This paper provides an introspective retrospective on the history and development of the United States Department of Defense Trusted Computer System Evaluation Criteria (TCSEC). Known to many as the Orange Book, the TCSEC contained a distillation of what many researchers considered to be the soundest proven principles and practices for achieving graded degrees of sensitive information protection on multiuser computing systems. While its seven stated evaluation classes were explicitly directed to standalone computer systems, many of its authors contended that its principles would stand as adequate guidance for the design, implementation, assurance, evaluation and certification of other classes of computing applications including database management systems and networks. The account is a personal reminiscence of the author, and concludes with a subjective assessment of the TCSEC's validity in the face of its successor evaluation criteria.

Our thesis is that biometric and other intertwined technologies will be used to supplement the work of people in the security field. When these technologies are used, we fear that a high degree of misinterpretation and error is likely. Because of this, we need to identify the technical measures required for these systems. This thesis, along with a justification, and proof sketch, was given to the panelists.Five areas of the technology life-cycle were investigated: modeling, implementation, interpretation of results, database protection, and social issues.The format was simple. After the introduction, each panelist gave a brief presentation. Afterwards the workshop participated in a highly interactive and collegial way, with the panel chair keeping things orderly.A lively discussion resulted, with many good comments and questions from the NSPW attendees, some of which we report.

The basic question this panel has been asked to ponder is: Have New Security Paradigms Workshops been worth it? The subtext enquires whether NSPW participants have been wasting time and money by traveling to rustic remote sites to attempt to create new paradigms for addressing information security issues. What has been the Return On Investment (ROI)? Has NSPW had an Impact on the profession or practice?Holly Hosmer told us she originally conceived of NSPW after thinking about Thomas S. Kuhn's monumental opus The Structure of Scientific Revolutions, the 200 pages of which were originally published in 1962. This book has become the most often cited work in literature related to the sciences. Ms Hosmer's motivation came from Kuhn's observations that scientific progress and revolution are largely a social process. In essence,Paradigms, Kuhn suggests, are the basis of all science. Indeed, what we mean by science are the activities of a group of people (practitioners) who share a paradigm . Before a shared paradigm exists, Kuhn points out, there is no agreement about what is important and how scientists should proceed. In the absence of a paradigm or some candidate for paradigm, all of the facts that could possibly pertain to the development of a given science are likely to seem equally relevant. As a result, early fact-gathering is a far more nearly random activity than the one that subsequent scientific development makes familiar.Scientific revolutions, then, are the culmination of a recurrent process in the history of science, according to Kuhn. Paradigms give rise to normal science. At some point normal science gives rise to anomalies, which in turn give rise to a period of extraordinary science. If the outcome of this process is that a new paradigm replaces the old one, a scientific revolution is said to have occurred.I believe that NSPW has been of high value to its participants and, by extension, to the information security community. I have found a number of presentations to have been particularly beneficial. To name a few: Holly Hosmer on applications of Fuzzy Mathematics;David Bell and Holly Hosmer on multipolicy systems;Dixie Baker on the importance of PCs to finding solutions;Bob Blakely on rethinking/redefining the problem;Don Welch, Nathan Buchheit and Anthony Ruocco on staging military attacks on cyberattackers;Susan Pancho questioning the validity of deliberately perturbing secure protocols and then claiming to have found publishable flaws in the perturbed models;Jeff Williams, Marvin Schaefer and Doug Landoll on the utility of Pretty Good Assurance; and O so many more. The papers selected above were not all well-received at the time of presentation. Some proved to be very controversial, in fact, and at least one was interrupted so frequently during presentation that only a small portion of the written paper, which all could read at leisure, was ever presented and discussed at NSPW. At least in the past, NSPW's criteria for selection of papers was much more like that of traditional workshops as opposed to that for conferences and symposia. This has been precisely because NSPW has solicited new ideas, ideas for which not all the details have been worked out (if even identified). Selection had largely been based on: Novelty and originality; Likelihood that the paper would provide discussion and inspection of underlying concepts and beliefs; The likelihood that the discussion would advance understanding; The potential to inspire others.

This paper introduces a panel discussion on establishing assurance evidence that mobile code applications perform as expected by the user, without the side effects that have been demonstrated as possible in constructed examples of malicious or "rogue" applets. The paper's principal authors, Schaefer and Pinsky, have been engaged in cooperative research with the JavaSoft community to gain understanding of the complexities of assurance for mobile code applications. The paper discusses part of this on-going research. The panel adds the voices and experience of a continuing researcher, Dean, and of active practitioners from the principal vendors of mobile-code-enabled (and enabling) products. The panel actively debates the issues of providing compelling assurance evidence relating to the control of such code.

Changes in computer usage have significantly changed the so-called computer security, network security and information security problems. The changes are largely due to the rapid proliferation and interconnection of computers and the associated distribution of software. Of concern is the uncontrolled nature of this activity: systems and workstations are often interconnected without notice being given to all of the affected parties. The result has been increased user perception of breaches in "security", especially in the form of computer takeover, data destruction, or service denial by virus, worm or trapdoor. It is expected that consciousness of these problems, and of confidentiality compromises, will increase in the coming months. It is posited that a principal cause of the problem is willful promiscuity and a pronounced lack of mutual suspicion. The separation kernel concept is revisited as a potential practical means of improving security protections consistent with preserving the use of legacy systems and of commercial products.

This paper describes the need for pretty good assurance: clearly stated claims about the security properties of systems accompanied by evidence that explains in clear terms why we should believe that these claims are substantiated. Several different types of threats are identified and their relationships to assurance are explored. The developer's role in creating on assurance argument is distinguished from the user's role in consuming assurance. Finally, some thoughts on the future are presented.

Article Free Access Share on We need to think about the foundations of computer security Author: Marvin Schaefer CTA Incorporated, 6116 Executive Blvd., Suite 800, Rockville, Maryland CTA Incorporated, 6116 Executive Blvd., Suite 800, Rockville, MarylandView Profile Authors Info & Claims NSPW '92-93: Proceedings on the 1992-1993 workshop on New security paradigmsAugust 1993 Pages 120–125https://doi.org/10.1145/283751.283801Published:03 August 1993Publication History 2citation340DownloadsMetricsTotal Citations2Total Downloads340Last 12 Months9Last 6 weeks2 Get Citation AlertsNew Citation Alert added!This alert has been successfully added and will be sent to:You will be notified whenever a record that you have chosen has been cited.To manage your alert preferences, click on the button below.Manage my AlertsNew Citation Alert!Please log in to your account Save to BinderSave to BinderCreate a New BinderNameCancelCreateExport CitationPublisher SiteeReaderPDF

Summary form only given. An ongoing study of audit issues in the context of trusted database management systems (TDBMSs) is discussed. The study consists of a survey of the state of the art, an analysis of issues raised, and an assessment of future relevant research. The scope of the study is broad, and includes a variety of security policies and TDBMS architectures intended for commercial and defense applications. Issues of interest have included those associated with capture, storage, protection, reduction, and analysis of audit data. The study is based on extensive interviews with a number of researchers and product development groups and an examination of audit in its historical and trusted systems contexts. The authors have found that little guidance is provided for either what needs to be audited in TDBMS contexts or when, how, or even where audit data should be captured or recorded. They have found that audit objectives and implied requirements may be specific to each application and security policy. It has also been found that surprisingly little attention has been given in practice to the analysis of TDBMS audit data.>