The process of limiting access to the resources of an IS only to authorized users, programs, processes, or other

 systems. System-specific policy is often implemented through the use of access controls. For example, it may be a

 policy decision that only two individuals in an organization are authorized to run a check-printing program. Access

 controls are used by the system to implement (or enforce) this policy.

Accreditation authority or Designated

Approving Authority (DAA)

Official with the authority to formally assume responsibility for

 operating an IS or network at an acceptable level of risk.

Chronological record of system activities to enable the construction,

 and examination of the sequence of events and/or changes in an

 event. An audit trail may apply to information in an IS, to message

 routing in a communications system, or to the transfer of COMSEC

 material.

Comprehensive evaluation of the technical and non-technical

 security features of an IS and other safeguards, made in support of

 the accreditation process, to establish the extent to which a

 particular design and implementation meets a set of specified

security requirements.

Unintentional signals that, if intercepted and analyzed, would

 disclose the information transmitted, received, handled, or

 otherwise processed by telecommunications or automated

 information systems equipment (See TEMPEST).

A machine capable of accepting data, performing calculations on,

 or otherwise manipulating that data, storing it, and producing new

data.

A computer system that is characterized by dedicated operators (beyond the

system users); high capacity, distinct storage devices; special environmental

considerations; and an identifiable computer room or complex

Process of controlling modifications to a telecommunications or information systems

hardware, firmware, software, and documentation to ensure the system is protected

against improper modifications prior to, during, and after system implementation

[image] The management of security features and assurances through control of changes

made to hardware, software, firmware, documentation, test, test fixtures, and test

documentation of an IS throughout the development and operational life of the

system

Login procedures, audit of security-relevant events, and resource isolation as

prescribed for class C2 in DoD 5200.28-STD, often referred to as the “Orange Book”.

An action, device, procedure, technique, or other measure that reduces the

vulnerability of an IS.

Protection of data from unauthorized (accidental or intentional)

modification, destruction, or disclosure

An administrative procedure resulting in a determination that classified information

formerly stored on a magnetic medium has been removed or overwritten sufficiently

to permit reuse in an unclassified environment.

Result of any action or series of actions that prevents any part of a

telecommunications system or IS from functioning. Denial is the term used

throughout the course and respective references

Document containing basic requirements and evaluation classes for assessing

degrees of effectiveness of hardware and software security controls built into IS. This

document, DOD 5200.28 STD, is frequently referred to as the Orange Book.

Embedded (computer) system

Computer system that is an integral part of a larger system or subsystem that

performs or controls a function, either in whole or in part.

Protection resulting from all measures taken to deny unauthorized persons

information of value which might be derived from intercept and analysis of

compromising emanations from cryptographic equipment, ISs, and

telecommunications systems.

Software that is permanently stored in a hardware device that allows reading and

executing the software, but not writing or modifying it.

Documented approval by a data owner to allow access to a particular category of

information

The protection of systems and information in storage, processing, or transit from

unauthorized access or modification; denial of service to unauthorized users; or the

provision of service to authorized users. It also includes those measures necessary

to detect, document, and counter such threats. This regulation designates IA as the

security discipline that encompasses COMSEC, INFOSEC, and control of

compromising emanations (TEMPEST).

Integrity

A requirement that information and programs are changed only in a specified and authorized manner

System integrity

Local Area Networks (LAN)

The protection of networks and their services from unauthorized modification, destruction, or disclosure. Network security provides for assurance that a network performs its critical functions correctly and there are no harmful side effects.

Process of analyzing threats to and vulnerabilities of an information system, and determining potential adverse effects that the loss of information or capabilities of a system would have on national security and using the analysis as a basis for identifying appropriate and cost-effective countermeasures.

Security Operating Modes

A categorization of computer systems according to the security protection they provide. Determination of the security processing mode of an IS is based on the classification or sensitivity and the formal categories of data processed and the clearance, formal access approval, and need-to-know of users of the system. There are four security-operating modes.

Multilevel mode

Processing, transmission, storage, or data is handled across different information categories with "simultaneous" access by individual users or processes. (All users and processes may not have the same clearances or need to know. Access controls are different for each user and process.)

Dedicated mode

Processing, transmission, or storage is within a single information category. (All users and processes have a valid security clearance for all processes and data, and all users or processes have the same need to know. Access controls are equal for all users and processes.)

Compartmented mode

Processing, transmission, storage, or data is handled across different information categories with single-level access by individual users or processes at any "given time." (All users and processes have a valid clearance for the most restricted information processed in the system, and a valid need-to-know for the information that the user or process will have access. Access controls are different for each user and process.)

Systems high mode

Processing, transmission, storage, or data while actually across different information categories, is handled as if it were in a single information category or processing domain. (All users and processes have valid security clearance to all processes and data. All users and processes may not have the same need to know. Access controls are equal for all users and processes.)

Systems Security

There are three parts to Systems Security.

a. Computer Security (COMPUSEC) is composed of measures and controls that protect an IS against denial of service, unauthorized disclosure, modification, or destruction of IS and data (information).

b. Communications Security (COMSEC) is measures and controls taken to deny unauthorized persons information derived from telecommunications of the U.S. government. Government communications regularly travel by computer networks, telephone systems, and radio calls.

c. Information Security (INFOSEC) is controls and measures taken to protect telecommunications systems, automated information systems, and the information they process, transmit, and store