The processes of granting security clearances to people and accrediting trusted computer systems are compared, both informally and using preliminary mathematical models of risk probabilities. The risk models support the validity of two hypotheses that were previously merely conjectures: (1) in determining an acceptable accreditation range for a computer one need only consider the highest classification of data on it and the least-cleared person using it, (2) that under suitable conditions a cascade (combination) of two trusted systems can be trusted more than either individually. In particular, it is shown that a cascade of two (independently built) B2 systems is as good as one B3 system.>

Government research, development, and standardization efforts in computer security have been repeatedly criticized as not being applicable to the commercial world. In particular, they have been criticized as not being able to support the kinds of security policies, such as separation of duties and well-formed transactions, used by the financial and other communities to control unauthorized changes to or falsification of information. It is shown two natural extensions-integrity categories and partially trusted subjects-of the principles of current US Department of Defense computer security standards could be used to implement such commercial security policies in a way that exploits the fundamental strengths of existing or future trusted systems.>