The Internet ecosystem depended on the cooperation of Internet service providers, private network operators, users and vendors in order to keep the system functioning. In this environment, we boldly attempted to offer guidelines to this growing, diverse, largely cooperating ecosystem. They were a common set of voluntary rules for the successful and increasingly secure operation of the Internet. Security is understood to include protection of the privacy of information, protection of information against unauthorized modification, protection of systems against denial of service, and protection of systems against unauthorized access.

As the Internet becomes increasingly widely used and as individuals and businesses come to depend on it ever more, disruptions of service are less and less tolerable. Disruptions occur either because of a natural disaster, e.g., a fire or equipment failure, or because of a deliberate attack. Protecting against natural disasters is generally easier than protecting against malicious attacks. Our focus here is on the latter. Malicious attacks fall broadly into two classes. One class is penetration, whereby an unauthorized user gains access to one or more machines. Another class is denial-of-service attacks. In this paper, we analyze the nature and impact of this latter class of attacks and propose a method to reduce their threat and impact.

The LOCK definition of non-interference and the LOCK unwinding theorem provide a method of using a non-interference model in a system with an identified potential for interference. However, the LOCK work is presented in terms specific to the LOCK system. The authors generalize the LOCK definitions and theorems so that they could be used in systems other than LOCK that have specifically identified potentials for interference They state and prove a general winding theorem for this purpose. They also show that the LOCK unwinding theorem follows from their general unwinding theorem.>

The vast range of security levels/compartments, complex ownership, continuous evolution, adaptive policy requirements, and the large size of battle management systems (BMSs) make it evident that the trust issues are substantial and will require extensive attention throughout the development cycle of the system. The authors outline the software development process for a BMS and identify where trusted system development requirements fit into the process. The focus is on the identification and discussion of eight leverage points that cut across the entire development process and provide the greatest opportunity to affect the security of the software that is developed. These points are visibility, protocols, downloading, configuration control, monitoring and measurement, environment, communication, and verification.>

An approach for filtering out programs that make unauthorized modifications is outlined. The approach is based on formal specification and verification techniques, is fail-safe, and does not require any special architectural support.>

The FM8501 microprocessor was defined and verified by W.A. Hunt (1986) using the Boyer-Moore theorem-prover. The authors have carried out a reverification of the machine using the State Delta Verification System. Their work correlates strongly with work done by Hunt, demonstrating that the verification community is capable of supporting its own results, drawing on the diversification of proof tools to provide independent validation of previous work. The proof strategies and the complexities that are encountered in proving correctness of microcoded processors are discussed.>

Information flow analysis algorithms for programs typically overestimate the amount of information flow that occurs in a program, since they must account for all paths through the computation graph, whether or not they are actually possible. This is the source of the information flow anomalies, which are simple situations not properly handled by syntactic information flow analysis. This paper introduces an abstract information content function for state machine models of programs, and applies it to the information firm analysis problem, in conjunction with a semantic analysis of functional behavior provided by a program verification system. Our method fits well within the framework of many existing program verification systems, requiring only a small amount of knowledge of set theory. Some of the more common information flow anomalies are shown to be handled correctly by the method.