Parallels are drawn between the problems and techniques associated with achieving high reliability, and those associated with the provision of security, in distributed computing systems. Some limitations of the concept of a Trusted Computing Base are discussed, and an alternative approach to the design of highly secure computing systems is put forward, based on fault tolerance concepts and techniques.

At the Children's Services Planning Group, our task is to find a way of integrating all the various specialist agencies that provide support for children with problems or special needs, so that children and their families see us operating as a team, working together with the best interest of the child at heart, instead of the old way of doing things in which each agency operated within the narrow confines of its own professionalism. The trouble is, we don't really know how to do this. We have many years' experience of not talking to each other or sharing budgets, and changing this does not come easily. An information system might help us to overcome our communication difficulties, but we don't know what sort of system we want or how we will be able to make sense of it so that it will help us in our task of supporting an integrated service delivery that crosses organisational and professional boundaries. There are three major problems that we are beginning to solve. The first is ontological heterogeneity: different services have different constructions of 'the child' and it is only just becoming clear how it can be determined whether the various constructions are compatible. The second is ethical conflict: different professions have differing ethical codes, and these codes are incompatible. The third is epistemological uncertainty: we are only beginning to find out what the structure of the problem space might be, let alone knowing how to design what might constitute a solution. Even thinking of the situation in terms of a problem/solution dichotomy is unhelpful, and may well be deconstructive. None of these is a new problem of course, but their combination is such as to make the design of the research plan itself a research task.

The most crucial aspect of software engineering is the gathering of requirements. Increasing the amount of time and improving the quality of effort expended at this stage will lead to fewer and more manageable problems later on in the development life-cycle. The purpose of this paper is to highlight one of the most crucial problems that afflict user organizations when engaging in IT systems: the problem that the requirements for the system may change and evolve during the construction of the system. What we propose in this paper is a framework in which evolving and emerging requirements can be dealt with in an iterative manner within a method constructed upon a user-centered design philosophy. This paper is a presentation of recent developments made in the ORDIT project which was reported on last year.>

When a technical system is placed in a social context organisational requirements arise in addition to the functional requirements on the system.Security is a good example of such an organisational requirement.A means of identifying these organisational requirements is needed and also a way of specifying them that is meaningful both to users and systems designers.This paper proposes that the concept of responsibility fills both these needs.Responsibilities embody requirements in that the responsibility holder needs to do things, needs to know things and needs to record things for subsequent audit.These needs form the basis of a 'need-to-know' security policy.Furthermore a model of responsibilities describes the context within the organisational structure in which the requirements, including those related to security, arise.

The difficulty of handling changing requirements within traditional development processes is described. The origins of changing user and organizational requirements are discussed and different types are classified. The author identifies a number of ways in which different approaches to design may help to deal with change as well as mechanisms which should underpin effective communication between users and designers.>

The authors describe the ORDIT approach to requirements identification and expression within the context of organization change. ORDIT focuses on the representation of organizational requirements in the design of socio-technical systems which are intended to emphasize the relationships between organizational structure and information technology (IT) systems. The five main components of the ORDIT methodology are discussed, with a focus on the process model and the enterprise model. A process model is a model of the process of eliciting and modeling requirements. One of the main characteristics of the ORDIT process model is the way it has separated these two functions and has shown the relation between them. The ORDIT project has devised an enterprise modeling language to represent the structure of the organization to serve two related but distinct purposes: to determine the requirements owners and their positions and roles within the organization; and to determine the users and their roles and responsibilities within the organization.>

We consider the distinction between the terms 'safety' and 'security' in terms of the differences in causal structure and in terms of the differences in the degree of harm caused. The discussion is illustrated by an analysis of a number of cases of system failure where the safety and security issues seem, at least at first sight, to be difficult to disentangle.

The authors first describe some issues that arise from the interplay between the security requirements for an integrated project support environment (IPSE) for the development of a trusted system, and the security requirements of the trusted system itself. All of these issues derive from security policy and the modeling of security policy. A framework is then presented which allows security policies to be expressed in the context of the enterprise whose needs the trusted system is intended to serve. Finally some possible applications of the framework are used to indicate how security policies affect design decision-making, security policy conflict detection, and security risk evaluation.>

Parallels are drawn between the problems and techniques associated with achieving high reliability, and those associated with the provision of security, in distributed computing systems. Some limitations of the concept of a Trusted Computing Base are discussed, end an alternative approach to thedesign of highly secure computing systems is put forward,based on fault tolerance concepts and techniques.