Page 247 - CISSO_Prep_ Guide

• Need clearance/privilege labels for
subjects (assigned by management
but implemented by system
administrators).
• Trusted path: a secure login or
authentication process that is not easily
compromised.
• Clipping: Setting the audit level by deciding
what to log or not log.
• Filtering: looking at a subset of the existing
logs
• Object reuse protection: protecting against
memory leakage and data remanence.
(residual data on magnetic media)

Evaluation criteria
• Certification: the solution meets the
requirements. Certification is the sign off by
IT staff that a solution meets the current
requirements.
• Accreditation: management approval. It
includes management’s permission to
implement and acceptance of risk.
• Trusted Computer System Evaluation Criteria
(TCSEC)
• Orange book (part of rainbow series)
• TCSEC only tests confidentiality
• Trusted Network Interpretation (TNI) – the
red book of the rainbow series. Applies
orange book principles to network systems.