Conventional approaches to building and assessing securitycritical software are based on the implicit assumption that security is the single most important concern and can be the primary factor driving the software development process. Changes in the marketplace and the nature of security requirements have brought this assumption into question. There is now a large class of systems in which security must compete with other development goals. A risk-driven process model of software development provides a framework for building software that balances conflicting requirements. But a risk-driven process invalidates many of the assumptions made by conventional approaches to the specification and verification of security requirements. This paper presents a new approach to assessing the degree to which software meets its security requirements. It does not propose a new specification notation or analysis technique, but provides a general framework into which existing notations and techniques ...

This paper summarizes the affirmative argument supporting the proposition that "the concept of the trusted computing base (TCB) as a basis for constructing systems to meet security requirements is fundamentally flawed and should no longer be used to justify system security architectures".

Information flow predicates are properties of sets of traces and therefore cannot be handled under the Alpem-Schneider framework and the Abadi-Lamport Composition Principle. McLean proposed a theory (1994) to investigate the composition properties of these predicates and derived a partial order on them. In this paper we present an alternate framework based on many-sorted predicate logic for specifying the information flow properties and show that this framework can be used to reason about the composition of such properties that is amenable to automated theorem proving.

With the rapid growth of the information age, open distributed systems have become increasingly popular.The need for protection and security in a distributed environment has never been greater.The conventional approach to security has been to enforce a system-wide policy, but this approach will not work for large distributed systems where entirely new security issues and concerns are emerging.We argue that a new model is needed that shifts the emphasis from "system as enforcer" to user-definable policies.Users ought to be able to select the level of security they need and pay only the necessary overhead.Moreover.ultimately, they must be responsible for their own security.This research is being carried out in the context of the Legion project.We start by describing the objectives and philosophy of the overall project and then present our conceptual model and design decisions.A set of technical challenges and related issues are also addressed.