
Perform, Design, Evaluate,
Explain, Initiate, Organize,
Plan, Report
Industrial Espionage
Breaks Down, Categorize, Define,
Describe, Discuss, Example,
Identify, Report
Info Sys Security Program
Budgeting
Builds, Compile, Defend,
Discuss, Displays, Estimate,
Evaluate, Justify, Prepare,
Present, Questions, Report,
Revise, Summarize, Support,
Implements
Info Sys Security Program Planning
Change, Defend, Define, Discuss,
Evaluate, Justify, Modify,
Predicts, Perform, Prepare,
Propose, Questions,
Reorganize, Report, Write,
Information Categorization
Evaluate, Defend, Define,
Differentiate, Example,
Explain, Identify, Interpret,
Labels, Organize, Present,
Propose
Information Classification
Evaluate, Defend, Define,
Differentiate, Example,
Explain, Identify, Interpret,
Labels, Organize, Present,
Propose
Information Criticality
Evaluate, Defend, Define,
Differentiate, Example,
Explain, Identify, Interpret,
Labels, Organize, Present,
Propose
Information Ownership
Define, Differentiate, Identify
Information Resource
Owner/Custodian
Identify, Labels, Verify
Information Security Policy
Change, Defend, Define, Explain,
Evaluate, Follows, Influence,
Initiate, Integrate, Interpret
Information Sensitivity
Define, Describe, Evaluate,
Example, Explain, Labels,
Questions, Responds
Information Systems Security
Officer
Perform, Identify, Evaluate,
Assist
Information Valuation
Analyze, Assist, Describe,
Evaluate, Identify, Interpret,
Justify, Labels, Report
Insurance
Appraise, Categorize, Identify,
Describe, Estimate, Justify,
Propose, Assist
Internal Controls And Security
Discuss, Distinguish, Evaluate,
Explain, Identify, Illustrate,
Integrate, Perform, Plan,
Comply, Initiate, Assist
INTERNET Security
Appraise, Define, Design,
Distinguish, Example,
Explain, Identify, Integrate,
Questions, Use, Verify
Intrusion Detection
Implements, Define, Design,
Discuss, Evaluate, Explain,
Identify, Operate, Plan,
Select, Solve, Verify
Investigation Of Security Breaches
Corrects, Define, Perform,
Discovers, Evaluate, Explain,
Identify, Questions, Study,
Report
Investigative Authorities
Identify, Distinguish, Explain
Is/It Asset Valuation
Analyze, Assist, Describe,
Evaluate, Identify, Interpret,
Justify, Labels,
Report
Keystroke Monitoring
Assist, Comply, Describe,
Distinguish, Evaluate,
Integrate, Perform, Plan
Leased-Line Networks
Builds, Connects, Integrate,
Design, Diagrams, Evaluate,
Example, Explain, Identify,
Integrate, Plan
Legal And Liability Issues
Comply, Discuss, Evaluate,
Example, Explain, Identify
Lessons Learned
Categorize, Compare, Describe,
Evaluate, Example, Identify,
Illustrate, Influence, Discuss,
Verify, Practice, Report
Life Cycle System Security Planning
Builds, Define, Demonstrate,
Design, Discuss, Evaluate,
Explain, Prepare, Support,
Assist
Local Area Network Security
Perform, Plan, Evaluate, Assist
Logs And Journals
Compile, Define, Describe,
Discuss, Example, Explain,
Documents, Analyzes
Management Of The Security
Function
Assist, Defend, Describe, Discuss,
Evaluate, Example, Explain,
Organize, Perform, Plan,
Allocates
Marking Of Sensitive Information
Organize, Perform, Comply,
Define, Discuss, Example,
Explain, Produce, Support
Marking Of Media
Organize, Perform, Comply,
Define, Discuss, Example,
Explain, Produce, Support
Monitoring (E.G.. Data. Line)
Organize, Perform, Discuss,
Explain, Report
Multilevel Processing
Comply, Organize, Perform,
Create, Define, Discuss,
Explain
Need-To-Know Controls
Initiate, Outline, Practice,
Integrate
Network Monitoring
Define, Design, Interpret, Justify,
Organize, Select, Analyze,
Use, Prepare, Evaluate,
Operate, Plan,
Network Security
Assist, Builds, Defend, Describe,
Design, Discuss, Evaluate,
Identify, Integrate, Operate,
Organize, Estimate, Propose,
Report, Support
Network Topology
Assist, Builds, Design, Evaluate,
Identify, Integrate, Select,
Organize, Plan, Estimate,
Present, Propose, Support,
Use
Off-Site Security (Information.
Processing)
Assist, Defend, Describe, Design,
Evaluate, Identify, Integrate,
Organize, Plan, Estimate,
Propose, Use
One-Time Passwords
Defend, Define, Describe,
Evaluate, Influence, Operate,
Propose, Select, Generates
Operating System Security Features
Define, Describe, Design,
Evaluate, Identify, Propose,
Support, Cleans, Complies
Org.. Placement Of The Is/It
Security Function
Defend, Define, Explain,
Influence, Support
Organizational Culture
Define, Discuss, Explain,
Influence, Comply, Integrate
Oversight
Define, Discuss, Influence,
Comply, Support,
Coordinate, Practice, Locate,
Report
Password Management
Comply, Define, Design,
Evaluate, Explain, Justify,
Operate, Constructs, Labels
Personnel Security Policies And
Guidance
Assist, Describe, Discuss,
Integrate, Propose, Support,
Define, Evaluate, Use
Platform-Specific Security
Perform, Plan, Evaluate, Assist
Policy Development
Influence, Write, Define,
Describe, Evaluate, Explain,
Justify, Propose, Plan,
Integrate
Policy Enforcement
Assist, Practice, Defend, Discuss,
Evaluate, Influence, Explain,
Report
Position Sensitivity
Assist, Categorize, Describe,
Discuss, Evaluate, Interpret,
Propose
Practices
Define, Evaluate, Identify,
Influence, Support, Estimate,
Corrects, Criticize, Explain,
Justify, Propose
Procedures
Define, Describe, Design,
Evaluate, Identify, Influence,
Support, Write, Criticize,
Explain, Justify, Propose
Professional Interfaces
Builds, Define, Discuss, Extends,
Evaluate, Integrate
Protection From Malicious Code
Categorize, Define, Design,
Evaluate, Explain, Influence,
Initiate, Perform, Plan,
Study, Verify, Support,
Report
Quality Assurance
Define, Discuss, Support,
Comply, Evaluate
Redundancy
Define, Explain, Describe, Justify,
Design, Evaluate, Support
Risk Acceptance Process
Define, Describe, Discuss,
Explain, Recommends,
Support, Evaluate
Risk Management
Define, Describe, Evaluate,
Support, Design, Perform,
Justify, Plan
Roles And Responsibilities
Define, Categorize, Compare,
Contrasts, Explain, Verify,
Evaluate
Secure System Operations
Describe, Discuss, Evaluate,
Justify, Plan, Support
Security Architecture
Define, Describe, Evaluate,
Justify, Prescribes
Security Awareness
Describe, Discuss, Organize,
Promote, Perform, Support,
Plan, Evaluate
Security Education
Describe, Discuss, Organize,
Promote, Perform, Evaluate,
Plan
Security Product Integration
Define, Describe, Develop,
Evaluate, Plan, Support,
Perform, Integrate
Security Reviews
Define, Describe, Plan, Perform,
Support, Evaluate, Follows-
Up, Recommends
Security Staffing Requirements
Define, Propose, Evaluate, Justify,
Plan, Prioritize, Present
Security Training
Define, Specify, Outline,
Evaluate, Perform, Promote,
Verify
Security Violations Reporting
Process
Define, Describe, Develop,
Evaluate, Monitor, Organize,
Follows-Up, Perform, Report
Sensitive System
Define, Describe, Evaluate,
Identify, Verify
Separation Of Duties
Define, Describe, Monitor,
Promote, Example, Evaluate
Software Asset Management
Define, Promote, Justify,
Evaluate, Report, Verify
Software Licensing
Define, Example, Promote,
Monitor, Evaluate
Standalone Systems And Remote
Terminals
Define, Support, Integrate,
Evaluate
(Suggest This Item Be Broken
Into Two Items)
Standards Of Conduct
Describe, Support, Exemplify,
Report, Follows-Up
Storage Area Controls
Define, Develop, Evaluate,
Example, Support, Verify,
Plan, Report, Follows-Up
Storage Media Protection And
Control
Define, Develop, Evaluate,
Example, Support, Verify,
Plan, Report, Follows-Up
Transportation Of Media
Define, Describe, Compare,
Evaluate, Plan, Justify
Warranties
Define, Describe, Evaluate,
Monitor, Verify
Wide Area Network Security
Define, Describe, Integrate, Plan,
Promote, Evaluate, Perform,
Support
Witness Interviewing/Interrogation
Define, Describe, Perform,
Evaluate, Support
Workstation Security
Define, Describe, Promote, Plan,
Report, Verify, Perform
Zone Of Control/Zoning
Define, Recommends, Justify,
Report, Describe, Evaluate






Designing & Engineering AIS To Be Secure

From the Unified Taxonomy Model, Designing And Engineering Information Systems To Be Secure
represents one of the areas where individuals are expected to know details about the specific items
and perform specific tasks. Designing And Engineering Information Systems To Be Secure requires
process knowledge involving tasks up to deployment of an operational system. There are several
parallel processes (e.g., risk management, life cycle management, certification) that are used to build
and deploy information systems with appropriate security. These processes use much of the encyclo-
pedic knowledge in this framework. The knowledge and performance areas are reported here with the
appropriate verbs that should be used to develop the behavioral objectives and instruction.


Access Control Models
Create, Compare, Evaluate, Test
Access Control Policies
Apply, Interpret
Access Control Software
Select, Propose, Use, Evaluate,
Test
Access Controls
Apply, Use, Evaluate
Acquisitions
Questions, Support
Agency-Specific Security Policies
Interpret, Apply
Application Development Control
Define, Design, Evaluate, Modify,
Propose, Test
Applications Security
Apply, Define, Design, Evaluate,
Use, Verify
Assurance
Define, Evaluate, Explain, Verify,
Builds-In
Audit Trails And Logging Policies
Complies-With, Interpret
Authentication
Builds-In
Cabling
Select, Evaluate, Propose, Use
Call-Back Security
Apply
Certification
Defend, Design, Evaluate,
Explain, Influence, Perform
Client/Server Security
Design, Evaluate, Influence,
Solve, Apply, Use
Common Carrier Security
Evaluate, Identify, Questions, Use
COMSEC Testing
Define, Describe, Evaluate,
Influence, Perform, Report,
Verify
Confidentiality
Apply, Builds-In, Support
Configuration Management
Influence, Complies-With
Conformance Testing
Design, Describe, Evaluate,
Influence, Initiate, Perform,
Report, Verify
Cost/Benefit Analysis
Influence, Support
Countermeasures
Builds-In, Combine, Compare,
Design, Evaluate, Influence,
Integrate, Modify
Cover And Deception
Apply
Cryptographic Techniques
Apply, Design, Explain, Use,
Verify
Cryptography
Apply, Design, Describe,
Influence, Justify, Plan,
Study, Use
Cryptovariable
Use
Dedicated Line
Integrate, Justify, Propose, Use
Dedicated Mode
Propose, Select
Denial Of Service
Solves
Detective Controls
Builds-In, Design, Evaluate,
Propose, Use, Verify
Development (Life Cycle)
Apply, Complies- With, Evaluate,
Integrate
Discretionary Access Control
Apply, Builds-In, Design,
Propose, Use
Distributed Systems Security
Design, Evaluate, Influence,
Solve, Apply, Use
Documentation
Create, Produce, Modify
Electromagnetic Countermeasures
Builds-In, Design, Evaluate,
Identify, Initiate, Integrate,
Select, Verify
Electromagnetic Interference
Address, Evaluate, Study
Electronic Data Interchange
Design, Evaluate, Integrate, Use
Electronic Key Management System
Design, Evaluate, Integrate,
Select, Use, Verify
Electronic-Mail Security
Apply, Design, Evaluate,
Influence, Solve, Use
Emanations Security
Apply, Design, Evaluate,
Influence, Solve, Use
Encryption Modes
Apply, Use
Evaluated Products
Compare, Evaluate, Influence,
Integrate, Select, Test, Use
Evaluation Techniques
Apply, Design, Evaluate, Identify,
Select, Use, Verify
Expert Security/Audit Tools
Apply, Create, Design, Evaluate,
Select, Use, Verify
Expert Systems
Apply, Builds, Evaluate, Select,
Use
Fault Tolerance
Builds-In, Design, Evaluate,
Select, Use, Verify
Fax Security
Apply, Design, Evaluate,
Influence, Solve, Use
Firmware Security
Apply, Builds-In, Create, Design,
Evaluate, Influence, Select,
Use
Formal Methods For Security
Design
Apply, Evaluate, Use, Verify
Identification & Authentication
Address, Builds-In, Evaluate,
Test, Verify
Inference
Address, Evaluate, Test, Verify
Inference Engine
Apply, Evaluate, Use, Verify
Information Availability
Address, Builds-In, Evaluate,
Verify
Information Confidentiality
Address, Builds-In, Evaluate,
Verify
Information Integrity
Address, Builds-In, Evaluate,
Verify
Information State
Apply, Define, Evaluate, Identify,
Use, Verify
Integrity
Apply, Builds-In, Evaluate, Test,
Verify
Intrusion Detection
Apply, Builds-In, Design,
Evaluate, Select, Study,
Verify
Intrusion Deterrents
Apply, Builds-In, Compare,
Design, Devise, Evaluate,
Identify, Propose, Select, Use,
Verify
Isolation And Mediation
Apply, Builds-In, Create,
Evaluate, Propose, Study,
Use, Verify
Jamming
Address, Evaluate, Identify,
Verify
Kernel
Builds-In, Design, Evaluate,
Integrate, Modify, Propose,
Use, Verify
Lattice Model
Apply, Builds-In, Constructs,
Evaluate, Interpret, Modify,
Propose, Test, Verify
Least Privilege
Apply, Builds-In, Complies-With,
Evaluate, Test, Use, Verify
Line Authentication
Apply, Builds-In, Evaluate,
Support, Use, Verify
Line Of Sight
Apply, Evaluate, Use, Verify
Local Area Network Security
Address, Builds-In, Design,
Evaluate, Integrate, Support,
Test, Verify
Mandatory Access Control
Apply, Builds-In, Complies-With,
Design, Evaluate, Propose,
Support, Test, Use, Verify
Media Convergence
Addresses
Memory (Non-Volatile)
Apply, Use
Memory (Random)
Apply, Use
Memory (Sequential)
Apply, Use
Memory (Volatile)
Apply, Use
Message Authentication Codes
Apply, Builds-In, Evaluate,
Propose, Test, Use, Verify
Microwave/Wireless
Communications Security
Design, Evaluate, Integrate,
Propose, Test, Use, Verify
Mobile Workstation Security
Address, Apply, Design,
Evaluate, Propose, Test, Use,
Verify
Monitoring
Address, Apply, Builds-In,
Design, Evaluate, Propose,
Test, Use, Verify
Multilevel Processing
Address, Design, Evaluate, Test,
Verify
Multilevel Security
Address, Design, Evaluate, Test,
Verify
Network Communications Protocols
Apply, Builds-In, Complies-With,
Integrate, Interpret, Select,
Use
Network Firewalls
Apply, Builds-In, Design,
Evaluate, Influence,
Integrate, Propose, Select,
Test, Use, Verify
Network Monitoring
Address, Apply, Builds-In,
Design, Evaluate, Influence,
Propose, Select, Use, Verify
Network Security
Address, Apply, Builds-In,
Design, Evaluate, Propose,
Select, Use, Verify
Network Security Software
Apply, Alters, Builds-In, Design,
Evaluate, Integrate, Modify,
Propose, Select, Test, Use,
Verify
Non-Repudiation
Address, Apply, Builds-In,
Design, Evaluate, Integrate,
Propose, Support, Test, Use,
Verify
Non-Inference Model
Apply, Evaluate, Use, Verify
Object Labeling
Apply, Builds-In, Design,
Evaluate, Integrate, Support,
Test, Use, Verify
Object Reuse
Address, Controls, Evaluate, Test,
Verify
One-Time Passwords
Address, Apply, Builds-In,
Evaluate, Influence,
Integrate, Propose, Test, Use,
Verify
Open Systems Interconnect (OSI)
Model
Apply, Evaluate, Integrate,
Propose, Test, Use, Verify
Open Systems Security
Address, Apply, Design,
Evaluate, Influence,
Integrate, Propose, Test, Use,
Verify
Operating System Integrity
Apply, Builds-In, Evaluate, Test,
Use, Verify
Operating System Security Features
Apply, Evaluate, Integrate, Test,
Use, Verify
Operating Systems
Evaluate, Propose, Test, Use
Optical/Imaging Systems Security
Apply, Builds-In, Design,
Evaluate, Influence,
Integrate, Propose, Test, Use,
Verify
Packet Filtering
Apply, Design, Evaluate,
Integrate, Propose, Support,
Test, Verify
Peer-To-Peer Security
Address, Apply, Builds-In,
Design, Evaluate, Influence,
Integrate, Select, Test, Verify
Penetration Testing
Apply, Design, Propose, Support,
Verify
Platform-Specific Security
Apply, Design, Evaluate,
Influence, Integrate, Support,
Test, Use, Verify
Power Controls (Ups. Emergency
Power)
Propose, Test, Use
Preventive Controls
Address, Apply, Builds-In,
Design, Evaluate, Influence,
Propose, Select, Test, Verify
Private Key Cryptology
Apply, Evaluate, Propose, Select,
Test, Use, Verify
Privileges (Class. Nodes)
Apply, Integrate, Propose, Test,
Verify
Protected Distributed System
Address, Apply, Design,
Evaluate, Integrate, Test,
Verify
Protection From Malicious Code
Address, Apply, Builds-In,
Design, Evaluate, Influence,
Integrate, Propose, Select,
Test, Verify
Public Key Encryption
Apply, Builds-In, Evaluate,
Propose, Select, Test, Verify
Quality Assurance
Apply, Influence, Support
Rainbow Series
Apply, Complies-With
Redundancy
Apply, Builds-In, Design,
Evaluate, Propose, Support,
Test, Use, Verify
Reference Monitor
Apply, Build-In, Evaluate,
Integrate, Test, Use, Verify
Remote Terminal Protection
Devices
Design, Evaluate, Integrate,
Propose, Select, Test, Use,
Verify
Risks
Address, Control, Evaluate,
Identify
Role-Based Access Controls
Apply, Build-In, Design,
Evaluate, Support, Test, Use,
Verify
Rules-Based Access Control
Apply, Build-In, Design,
Evaluate, Support, Test, Use,
Verify
Safeguards
Apply, Build-In, Design,
Evaluate, Influence, Propose,
Select, Support, Test, Use,
Verify
Safety
Address, Apply, Build-In, Design,
Evaluate, Propose, Support,
Test, Verify
Satellite Communications Security
Address, Apply, Design,
Evaluate, Influence,
Integrate, Propose, Test, Use,
Verify
Secure System Operations
Apply, Influence, Support, Test,
Verify
Security Architecture
Apply, Comply-With, Design,
Evaluate, Influence, Propose,
Select, Support
Security Awareness
Cognizant-Of, Influence, Initiate,
Propose, Support
Security Domains
Address, Apply, Design,
Influence, Test, Use, Verify
Security Education
Cognizant-Of, Influence, Propose,
Support, Use
Security Product Integration
Apply, Design, Evaluate,
Influence, Propose, Test, Use,
Verify
Security Product Testing/Evaluation
Design, Influence, Perform,
Report, Verify
Security Training
Cognizant-Of, Influence, Propose,
Support, Use
Shielded Enclosures
Cognizant-Of, Influence, Propose
Single Sign-On
Address, Apply, Design,
Evaluate, Influence, Propose,
Support, Test, Use, Verify
Smartcards/Token Authentication
Apply, Build-In, Design,
Evaluate, Integrate, Propose,
Select, Support, Test, Use,
Verify
Software Engineering
Apply, Integrate, Propose, Use
Software Security
Apply, Build-In, Design,
Evaluate, Influence, Propose,
Select, Test, Use, Verify
Space Systems Security
Apply, Cognizant-Of, Use
Spread Spectrum Analysis
Apply, Integrate, Propose, Use
System Software Controls
Apply, Build-In, Evaluate,
Influence, Propose, Test, Use,
Verify
System Testing And Evaluation
Process
Apply, Comply-With, Initiate,
Propose, Use, Verify
System-High Mode
Address, Cognizant-Of, Propose,
Use
Systems Security Engineering
Apply, Comply-With, Use
TCSEC/ITSEC/Common Criteria
Cognizant-Of, Integrate, Use
Technological Threats
Cognizant-Of, Control, Evaluate
Technology Trends
Cognizant-Of, Evaluate
Tempest
Apply, Cognizant-Of, Comply-
With, Propose, Use
Third-Party Evaluation
Apply, Perform, Propose, Select,
Support, Use, Verify
Threat
Cognizant-Of, Control, Evaluate
Trust
Apply, Cognizant-Of, Evaluate,
Identify, Influence
Trusted Comp Sys Eval.
Criteria(Orange Bo
Apply, Cognizant-Of, Comply-
With, Propose, Use
Trusted Network Interpretation
(Red Book
Apply, Cognizant-Of, Comply-
With, Propose, Use
Validation (Testing)
Apply, Design, Integrate,
Perform, Propose, Report,
Verify
Verification And Validation Process
Apply, Cognizant-Of, Design,
Influence, Perform, Plan,
Propose, Report, Select,
Verify
Voice Communications Security
Apply, Evaluate, Integrate,
Propose, Test, Use, Verify
Voice Mail Security
Apply, Evaluate, Integrate,
Propose, Test, Use, Verify
Wide Area Network Security
Address, Apply, Builds-In,
Design, Evaluate, Propose,
Select, Use, Verify
Workstation Security
Apply, Design, Evaluate,
Influence, Propose, Select,
Use, Verify
Zone Of Control/Zoning
Cognizant-Of, Comply-With,
Propose, Use







Using and Operating AIS Securely

From the Unified Taxonomy Model, Using and Operating Information Systems Securely represents
one of the areas where individuals are expected to know details about the specific items and perform
specific tasks. The Using and Operating Information Systems Securely category contains knowledge
that addresses activities used in an operational environment to ensure that information systems are
operated and used securely. These activities also use much of the encyclopedic knowledge. The
knowledge and performance areas are reported here with the appropriate verbs that should be used to
develop the behavioral objectives and instruction.


Access Authorization
Change, Verify, Generates
Access Control Policies
Defend, Explain, Revise, Write,
Evaluate, Use
Access Control Software
Evaluate, Identify, Propose,
Select, Use
Access Controls
Evaluate, Identify, Propose,
Select, Use
Access Privileges
Describe, Design, Evaluate,
Modify, Use
Account Administration
Cognizant-Of, Use
Accountability
Support, Verify
Accountability For Sensitive Data
Defend, Define, Describe,
Evaluate, Verify
Administrative Security
Apply, Follows, Initiate, Interpret
Administrative Security Policies
And Procedures
Apply, Follows, Influence,
Propose,
Agency-Specific Security Policies
Apply, Follows, Influence,
Propose
Aggregation
Define, Discuss, Evaluate,
Identify, Points Out,
Questions, Solves
Alarms. Signals And Report
Evaluate, Propose, Select, Use
Applications Security
Defend, Define, Evaluate, Use
Assessments (E.G.. Surveys.
Inspections)
Assist, Evaluate, Initiate,
Interpret, Perform
Audit
Assist, Evaluate, Influence,
Interpret, Reads, Reply,
Support
Audit Trails And Logging
Defend, Define, Interpret, Reads,
Use
Audit Trails And Logging Policies
Defend, Define, Evaluate,
Interpret, Justify, Modify,
Use, Write
Auditing Tools
Evaluate, Identify, Propose,
Select, Use
Authentication
Cognizant-Of, Use
Automated Security Tools
Evaluate, Identify, Propose,
Select, Use
Backups(Data. Software. Etc.)
Influence, Initiate, Justify,
Perform, Propose, Verify
Biometrics
Justify, Select, Use
Cabling
Evaluate, Identify, Influence,
Propose, Select, Use
Call-Back Security
Justify, Propose, Select, Use
Caller Id
Justify, Propose, Use
Change Control Policies
Apply, Use
Change Controls
Apply, Use
Classified Materials(Eg. Handling
And Sh
Identify, Labels, Report, Use
Client/Server Security
Apply, Propose, Select, Use
Common Carrier Security
Cognizant -Of, Use
Communications Center Security
Cognizant-Of, Influence, Use
Computer Abuse
Corrects, Define, Evaluate,
Identify, Report, Verify
Computer Emergency Response
Team(CERT)
Describe, Identify, Points To, Use
COMSEC Accounting
Cognizant-Of
COMSEC Custodian
Identify, Support
COMSEC Material Destruction
Procedures
Cognizant-Of, Use
COMSEC Material Identification &
Invent
Assist, Comply, Support
Confidentiality
Define, Influence, Promote,
Verify
Consequences
Define, Identify, Illustrate
Contingency Plan Testing
Describe, Design, Evaluate,
Perform
Contingency Planning
Describe, Design, Evaluate,
Influence, Interpret, Perform,
Use, Verify
Continuity Planning
Describe, Design, Evaluate,
Influence, Interpret, Perform,
Use, Verify
Contracting For Security Services
Assist, Discuss, Evaluate,
Influence, Justify, Propose,
Reviews
Coordination With Related
Disciplines
Builds, Defend, Demonstrate,
Discuss, Evaluate, Identify,
Influence, Invite, Justify,
Propose, Select, Use
Copyright Protection And Licensing
Adhere, Follows, Support, Use
Corrective Actions
Assist, Defend, Discuss,
Influence, Initiate, Propose,
Recommends, Report
Countermeasures
Combine, Compare, Create,
Defend, Define, Describe,
Evaluate, Identify, Influence,
Initiate, Integrate, Justify,
Modify, Practice, Present,
Propose, Use, Verify
Criminal Prosecution
Defend, Influence, Propose,
Support
Critical Systems
Describe, Propose, Select,
Support, Use
Customer Service Orientation
Answers, Assist, Helps, Influence,
Listens, Support, Shows,
Tells
Data Access Control
Defend, Define, Design, Explain,
Identify, Initiate, Interpret,
Justify, Modify, Support, Use,
Verify
Data Processing Center Security
Cognizant-Of, Influence, Use
Database Integrity
, Define, Describe, Design,
Explain, Identify, Initiate,
Integrate, Justify, Support,
Use, Verify
Dedicated Mode
Apply, Defend, Describe, Initiate,
Propose, Select, Use, Verify
Delegation Of Authority
Cognizant-Of
Denial Of Service
Corrects, Discovers, Solves
Detective Controls
Describe, Use, Verify
Dial Number Indicator
Cognizant-Of, Propose, Use
Dial-Up Security
Cognizant-Of, Define, Justify,
Operate, Propose, Select,
Support, Use, Verify
Disaster Recovery
Comply, Conforms, Use
Disaster Recovery Plan Testing
Describe, Design, Evaluate,
Perform, Plan, Propose,
Verify
Disaster Recovery Planning
Assist, Defend, Design, Evaluate,
Rewrite, Support, Use, Write
Disclosure Of Sensitive Data
Discovers, Evaluate, Points Out
Discretionary Access Control
Defend, Define, Design, Evaluate,
Initiate, Modify, Propose,
Use, Verify
Disgruntled Employees
Controls, Hammers, Identify,
Points To, Questions
Diskless Workstations
Cognizant-Of, Use
Disposition Of Classified
Information
Comply, Perform, Verify
Disposition Of Media & Data
Comply, Perform, Verify
Distributed Systems Security
Apply, Define, Describe,
Evaluate, Integrate, Justify,
Operate, Propose, Use, Verify
Document Labeling
Complies-With, Perform, Use,
Verify
Documentation
Describe, Modify, Use, Write
Drop-Off/Add-On Protection(Piggy
Backing
Cognizant-Of, Propose, Use
Due Care
Complies-With, Evaluate,
Initiate, Integrate, Interpret,
Justify, Use, Verify
Education. Training And Awareness
Cognizant-Of, Defend, Define,
Give, Identify, Initiate,
Integrate, Justify, Perform,
Propose, Select, Shows,
Support, Use, Verify
Electromagnetic Countermeasures
Apply, Cognizant-Of, Integrate,
Select, Use, Verify
Electromagnetic Interference
Cognizant-Of, Corrects
Electronic Data Interchange
Complies-With, Explain, Justify,
Use, Verify
Electronic Funds Transfer
Complies-With, Initiate, Report,
Use
Electronic Key Management System
Apply, Integrate, Support, Use
Electronic Monitoring
Apply, Defend, Define, Discovers,
Evaluate, Identify, Initiate,
Integrate, Justify, Perform,
Plan, Practice, Report, Use,
Verify
Electronic Records Management
Complies-With, Evaluate,
Initiate, Integrate, Perform,
Report, Use, Verify
Electronic-Mail Privacy
Complies-With, Defend,
Evaluate, Justify, Use, Verify
Electronic-Mail Security
Complies-With, Defend, Define,
Evaluate, Influence, Initiate,
Integrate, Select, Use, Verify
Emanations Security
Apply, Use
Emergency Destruction
Complies-With, Initiate, Justify,
Plan, Report, Use, Verify
Emergency Destruction Procedures
Complies-With, Defend, Initiate,
Justify, Modify, Perform,
Report, Use, Verify, Write
Encryption Modes
Cognizant-Of, Propose, Use
End User Computing Security
Corrects, Define, Describe,
Evaluate, Identify, Influence,
Initiate, Justify, Modify,
Perform, Plan, Practice,
Present, Propose, Questions,
Support, Use, Verify, Write
Entrapment
Cognizant-Of, Describe,
Evaluate, Verify
Environmental Controls
Apply, Design, Identify, Initiate,
Integrate, Justify, Use
Environmental/Natural Threats
Cognizant-Of
Error Logs
Assemble, Design, Evaluate,
Interpret, Reads, Use
Ethics
Apply, Complies-With, Defend
Evidence Acceptability
Cognizant-Of
Evidence Collection And
Preservation
Assist, Complies-With, Support
Expert Security/Audit Tools
Apply, Influence, Propose, Use
Expert Systems
Cognizant-Of, Propose, Select,
Use
Facility Management
Assist, Cognizant-Of, Influence,
Practice, Support
Fax Security
Apply, Propose, Select, Use
Filtered Power
Cognizant-Of, Propose, Use
Fire Prevention And Protection
Apply, Cognizant-Of, Use
Fraud
Cognizant-Of, Corrects, Describe,
Evaluate, Prevents, Verify
Fraud. Waste And Abuse
Corrects, Define, Evaluate,
Prevents
Frequency Hopping
Apply, Cognizant-Of, Propose,
Use
Generally Accepted Systems
Security Principles
Cognizant-Of, Complies-With,
Describe, Identify, Influence,
Interpret, Use
Grounding
Apply, Cognizant-Of, Use
Hackers And Unauthorized Users
Control, Discover, Dismantle,
Hammer, Identify, Prevent
Hardware Asset Management
Apply, Influence, Initiate,
Perform, Support
Housekeeping Procedures
Apply, Cognizant-Of, Perform,
Support, Use
Human Intelligence (Humint)
Cognizant-Of, Use
Human Threats
Cognizant-Of, Controls, Prevents
Identification & Authentication
Apply, Cognizant-Of, Use
Incident Response
Evaluate, Initiate, Perform,
Report, Use
Industrial Espionage
Cognizant-Of, Controls, Describe,
Prevents, Report
Information Availability
Define, Influence, Promote,
Verify
Information Categorization
Define, Differentiate, Identify,
Interpret, Labels, Propose,
Revise, Use
Information Classification
Apply, Define, Differentiate,
Identify, Labels, Use
Information Confidentiality
Define, Influence, Promote,
Support, Verify
Information Criticality
Information Integrity
Define, Influence, Promote,
Support, Verify
Information Ownership
Define, Identify, Labels, Name,
Verify
Information Resource
Owner/Custodian
Define, Identify, Labels, Name,
Verify
Information Sensitivity
Apply, Define, Differentiate,
Identify, Labels, Use
Information State
Apply, Cognizant-Of, Use
Information Systems Security
Officer
Acts, Assist, Defend, Identify,
Influence, Listens, Locate,
Support
Information Valuation
Apply, Cognizant-Of, Propose,
Support, Use
Integrity
Define, Influence, Promote,
Support, Verify
Internal Controls And Security
Apply, Cognizant-Of, Influence,
Propose, Select, Use
INTERNET Security
Questions, Use
Intrusion Detection
Apply, Cognizant-Of, Propose,
Use
Intrusion Deterrents
Apply, Cognizant-Of, Propose,
Use, Verify
Investigation Of Security Breaches
Propose, Recommend, Support
Investigative Authorities
Assist, Cognizant-Of, Identify,
Select, Support
Is/It Asset Valuation
Apply, Influence, Initiate,
Perform, Support
Key Management
Apply, Integrate, Support, Use
Keystroke Monitoring
Apply, Cognizant-Of, Evaluate,
Propose, Use, Verify
Labeling
Apply, Cognizant-Of, Use
Law Enforcement Interfaces
Assist, Propose, Support, Use
Least Privilege
Apply, Propose, Select, Use,
Verify
List-Based Access Controls
Apply, Propose, Select, Use,
Verify
Local Area Network Security
Apply, Follows, Initiate, Propose,
Support
Logs And Journals
Complies-With, Propose, Use
Low Power
Apply, Propose, Use
Magnetic Remanance
Apply, Cognizant-Of, Controls
Malicious Code
Cognizant-Of, Controls, Describe,
Report
Mandatory Access Control
Apply, Follows, Initiate, Support,
Use, Verify
Marking Of Media
Apply, Follows, Initiate, Support,
Use
Marking Of Sensitive Information
Apply, Follows Initiate, Support,
Use, Verify
Media Convergence
Explain, Synthesizes
Message Authentication Codes
Comply, Initiate, Use, Verify
Metrics
Apply, Select, Use
Mobile Workstation Security
Apply, Propose, Select, Use
Modes Of Operation
Cognizant-Of, Propose, Use
Monitoring
Apply, Cognizant-Of, Evaluate,
Propose, Use, Verify
Multilevel Processing
Cognizant-Of, Propose, Use
Multilevel Security
Apply, Cognizant-Of, Propose,
Use
Need-To-Know Controls
Apply, Initiate, Practice, Support,
Use, Verify
Network Firewalls
Cognizant-Of, Propose, Use
Network Monitoring
Apply, Cognizant-Of, Evaluate,
Propose, Use, Verify
Network Security
Apply, Propose, Select, Use
Network Security Software
Apply, Initiate, Propose, Select,
Use, Verify
Non-Repudiation
Apply, Cognizant-Of, Propose,
Use, Verify
Object Labeling
Apply, Follows Initiate, Support,
Use, Verify
Off-Site Security (Information,
Processing)
Define, Defend, Evaluate,
Influence, Justify, Perform,
Plan, Support, Use
One-Time Passwords
Apply, Initiate, Propose, Select,
Use, Verify
Operating System Integrity
Define, Influence, Promote,
Support, Verify
Operations Security
Apply, Follows, Propose, Select,
Support, Use
Optical/Imaging Systems Security
Apply, Describe, Defend,
Evaluate, Influence, Initiate,
Propose, Select, Use
Password Management
Apply, Defend, Define, Influence,
Propose, Support, Use, Verify
Penetration Testing
Cognizant-Of
Physical Security
Apply, Follows, Influence,
Propose, Select, Support, Use
Platform-Specific Security
Apply, Follows, Influence,
Initiate, Propose, Perform,
Select, Support, Use, Verify
Policy Enforcement
Defend, Evaluate, Influence,
Initiate, Propose, Select,
Support, Use, Verify
Power Controls (Ups. Emergency
Power)
Apply, Initiate, Propose, Use
Practices
Apply, Evaluate, Follows,
Propose, Select, Support, Use
Preventive Controls
Apply, Describe, Evaluate,
Identify, Influence, Initiate,
Integrate, Justify, Use
Privacy
Apply, Evaluate, Follows,
Propose, Select, Support, Use
Privileges (Class. Nodes)
Apply, Identify, Labels, Propose,
Initiate, Support, Use, Verify
Procedures
Apply, Evaluate, Follows,
Propose, Select, Support, Use
Professional Interfaces
Builds, Defend, Demonstrate,
Discuss, Evaluate, Identify,
Influence, Invite, Justify,
Propose, Select, Use
Protection From Malicious Code
Controls, Describe, Defend,
Evaluate, Influence, Initiate,
Perform, Plan, Select, Use,
Verify
Quality Assurance
Apple, Describe, Influence,
Support, Verify
Remanance
Apply, Cognizant-Of, Controls
Remote Terminal Protection
Devices
Apply, Describe, Defend,
Evaluate, Influence, Initiate,
Propose, Select, Use
Risks
Define, Defend, Evaluate, Identify
Role-Based Access Controls
Apply, Describe, Evaluate,
Identify, Influence, Initiate,
Integrate, Justify, Use
Roles And Responsibilities
Apply, Describe, Defend,
Evaluate, Influence, Initiate,
Propose, Select, Use
Rules-Based Access Control
Apply, Describe, Evaluate,
Identify, Influence, Initiate,
Integrate, Justify, Use
Safeguards
Apply, Describe, Defend,
Evaluate, Influence, Initiate,
Propose, Select, Use
Safety
Apply, Describe, Defend,
Evaluate, Influence, Initiate,
Propose, Select, Support, Use
Satellite Communications Security
Apply, Describe, Influence,
Propose, Support, Use
Secure System Operations
Define, Describe, Evaluate,
Influence, Justify, Perform,
Propose, Support, Use, Verify
Security Architecture
Cognizant-Of, Use
Security Awareness
Apply, Defend, Describe, Design,
Explain, Influence, Initiate,
Perform, Propose, Support,
Use, Plan, Practices
Security Education
Apply, Defend, Describe,
Influence, Initiate, Propose,
Support, Use
Security Product Integration
Apply, Define, Describe,
Evaluate, Influence, Justify,
Perform, Propose, Support,
Use, Verify
Security Training
Apply, Defend, Describe,
Influence, Initiate, Propose,
Support, Use
Security Violations Reporting
Process
Defend, Define, Describe, Design,
Evaluate, Identify, Influence,
Initiate, Justify, Perform,
Plan, Use, Verify
Sensitive System
Define, Describe, Evaluate,
Identify, Influence, Propose,
Select, Support, Use
Separation Of Duties
Defend, Define, Describe, Design,
Evaluate, Identify, Influence,
Initiate, Justify, Perform,
Plan, Use, Verify
Single Sign-On
Apply, Initiate, Propose, Select,
Use, Verify
Smartcards/Token Authentication
Apply, Propose, Initiate, Select,
Support, Use, Verify
Social Engineering
Cognizant-Of, Controls, Describe,
Report
Software Asset Management
Apply, Defend, Define, Influence,
Propose, Support, Use, Verify
Software Piracy
Controls, Describe, Defend,
Evaluate, Influence, Initiate,
Perform, Plan, Select, Use,
Verify
Software Security
Apply, Follows, Influence,
Initiate, Propose, Perform,
Select, Support, Use, Verify
Spoofing
Controls, Describe, Evaluate,
Verify
Storage Area Controls
Apply, Describe, Evaluate,
Identify, Influence, Initiate,
Integrate, Justify, Use
Storage Media Protection And
Control
Apply, Describe, Evaluate,
Identify, Influence, Initiate,
Integrate, Justify, Use, Verify
System-High Mode
Apply, Initiate, Propose, Justify,
Support, Use, Verify
Technical Surveillance
Countermeasures
Apply, Cognizant-Of, Define,
Defend, Evaluate, Influence,
Propose, Use, Verify
Technological Threats
Define, Discovers, Evaluate,
Identify, Lists, Report, Study,
Verify
Tempest
Apply, Use
Threat
Define, Discovers, Evaluate,
Identify, Lists, Report, Study,
Verify
Traffic Analysis
Apply, Initiate, Propose, Support,
Use, Verify
Transportation Of Media
Controls, Perform
Unauthorized Disclosure Of
Information
Define, Controls, Describe,
Evaluate, Report
Voice Communications Security
Apply, Follows, Propose, Select,
Support, Use, Verify
Voice Mail Security
Apply, Follows, Propose, Select,
Support, Use, Verify
Vulnerability Analysis
Assist, Evaluate, Initiate,
Interpret, Perform, Use,
Verify
Warranties
Cognizant-Of, Reads, Use
Wide Area Network Security
Apply, Follows, Propose, Select,
Support, Use, Verify
Witness Interviewing/Interrogation
Initiate, Perform, Support,
Report, Use
Workstation Security
Apply, Follows, Propose, Select,
Support, Use, Verify
Zone Of Control/Zoning
Apply, Use, Verify






The OUNKNOWN GODO
In both DACUM II and DACUM III the OOtherO category was often referred to as the unknown
god .

In this case it represents items which the group agreed belonged in the Unified taxonomy document;
however, they could not decide where they actually belonged.

Several others have been proposed and may be added in the future.

Electronic Funds Transfer
Adhere, Choose, Comply, Conclude, Conforms, Connects, Define, Describe, Evaluate, Explain, Initiate, Integrate,
Interpret, Justify, Plan, Points Out, Points To, Produce, Rearrange, Report, Separate, Support, Use, Verify
Peer-To-Peer Security
Contrasts, Categorize, Design, Discuss, Evaluate, Influence, Justify, Operate, Select, Write, Cleans
Reconciliation
Describe, Discuss, Support, Conforms, Connects, Identify
Social Engineering
Acts, Answers, Asks, Compare, Conclude, Define, Differentiate, Discuss, Generalize, Identify, Illustrate, Interpret,
Questions, Report, Verify, Write
Standalone Systems And Remote Terminals
Appraise, Assist, Compare, Define, Evaluate, Propose, Questions
Contractor Security Standards
Define, Describe, Design, Evaluate, Explain, Sets, State, Support, Write



The Maslow Hierarchy Verbs

In order to establish the characteristics of the information systems profession, the participants were
asked to ascribe verbs to each of the activities established in the CBK.  The participants did not know
the verb categories in advance.  This allowed us to break down the common body of knowledge into
each of the three domains and their respective sub categories.

Folder List
Affective Domain
Receiving
    Example: The student will be able to ask proper questions, use systems, and follow direction ...
Responding
    Example: The student will demonstrate an interest and commitment to the profession ...
Valuing
    Example: The student will be demonstrate a continuing desire to learn by reading and self development...
Organization
    Example: The student will demonstrate the ability to adhere to, synthesize, organize, alter and compare sys-
tems ...
Value Complex
    Example: The student will be able to lead discussions, freely express opinions, and form abstract relation-
ships ...
Cognitive Domain
Knowledge
    Example: The student will be able to define the terms ...
Comprehension
    Example: The student will be able to give his/her own examples of ...
Application
    Example: Given appropriate data, the student will be able to solve a problem ...
Analysis
    Example: The student will be able to detect discrepancies between two representative systems ...
Synthesis
    Example: The student will be able to create a hypothetical security system ...
Evaluation
    Example: The student will be able to evaluate objectively two working systems ...
Psychomotor Domain



The verb list may be used to aid in the development of behavioral objectives and instructional mate-
rials.

For example, selecting receiving from within the affective domain, one might state that the student
shall be able to form appropriate questions about {Access Control Policies; Access Control Software;
Access Controls; Access Privileges; Account Administration; Accountability for Sensitive Data;
Administrative Security; Administrative Security Policies and Procedures}. One would then be able to
discuss how to aid the student in these areas.


This report lists all ideas for each Maslow category.



Affective Domain


Receiving

Access Control Policies
Access Control Software
Access Controls
Access Privileges
Account Administration
Accountability for Sensitive Data
Administrative Security
Administrative Security Policies and
Procedures
Agency-Specific Security Policies
Aggregation
Alarms. Signals and Report
Applications Security
Audit
Audit Trails and Logging
Audit Trails and Logging Policies
Auditing Tools
Authentication
Automated Security Tools
Background Investigations
Basic/Generic Management Issues
Biometrics
Business Aspects of Information
Security
Cabling
Call-Back Security
Caller ID
Change Control Policies
Change Controls
Classified Materials(e.g.. Handling
and Sh
Client/Server Security
Common Carrier Security
Communications Center Security
Communications Security Policies and
Guidelines
Computer Abuse
Computer Emergency Response
Team(CERT)
Computer Matching Responsibilities
COMSEC Accounting
COMSEC Custodian
COMSEC Material Destruction
Procedures
COMSEC Material Identification &
Inventory
COMSEC Testing
Configuration Management
Conformance Testing
Consequences
Contingency Plan Testing
Contingency Planning
Continuity Planning
Contracting for Security Services
Contracts, Agreements & Other
Obligations
Coordination with Related Disciplines
Copyright Protection and Licensing
Corrective Actions
Cost/Benefit Analysis
Countermeasures
Criminal Prosecution
Critical Systems
Cryptographic Techniques
Cryptography
Cryptovariable
Customer IT Security Needs
Customer Service Orientation
Data Access Control
Data Processing Center Security
Dedicated Line
Dedicated Mode
Delegation of Authority
Detective Controls
Development (Life Cycle)
Dial Number Indicator
Dial-up Security
Disaster Recovery
Disaster Recovery Plan Testing
Disaster Recovery Planning
Discretionary Access Control
Disgruntled Employees
Diskless Workstations
Disposition of Classified Information
Distributed Systems Security
Document Labeling
Documentation
Documentation Policies
Drop-off/Add-on Protection(Piggy
Backing
Due Care
Education. Training and Awareness
Electromagnetic Countermeasures
Electronic Data Interchange
Electronic Funds Transfer
Electronic Key Management System
Electronic Monitoring
Electronic Records Management
Electronic-Mail Privacy
Electronic-Mail Security
Emanations Security
Emergency Destruction
Emergency Destruction Procedures
Encryption Modes
End User Computing Security
Entrapment
Environmental Controls
Error Logs
Ethics
Evaluated Products
Evaluation Techniques
Expert Security/Audit Tools
Expert Systems
Facilities Planning
Fault Tolerance
FAX Security
Filtered Power
Fire Prevention and Protection
Firmware Security
Formal Methods for Security Design
Fraud
Frequency Hopping
Generally Accepted Systems Security
Principles
Grounding
Guidelines
Hackers and Unauthorized users
Housekeeping Procedures
Human Intelligence (HUMINT)
Identification & Authentication
Incident Response
Industrial Espionage
Inference Engine
Information Categorization
Information Classification
Information Ownership
Information Resource
Owner/Custodian
Information Security Policy
Information Sensitivity
Information State
Information Systems Security Officer
Information Valuation
Insurance
Internal Controls and Security
International Security Considerations
INTERNET Security
Intrusion Detection
Intrusion Deterrents
Investigation of Security Breaches
Investigative Authorities
IS/IT Asset Valuation
Isolation and Mediation
Jamming
Kernel
Key Management
Keystroke Monitoring
Labeling
Law Enforcement Interfaces
Leased-line Networks
Least Privilege
Legal and Liability Issues
Lessons Learned
Line Authentication
Line of sight
List-based access controls
Local Area Network Security
Logs and Journals
Low Power
Malicious Code
Management of the Security Function
Mandatory Access Control
Marking of Media
Marking of Sensitive Information
Memory (Non-volatile)
Memory (Random)
Memory (Sequential)
Memory (Volatile)
Message Authentication Codes
Metrics
Microwave/Wireless Communications
Security
Mobile Workstation Security
Modes of Operation
Monitoring
Multilevel Processing
Multilevel Security
Need-to-know Controls
Network communications protocols
Network Firewalls
Network Monitoring
Network Security
Network Security Software
Network Topology
Non-inference Model
Non-repudiation
Object Labeling
Off-site Security (Information,
Processing)
Off-site Security (Information.
Processing)
One-time Passwords
Open Systems Interconnect (OSI)
Model
Open Systems Security
Operating System Integrity
Operating System Security Features
Operating Systems
Operations Security
Optical/Imaging Systems Security
Oversight
Password Management
Peer-to-Peer Security
Personnel Security Policies and
Guidance
Physical Security
Platform-specific Security
Policy Development
Policy Enforcement
Position Sensitivity
Power Controls (UPS. emergency
Power)
Practices
Preventive Controls
Privacy
Private Key Cryptology
Privileges (Class. Nodes)
Procedures
Professional Interfaces
Protection from Malicious Code
Public Key Encryption
Quality Assurance
Reconciliation
Redundancy
Remote Terminal Protection Devices
Risk Acceptance Process
Risk Management
Risks
Role-based Access Controls
Roles and Responsibilities
Rules-based Access Control
Safeguards
Safety
Satellite Communications Security
Secure System Operations
Security Architecture
Security Awareness
Security Education
Security Product Integration
Security Reviews
Security Training
Security Violations Reporting Process
Sensitive System
Separation of Duties
Single Sign-on
Smartcards/Token Authentication
Social Engineering
Software Asset Management
Software Piracy
Software Security
Spoofing
Standards of Conduct
Storage Area Controls
Storage Media Protection and Control
System-high Mode
Technical Surveillance
Countermeasures
Technological Threats
TEMPEST
Threat
Traffic Analysis
Transportation of Media
Unauthorized Disclosure of
Information
Voice Communications Security
Voice Mail Security
Vulnerability Analysis
Warranties
Wide Area Network Security
Witness Interviewing/Interrogation
Workstation Security
Zone of Control/Zoning

Responding

Access Control Policies
Access Control Software
Access Controls
Aggregation
Alarms. Signals and Report
Assessments (e.g.. surveys. inspec-
tions)
Audit
Audit Trails and Logging
Audit Trails and Logging Policies
Auditing Tools
Automated Security Tools
Backups(Data. Software. etc.)
Basic/Generic Management Issues
Biometrics
Cabling
Call-Back Security
Certification
Classified Materials(e.g. Handling and
Shipping)
Classified Materials(e.g.. Handling
and Sh
Client/Server Security
Computer Abuse
Computer Matching Responsibilities
COMSEC Accounting
COMSEC Material Destruction
Procedures
COMSEC Material Identification &
Invent
COMSEC Material Identification &
Inventory
COMSEC Testing
Conformance Testing
Contingency Plan Testing
Contingency Planning
Continuity Planning
Contracting for Security Services
Contracts, Agreements & Other
Obligations
Coordination with Related Disciplines
Copyright Protection and Licensing
Corrective Actions
Cost/Benefit Analysis
Countermeasures
Critical Systems
Customer IT Security Needs
Customer Service Orientation
Data Processing Center Security
Dedicated Mode
Delegation of Authority
Dial-up Security
Disaster Recovery
Disaster Recovery Plan Testing
Disaster Recovery Planning
Disposition of Classified Information
Disposition of Media & Data
Distributed Systems Security
Document Labeling
Documentation
Education. Training and Awareness
Electromagnetic Countermeasures
Electronic Funds Transfer
Electronic Key Management System
Electronic Monitoring
Electronic Records Management
Electronic-Mail Privacy
Electronic-Mail Security
Emergency Destruction
Emergency Destruction Procedures
End User Computing Security
Error Logs
Ethics
Evaluated Products
Evaluation Techniques
Evidence Collection and Preservation
Expert Security/Audit Tools
Expert Systems
Facilities Management
Facilities Planning
Facility Management
Fault Tolerance
FAX Security
Firmware Security
Fraud. Waste and Abuse
Hackers and Unauthorized users
Hardware Asset Management
Housekeeping Procedures
Identification & Authentication
Implementation (Life Cycle)
Incident Response
Industrial Espionage
Info Sys Security Program Budgeting
Info Sys Security Program Planning
Information Categorization
Information Classification
Information Ownership
Information Resource
Owner/Custodian
Information Sensitivity
Information Systems Security Officer
Information Valuation
Insurance
Internal Controls and Security
Intrusion Detection
Intrusion Deterrents
Investigation of Security Breaches
IS/IT Asset Valuation
Keystroke Monitoring
Law Enforcement Interfaces
Least Privilege
Legal and Liability Issues
Lessons Learned
Life Cycle System Security Planning
List-based access controls
Local Area Network Security
Logs and Journals
Malicious Code
Management of the Security Function
Marking of Media
Marking of Sensitive Information
Message Authentication Codes
Metrics
Mobile Workstation Security
Monitoring (e.g.. data. line)
Multilevel Processing
Need-to-know Controls
Network communications protocols
Network Firewalls
Network Monitoring
Network Security
Network Security Software
Network Topology
Off-site Security (Information,
Processing)
Off-site Security (Information.
Processing)
One-time Passwords
Operating System Security Features
Operations Security
Optical/Imaging Systems Security
Organizational Culture
Oversight
Password Management
Peer-to-Peer Security
Personnel Security Policies and
Guidance
Physical Security
Platform-specific Security
Policy Development
Policy Enforcement
Position Sensitivity
Practices
Preventive Controls
Privacy
Private Key Cryptology
Privileges (Class. Nodes)
Procedures
Professional Interfaces
Protection from Malicious Code
Public Key Encryption
Quality Assurance
Reconciliation
Remote Terminal Protection Devices
Risk Acceptance Process
Risk Management
Roles and Responsibilities
Safeguards
Safety
Secure System Operations
Security Awareness
Security Education
Security Product Integration
Security Reviews
Security Staffing Requirements
Security Training
Security Violations Reporting Process
Sensitive System
Separation of Duties
Single Sign-on
Smartcards/Token Authentication
Social Engineering
Software Asset Management
Software Piracy
Software Security
Standalone Systems and Remote
Terminals
Standards of Conduct
Storage Area Controls
Storage Media Protection and Control
Technological Threats
Threat
Transportation of Media
Unauthorized Disclosure of
Information
Voice Communications Security
Voice Mail Security
Vulnerability Analysis
Warranties
Wide Area Network Security
Witness Interviewing/Interrogation
Workstation Security
Zone of Control/Zoning

Valuing

Access Control Policies
Access Control Software
Access Controls
Access Privileges
Accountability for Sensitive Data
Administrative Security
Administrative Security Policies and
Procedures
Agency-Specific Security Policies
Alarms. Signals and Report
Application Development Control
Assessments (e.g.. surveys. inspec-
tions)
Assurance
Audit
Audit Trails and Logging
Audit Trails and Logging Policies
Auditing Tools
Automated Security Tools
Backups(Data. Software. etc.)
Basic/Generic Management Issues
Biometrics
Business Aspects of Information
Security
Cabling
Call-Back Security
Caller ID
Certification
Change Control Policies
Classified Materials(e.g. Handling and
Shipping)
Classified Materials(e.g.. Handling
and Sh
Client/Server Security
Communications Security Policies and
Guidelines
Computer Abuse
Computer Emergency Response
Team(CERT)
Computer Matching Responsibilities
COMSEC Accounting
COMSEC Custodian
COMSEC Material Destruction
Procedures
COMSEC Material Identification &
Inventory
COMSEC Testing
Confidentiality
Configuration Management
Conformance Testing
Contingency Plan Testing
Contingency Planning
Continuity Planning
Contracting for Security Services
Contracts, Agreements & Other
Obligations
Coordination with Related Disciplines
Copyright Protection and Licensing
Corrective Actions
Cost/Benefit Analysis
Countermeasures
Criminal Prosecution
Critical Systems
Cryptographic Techniques
Cryptography
Customer IT Security Needs
Customer Service Orientation
Data Access Control
Data Processing Center Security
Dedicated Line
Dedicated Mode
Delegation of Authority
Detective Controls
Development (Life Cycle)
Dial Number Indicator
Dial-up Security
Disaster Recovery
Disaster Recovery Plan Testing
Disaster Recovery Planning
Discretionary Access Control
Disposition of Classified Information
Disposition of Media & Data
Distributed Systems Security
Documentation
Documentation Policies
Drop-off/Add-on Protection(Piggy
Backing
Due Care
Education. Training and Awareness
Electromagnetic Countermeasures
Electromagnetic Interference
Electronic Data Interchange
Electronic Funds Transfer
Electronic Key Management System
Electronic Monitoring
Electronic Records Management
Electronic-Mail Privacy
Electronic-Mail Security
Emergency Destruction
Emergency Destruction Procedures
Encryption Modes
End User Computing Security
Entrapment
Environmental Controls
Error Logs
Ethics
Evaluated Products
Evaluation Techniques
Expert Security/Audit Tools
Expert Systems
Facilities Planning
Fault Tolerance
FAX Security
Filtered Power
Firmware Security
Fraud
Fraud. Waste and Abuse
Frequency Hopping
Generally Accepted Systems Security
Principles
Guidelines
Hackers and Unauthorized users
Hardware Asset Management
Incident Response
Industrial Espionage
Info Sys Security Program Budgeting
Info Sys Security Program Planning
Information Availability
Information Categorization
Information Classification
Information Confidentiality
Information Criticality
Information Integrity
Information Ownership
Information Security Policy
Information Sensitivity
Information Valuation
Insurance
Integrity
Internal Controls and Security
International Security Considerations
INTERNET Security
Intrusion Detection
Intrusion Deterrents
Investigation of Security Breaches
Investigative Authorities
IS/IT Asset Valuation
Isolation and Mediation
Kernel
Keystroke Monitoring
Lattice Model
Law Enforcement Interfaces
Leased-line Networks
Least Privilege
Legal and Liability Issues
Lessons Learned
Life Cycle System Security Planning
List-based access controls
Local Area Network Security
Logs and Journals
Low Power
Malicious Code
Management of the Security Function
Mandatory Access Control
Marking of Media
Marking of Sensitive Information
Media Convergence
Message Authentication Codes
Metrics
Microwave/Wireless Communications
Security
Mobile Workstation Security
Modes of Operation
Monitoring
Monitoring (e.g.. data. line)
Multilevel Processing
Multilevel Security
Need-to-know Controls
Network communications protocols
Network Firewalls
Network Monitoring
Network Security
Network Security Software
Network Topology
Non-repudiation
Off-site Security (Information,
Processing)
Off-site Security (Information.
Processing)
One-time Passwords
Open Systems Interconnect (OSI)
Model
Open Systems Security
Operating System Integrity
Operating System Security Features
Operating Systems
Operations Security
Optical/Imaging Systems Security
Org.. Placement of the IS/IT Security
Function
Organizational Culture
Oversight
Packet Filtering
Password Management
Peer-to-Peer Security
Penetration Testing
Personnel Security Policies and
Guidance
Physical Security
Platform-specific Security
Policy Development
Policy Enforcement
Position Sensitivity
Power Controls (UPS. emergency
Power)
Practices
Preventive Controls
Privacy
Private Key Cryptology
Privileges (Class. Nodes)
Procedures
Professional Interfaces
Protection from Malicious Code
Public Key Encryption
Quality Assurance
Reconciliation
Redundancy
Remote Terminal Protection Devices
Risk Acceptance Process
Risk Management
Role-based Access Controls
Roles and Responsibilities
Rules-based Access Control
Safeguards
Safety
Satellite Communications Security
Secure System Operations
Security Architecture
Security Awareness
Security Education
Security Product Integration
Security Reviews
Security Staffing Requirements
Security Training
Security Violations Reporting Process
Sensitive System
Separation of Duties
Shielded Enclosures
Single Sign-on
Smartcards/Token Authentication
Social Engineering
Software Asset Management
Software Licensing
Software Piracy
Software Security
Spoofing
Standalone Systems and Remote
Terminals
Standards of Conduct
Storage Area Controls
Storage Media Protection and Control
System-high Mode
Technical Surveillance
Countermeasures
Technological Threats
Threat
Traffic Analysis
Transportation of Media
Unauthorized Disclosure of
Information
Voice Communications Security
Voice Mail Security
Vulnerability Analysis
Warranties
Wide Area Network Security
Witness Interviewing/Interrogation
Workstation Security
Zone of Control/Zoning

Organization

Access Control Policies
Access Control Software
Access Controls
Access Privileges
Accountability for Sensitive Data
Administrative Security Policies and
Procedures
Agency-Specific Security Policies
Aggregation
Application Development Control
Applications Security
Assurance
Audit Trails and Logging
Audit Trails and Logging Policies
Auditing Tools
Automated Security Tools
Basic/Generic Management Issues
Business Aspects of Information
Security
Cabling
Certification
Change Control Policies
Classified Materials(e.g.. Handling
and Sh
Common Carrier Security
Communications Security Policies and
Guidelines
Computer Abuse
Computer Emergency Response
Team(CERT)
Computer Matching Responsibilities
COMSEC Custodian
COMSEC Material Destruction
Procedures
Consequences
Contingency Plan Testing
Contracts, Agreements & Other
Obligations
Coordination with Related Disciplines
Copyright Protection and Licensing
Corrective Actions
Cost/Benefit Analysis
Countermeasures
Criminal Prosecution
Critical Systems
Cryptographic Techniques
Customer IT Security Needs
Customer Service Orientation
Data Access Control
Data Processing Center Security
Dedicated Line
Dedicated Mode
Delegation of Authority
Development (Life Cycle)
Disaster Recovery Plan Testing
Disaster Recovery Planning
Discretionary Access Control
Disgruntled Employees
Disposition of Classified Information
Disposition of Media & Data
Distributed Systems Security
Documentation
Documentation Policies
Due Care
Education. Training and Awareness
Electromagnetic Countermeasures
Electronic Data Interchange
Electronic Funds Transfer
Electronic Key Management System
Electronic Monitoring
Electronic Records Management
Electronic-Mail Privacy
Electronic-Mail Security
Emergency Destruction Procedures
End User Computing Security
Environmental Controls
Ethics
Evaluated Products
Evaluation Techniques
Generally Accepted Systems Security
Principles
Guidelines
Hardware Asset Management
Incident Response
Industrial Espionage
Info Sys Security Program Budgeting
Info Sys Security Program Planning
Information Categorization
Information Classification
Information Criticality
Information Ownership
Information Resource
Owner/Custodian
Information Security Policy
Information Sensitivity
Information State
Information Systems Security Officer
Information Valuation
Insurance
Internal Controls and Security
International Security Considerations
INTERNET Security
Intrusion Detection
Intrusion Deterrents
Investigation of Security Breaches
Investigative Authorities
IS/IT Asset Valuation
Jamming
Kernel
Keystroke Monitoring
Lattice Model
Leased-line Networks
Legal and Liability Issues
Lessons Learned
Life Cycle System Security Planning
Local Area Network Security
Logs and Journals
Management of the Security Function
Marking of Media
Marking of Sensitive Information
Media Convergence
Microwave/Wireless Communications
Security
Monitoring (e.g.. data. line)
Multilevel Processing
Need-to-know Controls
Network communications protocols
Network Firewalls
Network Monitoring
Network Security
Network Security Software
Network Topology
Non-repudiation
Object Labeling
Off-site Security (Information,
Processing
Off-site Security (Information.
Processing)
One-time Passwords
Open Systems Interconnect (OSI)
Model
Open Systems Security
Operating System Security Features
Optical/Imaging Systems Security
Org.. Placement of the IS/IT Security
Function
Organizational Culture
Password Management
Peer-to-Peer Security
Personnel Security Policies and
Guidance
Platform-specific Security
Policy Development
Policy Enforcement
Practices
Preventive Controls
Privileges (Class. Nodes)
Procedures
Professional Interfaces
Protected Distributed System
Protection from Malicious Code
Reconciliation
Redundancy
Remote Terminal Protection Devices
Risk Acceptance Process
Risks
Role-based Access Controls
Roles and Responsibilities
Rules-based Access Control
Safeguards
Safety
Security Awareness
Security Education
Security Product Integration
Security Training
Security Violations Reporting Process
Sensitive System
Separation of Duties
Social Engineering
Software Asset Management
Software Piracy
Standalone Systems and Remote
Terminals
Storage Area Controls
Storage Media Protection and Control
Technical Surveillance
Countermeasures
Technological Threats
Threat
Transportation of Media
Wide Area Network Security

Value Complex

Access Authorization
Access Control Policies
Access Control Software
Access Controls
Access Privileges
Account Administration
Accountability
Accountability for Sensitive Data
Acquisitions
Administrative Security Policies and
Procedures
Agency-Specific Security Policies
Aggregation
Alarms. Signals and Report
Application Development Control
Applications Security
Assessments (e.g.. surveys. inspec-
tions)
Assurance
Audit
Audit Trails and Logging
Audit Trails and Logging Policies
Auditing Tools
Authentication
Automated Security Tools
Background Investigations
Backups(Data. Software. etc.)
Biometrics
Cabling
Call-Back Security
Caller ID
Certification
Change Control Policies
Change Controls
Classified Materials(e.g.. Handling
and Sh
Client/Server Security
Common Carrier Security
Communications Center Security
Communications Security Policies and
Guidelines
Computer Abuse
Computer Emergency Response
Team(CERT)
Computer Matching Responsibilities
COMSEC Accounting
COMSEC Custodian
COMSEC Material Destruction
Procedures
COMSEC Material Identification &
Inventory
COMSEC Testing
Confidentiality
Configuration Management
Conformance Testing
Contingency Plan Testing
Contingency Planning
Continuity Planning
Contracting for Security Services
Contracts, Agreements & Other
Obligations
Coordination with Related Disciplines
Copyright Protection and Licensing
Corrective Actions
Cost/Benefit Analysis
Countermeasures
Criminal Prosecution
Critical Systems
Cryptographic Techniques
Cryptography
Cryptovariable
Customer IT Security Needs
Customer Service Orientation
Data Access Control
Data Processing Center Security
Dedicated Line
Dedicated Mode
Delegation of Authority
Denial of Service
Detective Controls
Development (Life Cycle)
Dial Number Indicator
Dial-up Security
Disaster Recovery
Disaster Recovery Plan Testing
Disaster Recovery Planning
Discretionary Access Control
Disgruntled Employees
Diskless Workstations
Disposition of Classified Information
Disposition of Media & Data
Distributed Systems Security
Document Labeling
Documentation
Documentation Policies
Drop-off/Add-on Protection(Piggy
Backing
Due Care
Education. Training and Awareness
Electromagnetic Countermeasures
Electronic Data Interchange
Electronic Funds Transfer
Electronic Key Management System
Electronic Monitoring
Electronic Records Management
Electronic-Mail Privacy
Electronic-Mail Security
Emanations Security
Emergency Destruction
Emergency Destruction Procedures
Encryption Modes
End User Computing Security
Entrapment
Environmental Controls
Error Logs
Evaluated Products
Evaluation Techniques
Expert Security/Audit Tools
Expert Systems
Facilities Management
Facilities Planning
Facility Management
Fault Tolerance
FAX Security
Filtered Power
Fire Prevention and Protection
Firmware Security
Formal Methods for Security Design
Fraud
Frequency Hopping
Generally Accepted Systems Security
Principles
Grounding
Guidelines
Hardware Asset Management
Housekeeping Procedures
Human Intelligence (HUMINT)
Identification & Authentication
Identification & Authentication
Incident Response
Inference
Inference Engine
Info Sys Security Program Budgeting
Info Sys Security Program Planning
Information Availability
Information Categorization
Information Classification
Information Confidentiality
Information Integrity
Information Ownership
Information Resource Owner/
Custodian
Information Security Policy
Information Sensitivity
Information State
Information Systems Security Officer
Information Valuation
Insurance
Integrity
Internal Controls and Security
INTERNET Security
Intrusion Detection
Intrusion Deterrents
Investigation of Security Breaches
IS/IT Asset Valuation
Isolation and Mediation
Jamming
Kernel
Key Management
Keystroke Monitoring
Labeling
Lattice Model
Law Enforcement Interfaces
Least Privilege
Lessons Learned
Line Authentication
Line of sight
List-based access controls
Local Area Network Security
Logs and Journals
Low Power
Management of the Security Function
Mandatory Access Control
Marking of Media
Marking of Sensitive Information
Memory (Non-volatile)
Memory (Random)
Memory (Sequential)
Memory (Volatile)
Message Authentication Codes
Metrics
Microwave/Wireless Communications
Security
Mobile Workstation Security
Modes of Operation
Monitoring
Monitoring (e.g.. data. line)
Multilevel Processing
Multilevel Security
Need-to-know Controls
Network communications protocols
Network Firewalls
Network Monitoring
Network Security
Network Security Software
Network Topology
Non-inference Model
Non-repudiation
Object Labeling
Object Reuse
Off-site Security (Information,
Processing
Off-site Security (Information.
Processing)
One-time Passwords
Open Systems Interconnect (OSI)
Model
Open Systems Security
Operating System Integrity
Operating System Security Features
Operating Systems
Operations Security
Optical/Imaging Systems Security
Org.. Placement of the IS/IT Security
Function
Organizational Culture
Oversight
Packet Filtering
Password Management
Peer-to-Peer Security
Penetration Testing
Personnel Security Policies and
Guidance
Physical Security
Platform-specific Security
Policy Development
Policy Enforcement
Position Sensitivity
Power Controls (UPS. emergency
Power)
Practices
Preventive Controls
Privacy
Private Key Cryptology
Privileges (Class. Nodes)
Procedures
Professional Interfaces
Protected Distributed System
Protection from Malicious Code
Public Key Encryption
Quality Assurance
Redundancy
Remote Terminal Protection Devices
Risk Management
Role-based Access Controls
Roles and Responsibilities
Rules-based Access Control
Safeguards
Safety
Satellite Communications Security
Secure System Operations
Security Architecture
Security Awareness
Security Education
Security Product Integration
Security Reviews
Security Staffing Requirements
Security Training
Security Violations Reporting Process
Sensitive System
Separation of Duties
Shielded Enclosures
Single Sign-on
Smartcards/Token Authentication
Social Engineering
Software Asset Management
Software Piracy
Software Security
Spoofing
Standalone Systems and Remote
Terminals
Storage Area Controls
Storage Media Protection and Control
System-high Mode
Technical Surveillance
Countermeasures
Technological Threats
TEMPEST
Threat
Traffic Analysis
Transportation of Media
Voice Communications Security
Voice Mail Security
Vulnerability Analysis
Warranties
Wide Area Network Security
Witness Interviewing/Interrogation
Workstation Security
Zone of Control/Zoning


Cognitive Domain


Knowledge

Access Control Software
Access Controls
Access Privileges
Account Administration
Accountability for Sensitive Data
Administrative Security Policies and
Procedures
Agency-Specific Security Policies
Aggregation
Alarms. Signals and Report
Application Development Control
Applications Security
Assurance
Audit Trails and Logging
Audit Trails and Logging Policies
Auditing Tools
Automated Security Tools
Basic/Generic Management Issues
Biometrics
Business Aspects of Information
Security
Cabling
Call-Back Security
Change Control Policies
Classified Materials(e.g. Handling and
Shipping)
Classified Materials(e.g.. Handling
and Sh
Client/Server Security
Common Carrier Security
Communications Security Policies and
Guidelines
Computer Abuse
Computer Emergency Response
Team(CERT)
Computer Matching Responsibilities
COMSEC Accounting
COMSEC Custodian
COMSEC Material Destruction
Procedures
COMSEC Material Identification &
Inventory
COMSEC Testing
Confidentiality
Configuration Management
Conformance Testing
Consequences
Contingency Plan Testing
Contingency Planning
Continuity Planning
Contracts, Agreements & Other
Obligations
Coordination with Related Disciplines
Copyright Protection and Licensing
Corrective Actions
Cost/Benefit Analysis
Countermeasures
Critical Systems
Cryptography
Customer IT Security Needs
Data Access Control
Data Processing Center Security
Dedicated Mode
Delegation of Authority
Detective Controls
Development (Life Cycle)
Dial-up Security
Disaster Recovery
Disaster Recovery Plan Testing
Disaster Recovery Planning
Discretionary Access Control
Disgruntled Employees
Disposition of Classified Information
Distributed Systems Security
Documentation
Documentation Policies
Education. Training and Awareness
Electromagnetic Countermeasures
Electronic Funds Transfer
Electronic Key Management System
Electronic Monitoring
Electronic Records Management
Electronic-Mail Privacy
Electronic-Mail Security
End User Computing Security
Entrapment
Environmental Controls
Evaluated Products
Evaluation Techniques
Expert Security/Audit Tools
Expert Systems
Facilities Planning
Fault Tolerance
FAX Security
Firmware Security
Fraud
Fraud. Waste and Abuse
Generally Accepted Systems Security
Principles
Guidelines
Hackers and Unauthorized users
Hardware Asset Management
Implementation (Life Cycle)
Industrial Espionage
Info Sys Security Program Planning
Information Availability
Information Categorization
Information Classification
Information Confidentiality
Information Criticality
Information Integrity
Information Ownership
Information Resource
Owner/Custodian
Information Security Policy
Information Sensitivity
Information State
Information Systems Security Officer
Information Valuation
Insurance
Integrity
Internal Controls and Security
International Security Considerations
INTERNET Security
Intrusion Detection
Intrusion Deterrents
Investigation of Security Breaches
Investigative Authorities
IS/IT Asset Valuation
Jamming
Keystroke Monitoring
Leased-line Networks
Least Privilege
Legal and Liability Issues
Lessons Learned
Life Cycle System Security Planning
List-based access controls
Logs and Journals
Malicious Code
Management of the Security Function
Marking of Media
Marking of Sensitive Information
Metrics
Mobile Workstation Security
Multilevel Processing
Need-to-know Controls
Network communications protocols
Network Firewalls
Network Monitoring
Network Security
Network Security Software
Network Topology
Off-site Security (Information,
Processing)
Off-site Security (Information.
Processing)
One-time Passwords
Operating System Integrity
Operating System Security Features
Operations Security
Optical/Imaging Systems Security
Org.. Placement of the IS/IT Security
Function
Organizational Culture
Oversight
Password Management
Peer-to-Peer Security
Personnel Security Policies and
Guidance
Physical Security
Platform-specific Security
Policy Development
Policy Enforcement
Position Sensitivity
Practices
Preventive Controls
Privacy
Private Key Cryptology
Privileges (Class. Nodes)
Procedures
Professional Interfaces
Protection from Malicious Code
Public Key Encryption
Quality Assurance
Reconciliation
Redundancy
Remote Terminal Protection Devices
Risk Acceptance Process
Risk Management
Risks
Role-based Access Controls
Roles and Responsibilities
Rules-based Access Control
Safeguards
Safety
Satellite Communications Security
Secure System Operations
Security Architecture
Security Awareness
Security Education
Security Product Integration
Security Reviews
Security Staffing Requirements
Security Training
Security Violations Reporting Process
Sensitive System
Separation of Duties
Single Sign-on
Smartcards/Token Authentication
Social Engineering
Software Asset Management
Software Licensing
Software Piracy
Software Security
Spoofing
Standalone Systems and Remote
Terminals
Standards of Conduct
Storage Area Controls
Storage Media Protection and Control
Technical Surveillance
Countermeasures
Technological Threats
Threat
Transportation of Media
Unauthorized Disclosure of
Information
Voice Communications Security
Voice Mail Security
Warranties
Wide Area Network Security
Witness Interviewing/Interrogation
Workstation Security
Zone of Control/Zoning

Comprehension

Access Control Policies
Access Controls
Accountability for Sensitive Data
Administrative Security Policies and
Procedures Agency-Specific
Security Policies
Applications Security
Assurance
Asynchronous & Synchronous com-
munication
Attenuation
Audit Trails and Logging
Audit Trails and Logging Policies
Basic/Generic Management Issues
Business Aspects of Information
Security
Certification
Change Control Policies
Communications Security Policies and
Guidelines
Computer Matching Responsibilities
COMSEC Material Destruction
Procedures
Consequences
Contingency Plan Testing
Contracts. Agreements. & Other
Obligations
Coordination with Related Disciplines
Corrective Actions
Cost/Benefit Analysis
Countermeasures
Criminal Prosecution
Critical Systems
Cryptographic Techniques
Cryptovariable
Customer IT Security Needs
Customer Service Orientation
Data Access Control
Data Processing Center Security
Dedicated Mode
Delegation of Authority
Disaster Recovery Plan Testing
Disaster Recovery Planning
Discretionary Access Control
Diskless Workstations
Disposition of Classified Information
Disposition of Media & Data
Documentation
Documentation Policies
Education. Training and Awareness
Electromagnetic Interference
Electronic Data Interchange
Electronic Funds Transfer
Electronic Monitoring
Electronic Records Management
Electronic-Mail Privacy
Electronic-Mail Security
Emanations Security
Emergency Destruction Procedures
Encryption Modes
Ethics
Evaluated Products
Evaluation Techniques
Expert Security/Audit Tools
Expert Systems
Fault Tolerance
FAX Security
Filtered Power
Frequency Hopping
Guidelines
Hardware Asset Management
Identification & Authentication
Implementation (Life Cycle)
Incident Response
Industrial Espionage
Inference
Info Sys Security Program Budgeting
Info Sys Security Program Planning
Information Availability
Information Categorization
Information Classification
Information Confidentiality
Information Criticality
Information Integrity
Information Security Policy
Information Sensitivity
Information Systems Security Officer
Insurance
Internal Controls and Security
International Security Considerations
INTERNET Security
Intrusion Detection
Investigation of Security Breaches
Investigative Authorities
Jamming
Kernel
Keystroke Monitoring
Labeling
Leased-line Networks
Least Privilege
Legal and Liability Issues
Lessons Learned
Life Cycle System Security Planning
Line Authentication
Line of sight
List-based access controls
Local Area Network Security
Logs and Journals
Management of the Security Function
Marking of Media
Marking of Sensitive Information
Media Convergence
Microwave/Wireless Communications
Security
Mobile Workstation Security
Monitoring
Monitoring (e.g.. data. line)
Multilevel Processing
Multilevel Security
Network communications protocols
Network Monitoring
Network Security
Network Security Software
Network Topology
Non-repudiation
Object Reuse
Off-site Security (Information,
Processing)
Off-site Security (Information.
Processing)
One-time Passwords
Open Systems Security
Optical/Imaging Systems Security
Org.. Placement of the IS/IT Security
Function Policy Enforcement
Organizational Culture
Password Management
Peer-to-Peer Security
Policy Development
Practices
Preventive Controls
Procedures
Professional Interfaces
Protected Distributed System
Protection from Malicious Code
Redundancy
Remote Terminal Protection Devices
Risk Acceptance Process
Risks
Roles and Responsibilities
Safeguards
Safety
Security Awareness
Security Education
Security Training
Security Violations Reporting Process
Separation of Duties
Social Engineering
Software Asset Management
Software Licensing
Software Piracy
Storage Area Controls
Storage Media Protection and Control
Technical Surveillance
Countermeasures
Wide Area Network Security

Application

Access Authorization
Access Control Policies
Access Control Software
Access Controls
Access Privileges
Account Administration
Administrative Security
Administrative Security Policies and
Procedures
Agency-Specific Security Policies
Aggregation
Alarms. Signals and Report
Application Development Control
Applications Security
Audit Trails and Logging
Audit Trails and Logging Policies
Auditing Tools
Authentication
Automated Security Tools
Background Investigations
Biometrics
Cabling
Call-Back Security
Caller ID
Change Control Policies
Change Controls
Classified Materials(e.g.. Handling
and Sh
Client/Server Security
Common Carrier Security
Communications Center Security
Communications Security Policies and
Guidelines
Computer Emergency Response
Team(CERT)
COMSEC Material Destruction
Procedures
COMSEC Material Identification &
Invent
COMSEC Material Identification &
Inventory
Confidentiality
Contingency Plan Testing
Contingency Planning
Continuity Planning
Contracting for Security Services
Contracts, Agreements & Other
Obligations
Coordination with Related Disciplines
Copyright Protection and Licensing
Cost/Benefit Analysis
Countermeasures
Cover and Deception
Criminal Prosecution
Critical Systems
Cryptographic Techniques
Cryptography
Cryptovariable
Customer IT Security Needs
Customer Service Orientation
Data Access Control
Data Processing Center Security
Dedicated Line
Dedicated Mode
Delegation of Authority
Denial of Service
Detective Controls
Development (Life Cycle)
Dial Number Indicator
Dial-up Security
Disaster Recovery
Disaster Recovery Plan Testing
Disaster Recovery Planning
Disclosure of Sensitive Data
Discretionary Access Control
Diskless Workstations
Disposition of Classified Information
Disposition of Media & Data
Distributed Systems Security
Document Labeling
Documentation
Documentation Policies
Drop-off/Add-on Protection(Piggy
Backing
Due Care
Education. Training and Awareness
Electromagnetic Countermeasures
Electronic Data Interchange
Electronic Funds Transfer
Electronic Key Management System
Electronic Monitoring
Electronic Records Management
Electronic-Mail Privacy
Electronic-Mail Security
Emanations Security
Emergency Destruction
Emergency Destruction Procedures
Encryption Modes
End User Computing Security
Environmental Controls
Error Logs
Ethics
Evaluated Products
Evaluation Techniques
Expert Security/Audit Tools
Expert Systems
Facilities Planning
Fault Tolerance
FAX Security
Filtered Power
Fire Prevention and Protection
Firmware Security
Formal Methods for Security Design
Frequency Hopping
Generally Accepted Systems Security
Principles
Grounding
Guidelines
Hackers and Unauthorized users
Hardware Asset Management
Housekeeping Procedures
Human Intelligence (HUMINT)
Identification & Authentication
Incident Response
Inference Engine
Info Sys Security Program Budgeting
Info Sys Security Program Planning
Information Categorization
Information Classification
Information Security Policy
Information Sensitivity
Information State
Information Valuation
Integrity
Internal Controls and Security
INTERNET Security
Intrusion Detection
Intrusion Deterrents
Investigation of Security Breaches
IS/IT Asset Valuation
Isolation and Mediation
Kernel
Key Management
Keystroke Monitoring
Labeling
Lattice Model
Law Enforcement Interfaces
Least Privilege
Legal and Liability Issues
Life Cycle System Security Planning
Line Authentication
Line of sight
List-based access controls
Local Area Network Security
Logs and Journals
Low Power
Mandatory Access Control
Marking of Media
Marking of Sensitive Information
Memory (Non-volatile)
Memory (Random)
Memory (Sequential)
Memory (Volatile)
Message Authentication Codes
Metrics
Microwave/Wireless Communications
Security
Mobile Workstation Security
Modes of Operation
Monitoring
Multilevel Processing
Multilevel Security
Need-to-know Controls
Network communications protocols
Network Firewalls
Network Monitoring
Network Security
Network Security Software
Network Topology
Non-inference Model
Non-repudiation
Object Labeling
Off-site Security (Information,
Processing) Operations Security
Off-site Security (Information.
Processing)
One-time Passwords
Open Systems Interconnect (OSI)
Model
Open Systems Security
Operating System Integrity
Operating System Security Features
Operating Systems
Optical/Imaging Systems Security
Organizational Culture
Oversight
Packet Filtering
Password Management
Peer-to-Peer Security
Penetration Testing
Personnel Security Policies and
Guidance
Physical Security
Platform-specific Security
Policy Enforcement
Power Controls (UPS. emergency
Power)
Practices
Preventive Controls
Privacy
Private Key Cryptology
Privileges (Class. Nodes)
Procedures
Professional Interfaces
Protected Distributed System
Protection from Malicious Code
Public Key Encryption
Quality Assurance
Rainbow Series
Redundancy
Remanance
Remote Terminal Protection Devices
Role-based Access Controls
Roles and Responsibilities
Rules-based Access Control
Safeguards
Safety
Satellite Communications Security
Secure System Operations
Security Architecture
Security Awareness
Security Education
Security Product Integration
Security Training
Security Violations Reporting Process
Sensitive System
Separation of Duties
Single Sign-on
Smartcards/Token Authentication
Software Asset Management
Software Licensing
Software Piracy
Software Security
Storage Area Controls
Storage Media Protection and Control
System-high Mode
Technical Surveillance
Countermeasures
Technological Threats
TEMPEST
Threat
Traffic Analysis
Voice Communications Security
Voice Mail Security
Vulnerability Analysis
Warranties
Wide Area Network Security
Witness Interviewing/Interrogation
Workstation Security
Zone of Control/Zoning

Analysis

Access Control Policies
Access Control Software
Access Controls
Aggregation
Alarms. Signals and Report
Assessments (e.g.. surveys. inspec-
tions)
Auditing Tools
Automated Security Tools
Basic/Generic Management Issues
Biometrics
Business Aspects of Information
Security
Cabling
Call-Back Security
Classified Materials(e.g.. Handling
and Sh
Client/Server Security
Common Carrier Security
Communications Center Security
Computer Abuse
Computer Emergency Response
Team(CERT)
Computer Matching Responsibilities
COMSEC Custodian
COMSEC Material Destruction
Procedures
COMSEC Testing
Conformance Testing
Consequences
Contingency Plan Testing
Contingency Planning
Continuity Planning
Coordination with Related Disciplines
Corrective Actions
Countermeasures
Covert Channels
Critical Systems
Customer IT Security Needs
Customer Service Orientation
Data Access Control
Data Processing Center Security
Dedicated Mode
Dial-up Security
Disaster Recovery
Disaster Recovery Plan Testing
Disaster Recovery Planning
Disclosure of Sensitive Data
Disgruntled Employees
Distributed Systems Security
Drop-off/Add-on Protection(Piggy
Backing
Education. Training and Awareness
Electromagnetic Countermeasures
Electromagnetic Interference
Electronic Funds Transfer
Electronic Key Management System
Electronic Monitoring
Electronic Records Management
Electronic-Mail Security
End User Computing Security
Environmental Controls
Evaluated Products
Evaluation Techniques
Expert Security/Audit Tools
Expert Systems
Facilities Planning
Fault Tolerance
FAX Security
Firmware Security
Fraud
Fraud. Waste and Abuse
Generally Accepted Systems Security
Principles International Security
Considerations
Hackers and Unauthorized users
Hostile Overseas Intelligence
Sources(HO
Human Threats
Identification & Authentication
Implementation (Life Cycle)
Industrial Espionage
Inference
Info Sys Security Program Budgeting
Information Categorization
Information Classification
Information Criticality
Information Ownership
Information Resource
Owner/Custodian
Information Sensitivity
Information State
Information Systems Security Officer
Information Valuation
Insurance
Integrity
Internal Controls and Security
International Espionage
INTERNET Security
Intrusion Detection
Intrusion Deterrents
Investigation of Security Breaches
Investigative Authorities
IS/IT Asset Valuation
Jamming
Key Certificate Administration
Keystroke Monitoring
Lattice Model
Leased-line Networks
Least Privilege
Legal and Liability Issues
Lessons Learned
List-based access controls
Local Area Network Security
Low Power
Magnetic Remanance
Malicious Code
Management of the Security Function
Mandatory Access Control
Masquerading
Message Authentication Codes
Metrics
Microwave/Wireless Communications
Security
Mobile Workstation Security
Monitoring
Multilevel Processing
Multilevel Security
Need-to-know Controls
Network communications protocols
Network Firewalls
Network Monitoring
Network Security
Network Security Software
Network Topology
Non-repudiation
Object Labeling
Object Reuse
Off-site Security (Information.
Processing) Operating System
Security Features
One-time Passwords
Open Systems Interconnect (OSI)
Model
Open Systems Security
Operating System Integrity
Operating Systems
Operations Security
Optical/Imaging Systems Security
Packet Filtering
Peer-to-Peer Security
Physical Security
Platform-specific Security
Policy Enforcement
Power Controls (UPS. emergency
Power)
Practices
Preventive Controls
Privacy
Private Key Cryptology
Privileges (Class. Nodes)
Procedures
Professional Interfaces
Protected Distributed System
Protection from Malicious Code
Public Key Encryption
Reconciliation
Redundancy
Remanance
Remote Terminal Protection Devices
Risks
Role-based Access Controls
Roles and Responsibilities
Rules-based Access Control
Safeguards
Safety
Security Product Integration
Security Product Testing/Evaluation
Security Training
Security Violations Reporting Process
Sensitive System
Separation of Duties
Single Sign-on
Smartcards/Token Authentication
Social Engineering
Software Piracy
Software Security
Spoofing
Storage Area Controls
Storage Media Protection and Control
Technological Threats
Threat
Unauthorized Disclosure of
Information
Validation (Testing)
Value-added Networks
Verification and Validation Process
Voice Communications Security
Voice Mail Security
Wide Area Network Security
Wide Area Networks
Workstation Security

Synthesis

Access Authorization
Access Control Policies
Access Controls
Access Privileges
Administrative Security Policies and
Procedures Agency-Specific
Security Policies
Application Development Control
Assurance
Audit Trails and Logging Policies
Basic/Generic Management Issues
Business Aspects of Information
Security
Certification
Change Control Policies
Client/Server Security
Communications Security Policies and
Guidelines
Computer Matching Responsibilities
COMSEC Material Destruction
Procedures
Conformance Testing
Contingency Plan Testing
Contingency Planning
Continuity Planning
Contracting for Security Services
Contracts, Agreements & Other
Obligations
Corrective Actions
Cost/Benefit Analysis
Countermeasures
Criminal Prosecution
Cryptographic Techniques
Cryptography
Customer IT Security Needs
Customer Service Orientation
Data Access Control
Data Processing Center Security
Delegation of Authority
Detective Controls
Disaster Recovery
Disaster Recovery Plan Testing
Disaster Recovery Planning
Discretionary Access Control
Disposition of Classified Information
Disposition of Media & Data
Distributed Systems Security
Documentation
Documentation Policies
Education. Training and Awareness
Electromagnetic Countermeasures
Electronic Data Interchange
Electronic Funds Transfer
Electronic Key Management System
Electronic Monitoring
Electronic Records Management
Electronic-Mail Privacy
Electronic-Mail Security
Emanations Security
Emergency Destruction
Emergency Destruction Procedures
End User Computing Security
Error Logs
Evaluation Techniques
Expert Security/Audit Tools
Fault Tolerance
FAX Security
Firmware Security
Guidelines
Hardware Asset Management
Implementation (Life Cycle)
Incident Response
Info Sys Security Program Budgeting
Info Sys Security Program Planning
Information Categorization
Information Classification
Information Security Policy
Information Sensitivity
Internal Controls and Security
International Security Considerations
INTERNET Security
Intrusion Detection
Intrusion Deterrents
Investigation of Security Breaches
Investigative Authorities
Isolation and Mediation
Kernel
Keystroke Monitoring
Lattice Model
Leased-line Networks
Legal and Liability Issues
Life Cycle System Security Planning
Local Area Network Security
Logs and Journals
Management of the Security Function
Mandatory Access Control
Marking of Media
Marking of Sensitive Information
Media Convergence
Microwave/Wireless Communications
Security
Mobile Workstation Security
Monitoring
Monitoring (e.g.. data. line)
Multilevel Processing
Multilevel Security
Network Firewalls
Network Monitoring
Network Security
Network Security Software
Network Topology
Non-repudiation
Object Labeling
Off-site Security (Information,
Processing)
Off-site Security (Information.
Processing) Operating System
Security Features
One-time Passwords
Open Systems Security
Optical/Imaging Systems Security
Org.. Placement of the IS/IT Security
Function Organizational Culture
Password Management
Peer-to-Peer Security
Penetration Testing
Platform-specific Security
Policy Development
Policy Enforcement
Practices
Preventive Controls
Procedures
Protected Distributed System
Protection from Malicious Code
Redundancy
Risk Acceptance Process
Risk Management
Roles and Responsibilities
Secure System Operations
Security Awareness
Security Education
Security Product Integration
Security Reviews
Security Staffing Requirements
Security Violations Reporting Process
Separation of Duties
Social Engineering
Software Piracy
Storage Area Controls
Storage Media Protection and Control
Transportation of Media
Wide Area Network Security
Workstation Security
Zone of Control/Zoning

Evaluation

Access Control Policies
Access Controls
Accountability
Acquisitions
Administrative Security
Administrative Security Policies and
Procedures Agency-Specific
Security Policies
Assessments (e.g.. surveys. inspec-
tions)
Assurance
Audit
Audit Trails and Logging
Audit Trails and Logging Policies
Backups(Data. Software. etc.)
Basic/Generic Management Issues
Biometrics
Business Aspects of Information
Security
Call-Back Security
Caller ID
Certification
Change Control Policies
Communications Security Policies and
Guidelines
Computer Matching Responsibilities
COMSEC Custodian
COMSEC Material Destruction
Procedures
COMSEC Material Identification &
Invent
Confidentiality
Configuration Management
Contingency Plan Testing
Contingency Planning
Continuity Planning
Contracting for Security Services
Coordination with Related Disciplines
Copyright Protection and Licensing
Corrective Actions
Cost/Benefit Analysis
Countermeasures
Criminal Prosecution
Critical Systems
Cryptographic Techniques
Cryptography
Customer IT Security Needs
Customer Service Orientation
Data Access Control
Dedicated Line
Delegation of Authority
Dial-up Security
Disaster Recovery
Disaster Recovery Plan Testing
Disaster Recovery Planning
Disposition of Classified Information
Disposition of Media & Data
Distributed Systems Security
Documentation Policies
Due Care
Education. Training and Awareness
Electronic Data Interchange
Electronic Funds Transfer
Electronic Key Management System
Electronic Monitoring
Electronic Records Management
Electronic-Mail Privacy
Emergency Destruction
Emergency Destruction Procedures
End User Computing Security
Environmental Controls
Error Logs
Evaluated Products
Evidence Collection and Preservation
Facility Management
Generally Accepted Systems Security
Principles Contracts, Agreements &
Other Obligations Data Processing
Center Security
Guidelines
Hardware Asset Management
Housekeeping Procedures
Incident Response
Info Sys Security Program Budgeting
Info Sys Security Program Planning
Information Categorization
Information Classification
Information Confidentiality
Information Integrity
Information Security Policy
Information Sensitivity
Information Systems Security Officer
Information Valuation
Insurance
Integrity
Internal Controls and Security
International Security Considerations
INTERNET Security
Intrusion Detection
Intrusion Deterrents
Investigation of Security Breaches
Investigative Authorities
IS/IT Asset Valuation
Key Management
Lattice Model
Law Enforcement Interfaces
Leased-line Networks
Legal and Liability Issues
Lessons Learned
Life Cycle System Security Planning
Line Authentication
Local Area Network Security
Logs and Journals
Management of the Security Function
Mandatory Access Control
Marking of Media
Marking of Sensitive Information
Media Convergence
Monitoring (e.g.. data. line)
Multilevel Processing
Need-to-know Controls
Network communications protocols
Network Monitoring
Network Security
Network Topology
Non-repudiation
Object Labeling
Off-site Security (Information,
Processing) Preventive Controls
Operating System Integrity
Operating System Security Features
Operations Security
Org.. Placement of the IS/IT Security
Function Organizational Culture
Oversight
Packet Filtering
Password Management
Peer-to-Peer Security
Penetration Testing
Personnel Security Policies and
Guidance
Physical Security
Platform-specific Security
Policy Development
Policy Enforcement
Position Sensitivity
Practices
Privacy
Privileges (Class. Nodes)
Procedures
Professional Interfaces
Protection from Malicious Code
Quality Assurance
Reconciliation
Redundancy
Risk Acceptance Process
Risk Management
Role-based Access Controls
Roles and Responsibilities
Rules-based Access Control
Safety
Satellite Communications Security
Secure System Operations
Security Architecture
Security Awareness
Security Education
Security Product Integration
Security Reviews
Security Staffing Requirements
Security Training
Security Violations Reporting Process
Sensitive System
Separation of Duties
Smartcards/Token Authentication
Social Engineering
Software Asset Management
Software Security
Standalone Systems and Remote
Terminals
Standards of Conduct
Storage Area Controls
Storage Media Protection and Control
System-high Mode
Traffic Analysis
Transportation of Media
Voice Communications Security
Voice Mail Security
Vulnerability Analysis
Wide Area Network Security
Witness Interviewing/Interrogation
Workstation Security
Zone of Control/Zoning


Psychomotor Domain


Access Authorization
Access Control Policies
Access Control Software
Access Controls
Access Privileges
Account Administration
Administrative Security
Administrative Security Policies and
Procedures Agency-Specific
Security Policies
Aggregation
Alarms. Signals and Report
Applications Security
Audit Trails and Logging
Audit Trails and Logging Policies
Auditing Tools
Authentication
Automated Security Tools
Background Investigations
Basic/Generic Management Issues
Biometrics
Business Aspects of Information
Security
Cabling
Call-Back Security
Caller ID
Certification
Change Control Policies
Change Controls
Classified Materials(e.g.. Handling
and Sh
Client/Server Security
Common Carrier Security
Communications Center Security
Communications Security Policies and
Guidelines
Computer Abuse
Computer Emergency Response
Team(CERT)
Computer Matching Responsibilities
COMSEC Custodian
COMSEC Material Destruction
Procedures
COMSEC Material Identification &
Inventory
Conformance Testing
Consequences
Contingency Plan Testing
Contingency Planning
Continuity Planning
Contracting for Security Services
Contracts, Agreements & Other
Obligations
Coordination with Related Disciplines
Copyright Protection and Licensing
Corrective Actions
Cost/Benefit Analysis
Countermeasures
Critical Systems
Cryptographic Techniques
Cryptography
Cryptovariable
Customer IT Security Needs
Data Access Control
Data Processing Center Security
Dedicated Line
Dedicated Mode
Delegation of Authority
Denial of Service
Detective Controls
Development (Life Cycle)
Dial Number Indicator
Dial-up Security
Disaster Recovery
Disaster Recovery Plan Testing
Disaster Recovery Planning
Discretionary Access Control
Disgruntled Employees
Diskless Workstations
Disposition of Classified Information
Disposition of Media & Data
Distributed Systems Security
Document Labeling
Documentation
Documentation Policies
Drop-off/Add-on Protection(Piggy
Backing
Due Care
Education. Training and Awareness
Electromagnetic Countermeasures
Electromagnetic Interference
Electronic Data Interchange
Electronic Funds Transfer
Electronic Key Management System
Electronic Monitoring
Electronic Records Management
Electronic-Mail Privacy
Electronic-Mail Security
Emanations Security
Emergency Destruction
Emergency Destruction Procedures
Encryption Modes
End User Computing Security
Environmental Controls
Error Logs
Ethics
Evaluated Products
Evaluation Techniques
Expert Security/Audit Tools
Expert Systems
Facilities Planning
Fault Tolerance
FAX Security
Filtered Power
Fire Prevention and Protection
Firmware Security
Formal Methods for Security Design
Fraud
Fraud. Waste and Abuse
Frequency Hopping
Generally Accepted Systems Security
Principles International Security
Considerations
Grounding
Guidelines
Hardware Asset Management
Housekeeping Procedures
Human Intelligence (HUMINT)
Identification & Authentication
Incident Response
Industrial Espionage
Inference Engine
Info Sys Security Program Planning
Information Categorization
Information Classification
Information Ownership
Information Resource
Owner/Custodian
Information Security Policy
Information Sensitivity
Information State
Information Systems Security Officer
Information Valuation
Insurance
Internal Controls and Security
INTERNET Security
Intrusion Detection
Intrusion Deterrents
Investigation of Security Breaches
Investigative Authorities
IS/IT Asset Valuation
Isolation and Mediation
Jamming
Kernel
Key Management
Keystroke Monitoring
Labeling
Lattice Model
Law Enforcement Interfaces
Leased-line Networks
Least Privilege
Legal and Liability Issues
Lessons Learned
Life Cycle System Security Planning
Line Authentication
Line of sight
List-based access controls
Local Area Network Security
Logs and Journals
Low Power
Mandatory Access Control
Marking of Media
Marking of Sensitive Information
Memory (Non-volatile)
Memory (Random)
Memory (Sequential)
Memory (Volatile)
Message Authentication Codes
Metrics
Microwave/Wireless Communications
Security
Mobile Workstation Security
Modes of Operation
Monitoring
Multilevel Processing
Multilevel Security
Need-to-know Controls
Network communications protocols
Network Firewalls
Network Monitoring
Network Security
Network Security Software
Network Topology
Non-inference Model
Non-repudiation
Object Labeling
Off-site Security (Information,
Processing)
Off-site Security (Information.
Processing) Procedures
One-time Passwords
Open Systems Interconnect (OSI)
Model
Open Systems Security
Operating System Integrity
Operating System Security Features
Operating Systems
Operations Security
Optical/Imaging Systems Security
Oversight
Password Management
Peer-to-Peer Security
Penetration Testing
Personnel Security Policies and
Guidance
Physical Security
Platform-specific Security
Policy Enforcement
Power Controls (UPS. emergency
Power)
Practices
Preventive Controls
Privacy
Private Key Cryptology
Privileges (Class. Nodes)
Professional Interfaces
Protected Distributed System
Protection from Malicious Code
Reconciliation
Redundancy
Remote Terminal Protection Devices
Risk Management
Risks
Role-based Access Controls
Roles and Responsibilities
Rules-based Access Control
Safeguards
Safety
Satellite Communications Security
Secure System Operations
Security Architecture
Security Awareness
Security Education
Security Product Integration
Security Training
Security Violations Reporting Process
Sensitive System
Separation of Duties
Single Sign-on
Smartcards/Token Authentication
Social Engineering
Software Asset Management
Software Piracy
Software Security
Storage Area Controls
Storage Media Protection and Control
System-high Mode
Technical Surveillance
Countermeasures
Technological Threats
TEMPEST
Threat
Traffic Analysis
Voice Communications Security
Voice Mail Security
Vulnerability Analysis
Warranties
Wide Area Network Security
Witness Interviewing/Interrogation
Workstation Security
Zone of Control/Zoning







CBK Items with Maslow Categories

This section lists all items in the Common Body of Knowledge with the associated Maslow verb cat-
egories. This material is currently being analyzed to aid in determining which items belong in the
professional/executive  level of the DACUM II and DACUM III model




Access Control Policies
Receiving
Responding
Valuing
Organization
Value Complex
Comprehension
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Administrative Security Policies and
Pro
Receiving
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Synthesis
Evaluation
Psychomotor Domain

Communications Security Policies and
Guidelines
Receiving
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Synthesis
Evaluation
Psychomotor Domain

Computer Matching Responsibilities
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Analysis
Synthesis
Evaluation
Psychomotor Domain

COMSEC Accounting
Receiving
Responding
Valuing
Value Complex
Knowledge

COMSEC Material Destruction
Procedures
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Contingency Planning
Receiving
Responding
Valuing
Value Complex
Knowledge
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Continuity Planning
Receiving
Responding
Valuing
Value Complex
Knowledge
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Copyright Protection and Licensing
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Application
Evaluation
Psychomotor Domain

Criminal Prosecution
Receiving
Valuing
Organization
Value Complex
Comprehension
Application
Synthesis
Evaluation

Delegation of Authority
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Synthesis
Evaluation
Psychomotor Domain

Disaster Recovery
Receiving
Responding
Valuing
Value Complex
Knowledge
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Disposition of Classified Information
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Synthesis
Evaluation
Psychomotor Domain

Education. Training and Awareness
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Electronic Funds Transfer
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Electronic Monitoring
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Development (Life Cycle)
Receiving
Valuing
Organization
Value Complex
Knowledge
Application
Psychomotor Domain

Electronic Records Management
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Access Control Models

Access Controls
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Access Privileges
Receiving
Valuing
Organization
Value Complex
Knowledge
Application
Synthesis
Psychomotor Domain

Accountability
Value Complex
Evaluation

Accountability for Sensitive Data
Receiving
Valuing
Organization
Value Complex
Knowledge
Comprehension

Administrative Security
Receiving
Valuing
Application
Evaluation
Psychomotor Domain

Administrative Security Policies and
Pro

Aggregation
Receiving
Responding
Organization
Value Complex
Knowledge
Application
Analysis
Psychomotor Domain

Applications Security
Receiving
Organization
Value Complex
Knowledge
Comprehension
Application
Psychomotor Domain

Assessments (e.g.. surveys. inspections)
Responding
Valuing
Value Complex
Analysis
Evaluation

Assurance
Valuing
Organization
Value Complex
Knowledge
Comprehension
Synthesis
Evaluation

Audit
Receiving
Responding
Valuing
Value Complex
Evaluation

Audit Trails and Logging
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Evaluation
Psychomotor Domain

Audit Trails and Logging Policies
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Synthesis
Evaluation
Psychomotor Domain

Authentication
Receiving
Value Complex
Application
Psychomotor Domain

Availability

Background Investigations
Receiving
Value Complex
Application
Psychomotor Domain

Backups(Data. Software. etc.)
Responding
Valuing
Value Complex
Evaluation

Careless Employees

Change Control Policies
Receiving
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Synthesis
Evaluation
Psychomotor Domain

Change Controls
Receiving
Value Complex
Application
Psychomotor Domain

Communications Center Security
Receiving
Value Complex
Application
Analysis
Psychomotor Domain

Communications Security

Communications Systems Abuse

Computer Abuse
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Analysis
Psychomotor Domain

Computers at Risk

Confidentiality
Valuing
Value Complex
Knowledge
Application
Evaluation

Configuration Management
Receiving
Valuing
Value Complex
Knowledge
Evaluation

Consequences
Receiving
Organization
Knowledge
Comprehension
Analysis
Psychomotor Domain

Contracting for Security Services
Receiving
Responding
Valuing
Value Complex
Application
Synthesis
Evaluation
Psychomotor Domain

Contracts. Agreements. & Other
Obligation
Comprehension

Coordination with Related Disciplines
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Evaluation
Psychomotor Domain

Corrective Actions
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Analysis
Synthesis
Evaluation
Psychomotor Domain

Cost/Benefit Analysis
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Synthesis
Evaluation
Psychomotor Domain

Countermeasures
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Critical Systems
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Evaluation
Psychomotor Domain

Cryptography
Receiving
Valuing
Value Complex
Knowledge
Application
Synthesis
Evaluation
Psychomotor Domain

Data Access Control
Receiving
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Data Processing Center Security
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Database Integrity

Denial of Service
Value Complex
Application
Psychomotor Domain

Detective Controls
Receiving
Valuing
Value Complex
Knowledge
Application
Synthesis
Psychomotor Domain

Dial-up Security
Receiving
Responding
Valuing
Value Complex
Knowledge
Application
Analysis
Evaluation
Psychomotor Domain

Disclosure of Sensitive Data
Application
Analysis

Disgruntled Employees
Receiving
Organization
Value Complex
Knowledge
Analysis
Psychomotor Domain

Disposition of Media & Data
Responding
Valuing
Organization
Value Complex
Comprehension
Application
Synthesis
Evaluation
Psychomotor Domain

Document Labeling
Receiving
Responding
Value Complex
Application
Psychomotor Domain

Documentation Policies
Receiving
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Synthesis
Evaluation
Psychomotor Domain

Due Care
Receiving
Valuing
Organization
Value Complex
Application
Evaluation
Psychomotor Domain

Electronic-Mail Privacy
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Synthesis
Evaluation
Psychomotor Domain

Electronic-Mail Security
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Psychomotor Domain

Emanations Security
Receiving
Value Complex
Comprehension
Application
Synthesis
Psychomotor Domain

Emergency Destruction
Receiving
Responding
Valuing
Value Complex
Application
Synthesis
Evaluation
Psychomotor Domain

End User Computing Security
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Environmental Controls
Receiving
Valuing
Organization
Value Complex
Knowledge
Application
Analysis
Evaluation
Psychomotor Domain

Environmental/Natural Threats

Ethics
Receiving
Responding
Valuing
Organization
Comprehension
Application
Psychomotor Domain

Evaluated Products
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Evaluation
Psychomotor Domain

Export Controls

Facilities Planning
Receiving
Responding
Valuing
Value Complex
Knowledge
Application
Analysis
Psychomotor Domain

Facility Management
Responding
Value Complex
Evaluation

FAX Security
Receiving
Responding
Valuing
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Psychomotor Domain

Fire Prevention and Protection
Receiving
Value Complex
Application
Psychomotor Domain

Fraud
Receiving
Valuing
Value Complex
Knowledge
Analysis
Psychomotor Domain

Fraud. Waste and Abuse
Responding
Valuing
Knowledge
Analysis
Psychomotor Domain

Generally Accepted Systems Security
Principles
Receiving
Valuing
Organization
Value Complex
Knowledge
Application
Analysis
Evaluation
Psychomotor Domain

Hackers and Unauthorized users
Receiving
Responding
Valuing
Knowledge
Application
Analysis

Hardware Asset Management
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Synthesis
Evaluation
Psychomotor Domain

History of Information Security

Hostile Overseas Intelligence
Sources(HO
Analysis

Housekeeping Procedures
Receiving
Responding
Value Complex
Application
Evaluation
Psychomotor Domain

Human Threats
Analysis

Identification & Authentication
Receiving
Responding
Value Complex
Application
Psychomotor Domain

Implementation (Life Cycle)
Responding
Knowledge
Comprehension
Analysis
Synthesis

Incident Response
Receiving
Responding
Valuing
Organization
Value Complex
Comprehension
Application
Synthesis
Evaluation
Psychomotor Domain

Industrial Espionage
Receiving
Responding
Valuing
Organization
Knowledge
Comprehension
Analysis
Psychomotor Domain

Industrial Security

Info Sys Security Program Budgeting
Responding
Valuing
Organization
Value Complex
Comprehension
Application
Analysis
Synthesis
Evaluation

Info Sys Security Program Planning
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Synthesis
Evaluation
Psychomotor Domain

Information Availability
Valuing
Value Complex
Knowledge
Comprehension

Information Categorization
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Information Classification
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Information Confidentiality
Valuing
Value Complex
Knowledge
Comprehension
Evaluation

Information Criticality
Valuing
Organization
Knowledge
Comprehension
Analysis

Information Security Policy
Receiving
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Synthesis
Evaluation
Psychomotor Domain

Information State
Receiving
Organization
Value Complex
Knowledge
Application
Analysis
Psychomotor Domain

Information Systems Security Officer
Receiving
Responding
Organization
Value Complex
Knowledge
Comprehension
Analysis
Evaluation
Psychomotor Domain

Information Valuation
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Application
Analysis
Evaluation
Psychomotor Domain

Insurance
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Analysis
Evaluation
Psychomotor Domain

Integrity
Valuing
Value Complex
Knowledge
Application
Analysis
Evaluation

Internal Controls and Security
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

International Espionage
Analysis

International Security Considerations
Receiving
Valuing
Organization
Knowledge
Comprehension
Analysis
Synthesis
Evaluation
Psychomotor Domain

INTERNET Security
Receiving
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Intrusion Detection
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Intrusion Deterrents
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

IS/IT Asset Valuation
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Application
Analysis
Evaluation
Psychomotor Domain

Key Management
Receiving
Value Complex
Application
Evaluation
Psychomotor Domain

Keystroke Monitoring
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Psychomotor Domain

Law Enforcement Interfaces
Receiving
Responding
Valuing
Value Complex
Application
Evaluation
Psychomotor Domain

Lessons Learned
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Analysis
Evaluation
Psychomotor Domain

Life Cycle System Security Planning
Responding
Valuing
Organization
Knowledge
Comprehension
Application
Synthesis
Evaluation
Psychomotor Domain

Local Area Network Security
Receiving
Responding
Valuing
Organization
Value Complex
Comprehension
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Low Power
Receiving
Valuing
Value Complex
Application
Analysis
Psychomotor Domain

Magnetic Remanance
Analysis

Malicious Code
Receiving
Responding
Valuing
Knowledge
Analysis

Management of the Security Function
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Analysis
Synthesis
Evaluation

Marking of Media
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Synthesis
Evaluation
Psychomotor Domain

Marking of Sensitive Information
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Synthesis
Evaluation
Psychomotor Domain

Masquerading
Analysis

Media Convergence
Valuing
Organization
Comprehension
Synthesis
Evaluation

Mobile Workstation Security
Receiving
Responding
Valuing
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Psychomotor Domain

Modems

Monitoring
Receiving
Valuing
Value Complex
Comprehension
Application
Analysis
Synthesis
Psychomotor Domain

National Information Infrastructure
(NII

Need-to-know Controls
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Application
Analysis
Evaluation
Psychomotor Domain

Network Security
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Network Topology
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Non-repudiation
Receiving
Valuing
Organization
Value Complex
Comprehension
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Object Reuse
Value Complex
Comprehension
Analysis

Off-site Security (Information.
Processing)

Operating Systems
Receiving
Valuing
Value Complex
Application
Analysis
Psychomotor Domain

Operations Security
Receiving
Responding
Valuing
Value Complex
Knowledge
Application
Analysis
Evaluation
Psychomotor Domain

Optical/Imaging Systems Security
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Psychomotor Domain

Oversight
Receiving
Responding
Valuing
Value Complex
Knowledge
Application
Evaluation
Psychomotor Domain

Password Management
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Synthesis
Evaluation
Psychomotor Domain

Personnel Security Policies and
Guidance
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Application
Evaluation
Psychomotor Domain

Physical Security
Receiving
Responding
Valuing
Value Complex
Knowledge
Application
Analysis
Evaluation
Psychomotor Domain

Policy Development
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Synthesis
Evaluation

Policy Enforcement
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Position Sensitivity
Receiving
Responding
Valuing
Value Complex
Knowledge
Evaluation

Power Controls (UPS. emergency
Power)
Receiving
Valuing
Value Complex
Application
Analysis
Psychomotor Domain

Preventive Controls
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Principles of Control

Privacy
Receiving
Responding
Valuing
Value Complex
Knowledge
Application
Analysis
Evaluation
Psychomotor Domain

Private Branch Exchange (PBX)
Security

Professional Interfaces
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Evaluation
Psychomotor Domain

Protected Distributed System
Organization
Value Complex
Comprehension
Application
Analysis
Synthesis
Psychomotor Domain

Protected Services

Protection from Malicious Code
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Quality Assurance
Receiving
Responding
Valuing
Value Complex
Knowledge
Application
Evaluation

Redundancy
Receiving
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Reference Monitor

Remanance
Application
Analysis

Risk Acceptance Process
Receiving
Responding
Valuing
Organization
Knowledge
Comprehension
Synthesis
Evaluation

Risk Assessment

Risk Management
Receiving
Responding
Valuing
Value Complex
Knowledge
Synthesis
Evaluation
Psychomotor Domain

Risks
Receiving
Organization
Knowledge
Comprehension
Analysis
Psychomotor Domain

Safeguards
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Psychomotor Domain

Safety
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Evaluation
Psychomotor Domain

Secure System Operations
Receiving
Responding
Valuing
Value Complex
Knowledge
Application
Synthesis
Evaluation
Psychomotor Domain

Security Architecture
Receiving
Valuing
Value Complex
Knowledge
Application
Evaluation
Psychomotor Domain

Security Awareness
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Synthesis
Evaluation
Psychomotor Domain

Security Education
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Synthesis
Evaluation
Psychomotor Domain

Security Products

Security Reviews
Receiving
Responding
Valuing
Value Complex
Knowledge
Synthesis
Evaluation

Security Training
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Evaluation
Psychomotor Domain

Sensitive System
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Application
Analysis
Evaluation
Psychomotor Domain

Separation of Duties
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Social Engineering
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Analysis
Synthesis
Evaluation
Psychomotor Domain

Software Asset Management
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Evaluation
Psychomotor Domain

Software Licensing
Valuing
Knowledge
Comprehension
Application

Software Piracy
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Psychomotor Domain

Software Security
Receiving
Responding
Valuing
Value Complex
Knowledge
Application
Analysis
Evaluation
Psychomotor Domain

Spoofing
Receiving
Valuing
Value Complex
Knowledge
Analysis

Standards

Standards of Conduct
Receiving
Responding
Valuing
Knowledge
Evaluation

Storage Media Protection and Control
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Technical Surveillance
Countermeasures
Receiving
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Psychomotor Domain

Technological Threats
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Application
Analysis
Psychomotor Domain

Technology Trends

Third-party Evaluation

Threat
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Application
Analysis
Psychomotor Domain

Transportation of Media
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Synthesis
Evaluation

Trust

Trusted Comp Sys Eval.
Criteria(Orange Bo

Trusted Network Interpretation (Red
Book

Unauthorized Disclosure of Information
Receiving
Responding
Valuing
Knowledge
Analysis

Voice Communications Security
Receiving
Responding
Valuing
Value Complex
Knowledge
Application
Analysis
Evaluation
Psychomotor Domain

Voice Mail Security
Receiving
Responding
Valuing
Value Complex
Knowledge
Application
Analysis
Evaluation
Psychomotor Domain

Vulnerability Analysis
Receiving
Responding
Valuing
Value Complex
Application
Evaluation
Psychomotor Domain

Warranties
Receiving
Responding
Valuing
Value Complex
Knowledge
Application
Psychomotor Domain

Wide Area Network Security
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Witness Interviewing/Interrogation
Receiving
Responding
Valuing
Value Complex
Knowledge
Application
Evaluation
Psychomotor Domain

Workstation Security
Receiving
Responding
Valuing
Value Complex
Knowledge
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Certification
Responding
Valuing
Organization
Value Complex
Comprehension
Synthesis
Evaluation
Psychomotor Domain

Access Authorization
Value Complex
Application
Synthesis
Psychomotor Domain

Access Control Software
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Application
Analysis
Psychomotor Domain

Alarms. Signals and Report
Receiving
Responding
Valuing
Value Complex
Knowledge
Application
Analysis
Psychomotor Domain

Acquisitions
Value Complex
Evaluation

Asynchronous & Synchronous commu-
nication
Comprehension

Attenuation
Comprehension

Binding/handshaking

Biometrics
Receiving
Responding
Valuing
Value Complex
Knowledge
Application
Analysis
Evaluation
Psychomotor Domain

Burst Transmission

Cabling
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Application
Analysis
Psychomotor Domain

Call-Back Security
Receiving
Responding
Valuing
Value Complex
Knowledge
Application
Analysis
Evaluation
Psychomotor Domain

Caller ID
Receiving
Valuing
Value Complex
Application
Evaluation
Psychomotor Domain

Circuit-switched Networks

Client/Server Security
Receiving
Responding
Valuing
Value Complex
Knowledge
Application
Analysis
Synthesis
Psychomotor Domain

Common Carrier Security
Receiving
Organization
Value Complex
Knowledge
Application
Analysis
Psychomotor Domain

Compartmented/partitioned Mode

Computer Emergency Response
Team(CERT)
Receiving
Valuing
Organization
Value Complex
Knowledge
Application
Analysis
Psychomotor Domain

Computer Science & Architecture

COMSEC Custodian
Receiving
Valuing
Organization
Value Complex
Knowledge
Analysis
Evaluation
Psychomotor Domain

COMSEC Material Identification &
Invent
Responding
Application
Evaluation

COMSEC Testing
Receiving
Responding
Valuing
Value Complex
Knowledge
Analysis

Conformance Testing
Receiving
Responding
Valuing
Value Complex
Knowledge
Analysis
Synthesis
Psychomotor Domain

Contingency Plan Testing
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Covert Channels
Analysis

Cryptographic Techniques
Receiving
Valuing
Organization
Value Complex
Comprehension
Application
Synthesis
Evaluation
Psychomotor Domain

Cryptovariable
Receiving
Value Complex
Comprehension
Application
Psychomotor Domain

Dedicated Line
Receiving
Valuing
Organization
Value Complex
Application
Evaluation
Psychomotor Domain

Dedicated Mode
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Psychomotor Domain

Dial Number Indicator
Receiving
Valuing
Value Complex
Application
Psychomotor Domain

Digital/Analog Technology

Diskless Workstations
Receiving
Value Complex
Comprehension
Application
Psychomotor Domain

Disaster Recovery Plan Testing
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Disaster Recovery Planning
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Discretionary Access Control
Receiving
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Synthesis
Psychomotor Domain

Distributed Systems Security
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Documentation
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Synthesis
Psychomotor Domain

Drop-off/Add-on Protection(Piggy
Backing
Receiving
Valuing
Value Complex
Application
Analysis
Psychomotor Domain

Electromagnetic Countermeasures
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Application
Analysis
Synthesis
Psychomotor Domain

Electromagnetic Interference
Valuing
Comprehension
Analysis
Psychomotor Domain

Electronic Data Interchange
Receiving
Valuing
Organization
Value Complex
Comprehension
Application
Synthesis
Evaluation
Psychomotor Domain

Electronic Key Management System
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Electronic Sources of Security
Information

Encryption Modes
Receiving
Valuing
Value Complex
Comprehension
Application
Psychomotor Domain

Error Logs
Receiving
Responding
Valuing
Value Complex
Application
Synthesis
Evaluation
Psychomotor Domain

Evaluation Techniques
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Psychomotor Domain

Expert Security/Audit Tools
Receiving
Responding
Valuing
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Psychomotor Domain

Expert Systems
Receiving
Responding
Valuing
Value Complex
Knowledge
Comprehension
Application
Analysis
Psychomotor Domain

Fault Tolerance
Receiving
Responding
Valuing
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Psychomotor Domain

Filtered Power
Receiving
Valuing
Value Complex
Comprehension
Application
Psychomotor Domain

Firmware Security
Receiving
Responding
Valuing
Value Complex
Knowledge
Application
Analysis
Synthesis
Psychomotor Domain

Formal Methods for Security Design
Receiving
Value Complex
Application
Psychomotor Domain

Frequency Hopping
Receiving
Valuing
Value Complex
Comprehension
Application
Psychomotor Domain

Grounding
Receiving
Value Complex
Application
Psychomotor Domain

Isolation and Mediation
Receiving
Valuing
Value Complex
Application
Synthesis
Psychomotor Domain

Jamming
Receiving
Organization
Value Complex
Knowledge
Comprehension
Analysis
Psychomotor Domain

Kernel
Receiving
Valuing
Organization
Value Complex
Comprehension
Application
Synthesis
Psychomotor Domain

Key Certificate Administration
Analysis

Labeling
Receiving
Value Complex
Comprehension
Application
Psychomotor Domain

Leased-line Networks
Receiving
Valuing
Organization
Knowledge
Comprehension
Analysis
Synthesis
Evaluation
Psychomotor Domain

Least Privilege
Receiving
Responding
Valuing
Value Complex
Knowledge
Comprehension
Application
Analysis
Psychomotor Domain

Line Authentication
Receiving
Value Complex
Comprehension
Application
Evaluation
Psychomotor Domain

Line of sight
Receiving
Value Complex
Comprehension
Application
Psychomotor Domain

List-based access controls
Receiving
Responding
Valuing
Value Complex
Knowledge
Comprehension
Application
Analysis
Psychomotor Domain

Logs and Journals
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Synthesis
Evaluation
Psychomotor Domain

Mandatory Access Control
Receiving
Valuing
Value Complex
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Memory (Non-volatile)
Receiving
Value Complex
Application
Psychomotor Domain

Memory (Random)
Receiving
Value Complex
Application
Psychomotor Domain

Memory (Sequential)
Receiving
Value Complex
Application
Psychomotor Domain

Memory (Volatile)
Receiving
Value Complex
Application
Psychomotor Domain

Message Authentication Codes
Receiving
Responding
Valuing
Value Complex
Application
Analysis
Psychomotor Domain

Microwave/Wireless Communications
Security
Receiving
Valuing
Organization
Value Complex
Comprehension
Application
Analysis
Synthesis
Psychomotor Domain

Modes of Operation
Receiving
Valuing
Value Complex
Application
Psychomotor Domain

Monitoring (e.g.. data. line)
Responding
Valuing
Organization
Value Complex
Comprehension
Synthesis
Evaluation

Multilevel Processing
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Multilevel Security
Receiving
Valuing
Value Complex
Comprehension
Application
Analysis
Synthesis
Psychomotor Domain

Network communications protocols
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Evaluation
Psychomotor Domain

Network Firewalls
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Application
Analysis
Synthesis
Psychomotor Domain

Network Monitoring
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Network Security Software
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Psychomotor Domain

Network Switching

Object Labeling
Receiving
Organization
Value Complex
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

One-time Passwords
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Psychomotor Domain

Open Systems Interconnect (OSI)
Model
Receiving
Valuing
Organization
Value Complex
Application
Analysis
Psychomotor Domain

Operating System Integrity
Receiving
Valuing
Value Complex
Knowledge
Application
Analysis
Evaluation
Psychomotor Domain

Operating System Security Features
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Packet Filtering
Valuing
Value Complex
Application
Analysis
Evaluation

Packet-switched Networks

Peer-to-Peer Security
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Penetration Testing
Valuing
Value Complex
Application
Synthesis
Evaluation
Psychomotor Domain

Platform-specific Security
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Private Key Cryptology
Receiving
Responding
Valuing
Value Complex
Knowledge
Application
Analysis
Psychomotor Domain

Private Networks

Privileges (Class. Nodes)
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Application
Analysis
Evaluation
Psychomotor Domain

Protective Technology

Public Key Encryption
Receiving
Responding
Valuing
Value Complex
Knowledge
Application
Analysis

Remote Terminal Protection Devices
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Psychomotor Domain

Role-based Access Controls
Receiving
Valuing
Organization
Value Complex
Knowledge
Application
Analysis
Evaluation
Psychomotor Domain

Rules-based Access Control
Receiving
Valuing
Organization
Value Complex
Knowledge
Application
Analysis
Evaluation
Psychomotor Domain

Satellite Communications Security
Receiving
Valuing
Value Complex
Knowledge
Application
Evaluation
Psychomotor Domain

Security Domains

Security Product Integration
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Security Product Testing/Evaluation
Analysis

Shielded Enclosures
Valuing
Value Complex

Single Sign-on
Receiving
Responding
Valuing
Value Complex
Knowledge
Application
Analysis
Psychomotor Domain

Smartcards/Token Authentication
Receiving
Responding
Valuing
Value Complex
Knowledge
Application
Analysis
Evaluation
Psychomotor Domain

Software Engineering

Space Systems Security

Spread Spectrum Analysis

Standalone Systems and Remote
Terminals
Responding
Valuing
Organization
Value Complex
Knowledge
Evaluation

System Software Controls

System Testing and Evaluation Process

System-high Mode
Receiving
Valuing
Value Complex
Application
Evaluation
Psychomotor Domain

Systems Security Engineering

TEMPEST
Receiving
Value Complex
Application
Psychomotor Domain

Validation (Testing)
Analysis

Value-added Networks
Analysis

Verification and Validation Process
Analysis

Wide Area Networks
Analysis

Account Administration
Receiving
Value Complex
Knowledge
Application
Psychomotor Domain

Agency-Specific Security Policies
Receiving
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Synthesis
Evaluation
Psychomotor Domain

Basic/Generic Management Issues
Receiving
Responding
Valuing
Organization
Knowledge
Comprehension
Analysis
Synthesis
Evaluation
Psychomotor Domain

Business Aspects of Information
Security
Receiving
Valuing
Organization
Knowledge
Comprehension
Analysis
Synthesis
Evaluation
Psychomotor Domain

Classified Materials(e.g. Handling and
Security)
Responding
Valuing
Knowledge

COMSEC Material Identification &
Inventory
Receiving
Responding
Valuing
Value Complex
Knowledge
Application
Psychomotor Domain

Contracts, Agreements & Other
Obligation
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Application
Synthesis
Evaluation
Psychomotor Domain

Customer IT Security Needs
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Customer Service Orientation
Receiving
Responding
Valuing
Organization
Value Complex
Comprehension
Application
Analysis
Synthesis
Evaluation

Emergency Destruction Procedures
Receiving
Responding
Valuing
Organization
Value Complex
Comprehension
Application
Synthesis
Evaluation
Psychomotor Domain

Evidence Collection and Preservation
Responding
Evaluation

Facilities Management
Responding
Value Complex

Guidelines
Receiving
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Synthesis
Evaluation
Psychomotor Domain

Information Ownership
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Analysis
Psychomotor Domain

Information Resource Owner/Custodian
Receiving
Responding
Organization
Value Complex
Knowledge
Analysis
Psychomotor Domain

Information Sensitivity
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Investigation of Security Breaches
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Investigative Authorities
Receiving
Valuing
Organization
Knowledge
Comprehension
Analysis
Synthesis
Evaluation
Psychomotor Domain

Legal and Liability Issues
Receiving
Responding
Valuing
Organization
Knowledge
Comprehension
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Off-site Security (Information.
Processing)
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Psychomotor Domain

Org.. Placement of the IS/IT Security
Functions
Valuing
Organization
Value Complex
Knowledge
Comprehension
Synthesis
Evaluation

Organizational Culture
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Synthesis
Evaluation

Practices
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Procedures
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Roles and Responsibilities
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Security Staffing Requirements
Responding
Valuing
Value Complex
Knowledge
Synthesis
Evaluation

Security Violations Reporting Process
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Storage Area Controls
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Zone of Control/Zoning
Receiving
Responding
Valuing
Value Complex
Knowledge
Application
Synthesis
Evaluation
Psychomotor Domain

Application Development Control
Valuing
Organization
Value Complex
Knowledge
Application
Synthesis

Cover and Deception
Application

Identification & Authentication
Value Complex
Comprehension
Analysis

Inference
Value Complex
Comprehension
Analysis

Inference Engine
Receiving
Value Complex
Application
Psychomotor Domain

Information Integrity
Valuing
Value Complex
Knowledge
Comprehension
Evaluation

Lattice Model
Valuing
Organization
Value Complex
Application
Analysis
Synthesis
Evaluation
Psychomotor Domain

Non-inference Model
Receiving
Value Complex
Application
Psychomotor Domain

Open Systems Security
Receiving
Valuing
Organization
Value Complex
Comprehension
Application
Analysis
Synthesis
Psychomotor Domain

Rainbow Series
Application

TCSEC/ITSEC/Common Criteria

Auditing Tools
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Application
Analysis
Psychomotor Domain

Automated Security Tools
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Application
Analysis
Psychomotor Domain

Classified Materials(e.g.. Handling and
Sh
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Application
Analysis
Psychomotor Domain

Entrapment
Receiving
Valuing
Value Complex
Knowledge

Evidence Acceptability

Human Intelligence (HUMINT)
Receiving
Value Complex
Application
Psychomotor Domain

Metrics
Receiving
Responding
Valuing
Value Complex
Knowledge
Application
Analysis
Psychomotor Domain

Off-site Security (Information,
Processing)
Receiving
Responding
Valuing
Organization
Value Complex
Knowledge
Comprehension
Application
Synthesis
Evaluation
Psychomotor Domain

Traffic Analysis
Receiving
Valuing
Value Complex
Application
Evaluation
Psychomotor Domain

Reconciliation
Receiving
Responding
Valuing
Organization
Knowledge
Analysis
Evaluation
Psychomotor Domain

Contractor Security Standards
      P.L. 100-235
      Under U.S. Code 5 CFR Part 930 subpart C.
     FISSEAÑFederal Information Systems Security EducatorsO Association
     Both DACUM I and DACUM II teams had problems with the End User category since it represents another view of the same
individuals Ñ everyone is an Oend user.O
     Note that the Todd model mixed functions and level in the Audience Category.
     Held at Baltimore, May 1993.
     The OOtherO category was often referred to as the unknown god . This is from the Classic Greek tradition of offering the first
toast at the party to the unknown gods. The theory here was that if there were a god they had not yet identified, they would not
insult him/her.  Several others have been proposed and may be added in the future.
     One characteristic of ETCORP DACUM exercises is that they are open-ended. We expect to have suggestions made to this
living document.
     Schou, Corey D., Integrating Information Security, Center for Decision Support, Report 162, Idaho State University, Pocatello,
ID 83205-4043
     From five known attempts to date
     A benchmark
     July, 1993, DACUM II project conducted at the Center for Decision Support at  Idaho State University, under the auspices of
the Federal Information Systems Security EducatorsO Association.
     Schou, Corey D., Maconachy,  W.V., and Frost, J. OOrganizational Information Security: Awareness, Training and Education
to Maintain Systems Integrity,O Proceedings of the Ninth International Computer Security Symposium,  Toronto, Canada. May,
1993.
     A special note of appreciation is extended to Mr. John Tressler, U.S. Department of Education who shared the results of his re-
search and compilation of existing INFOSEC KSAs and CBKs.
     This is from the Classic Greek tradition of offering the first toast at the party to the unknown gods. The theory here was that if
there were a god they had not yet identified, they would not insult him/her.
DACUM III THE UNIFIED CURRICULUM

67






DACUM III THE UNIFIED CURRICULUM