JOS Orange Book Security Requirements - HTML Draft, 11/11/97

references,
  Computer Security Basics, Deborah Russell and G. T. Gangemi Sr.
  Department of Defense Trusted Computer System Evaluation Criteria, TCSEC DOD 5200.28-STD

compiled by, Ray Shpeley © 1997

`http://jos.org`
for JOS org use only

This document outlines Orange Book security requirements as defined under the US National Computer Security Center's Technical Guidelines Program publication, Department of Defense Trusted Computer System Evaluation Criteria and how they apply to JOS. It focuses on secrecy and has limited applicability to the principles of accuracy, availability and authenticity.

Networking concerns are covered in a (to be released) companion paper on JOS Red Book Requirements.

Implementation issues and examples of Orange Book requirements are covered in the Rainbow Series of books.

US residents may order copies from,

  Director, National Security Agency
  INFOSEC Awareness
  Attention: X71
  9800 Savage Road
  Fort George G. Meade, MD 20755-6000
  (301) 766-8729

Scaling concerns are important to JOS requirements. JOS must be scalable from minimal security to the Orange Book B1 class (the B1 security class has been chosen as an example security requirement for a JOS intranet/internet server application). At the B2 class and above, documentation, assurance and delivery considerations become predominant. These are outside the current scope of JOS requirements and are mentioned for reference purposes only.

The Orange Book requirements outline only a portion of all available security requirements classes. These classes are diverse, with many overlapping requirements. The Orange book provides a concise and organized definition of security requirements classes and for this reason it was chosen as a basis for this reference document. A good understanding of the Orange Book security classes provides a framework for understanding other security requirements classes.

Some JOS requirements dependancies are discussed as requirements considerations.

The glossary contains detailed descriptions of the terms used throughout this document.

The Orange Book

Computer security encompasses many aspects of security: locking the computer room and machine, protecting login accounts with passwords, using file protection to keep data from being destroyed, encrypting network communications lines, and using special shields to keep electromagnetic emanations from leaking from the computer. These are all necessary computer security considerations. In contrast this document focuses on computer system security.

The four primary methods of protection in computer system security are system access controls, data access controls, system security and administration, and system design. Attacks by viruses, worms, trojan horses, bombs, trap doors, spoofs and other forms of malicious logic, while system security issues, are beyond the scope of this document.

The Orange Book defines four broad heirarchal divisions of security protection. In increasing order of trust, they are minimal security, discretionary protection, mandatory protection and verified protection.

The purpose of the Orange Book is to outline evaluation criteria with the objectives of measurement, guidance and acquisition. These criteria constitute a uniform set of basic requirements and evaluation classes for assessing the effectiveness of security controls built into systems.

While many efforts have been made in the Orange Book to construct secure operational environments, there is an inherent weakness in the mathematical formal proof concept of the B3 and A1 levels. According to Godel's Incompleteness Theorem, no algorithm, or calculational procedure, that uses mathematical proofs can prove its own validity. That isn't to say that the formal models of the B3 and A1 levels are not successful - just that they are flawed in their concept.

Security is a human endeavour. As such, when designing secure environments we must be aware that every design will eventually be broken, and that it is vigilance which is the real security.

The O'Reilly and Associates book, Computer Security Basics by Deborah Russell and G. T. Gangemi Sr., is an excellent first resource for computer security. While this document provides an introduction and reference to the Orange Book, the O'Reilly book covers many other salient points not addressed here.

Orange Book Evaluation Classes

The Orange Book evaluation classes are:

  D - minimal security,
  C1 - discretionary security protection,
  C2 - controlled access protection,
  B1 - labeled security protection,
  B2 - structured protection,
  B3 - security domains,
  A1 - verified design.

Evaluations must be performed for systems with particular configurations on particular platforms. A system such as UNIX cannot be evaluated apart from its implementation on a particular piece of hardware.

Trusted Computer System Evaluation Criteria Summary Chart

The following chart is adapted from the book, Computer Security Basics, by Deborah Russell and G. T. Gangemi Sr.

Security Policy | C1 | C2 | B1 | B2 | B3 | A1
--- | --- | --- | --- | --- | --- | ---
discretionary access control | 1 | 2 | * | * | 3 | *
object reuse | · | 4 | * | * | * | *
labels | · | · | 5 | 6 | * | *
label integrity | · | · | 7 | * | * | *
exportation of labeled information | · | · | 8 | * | * | *
exportation to multilevel devices | · | · | 9 | * | * | *
exportation to single-level devices | · | · | 10 | * | * | *
labeling human-readable output | · | · | 11 | * | * | *
mandatory access control | · | · | 12 | 13 | * | *
subject sensitivity labels | · | · | · | 14 | * | *
device labels | · | · | · | 15 | * | *
Accountability | C1 | C2 | B1 | B2 | B3 | A1
identification and authentication | 16 | 17 | 18 | * | * | *
audit | · | 19 | 20 | 21 | 22 | *
trusted path | · | · | · | 23 | 24 | *
Assurance | C1 | C2 | B1 | B2 | B3 | A1
system architecture | 25 | 26 | 27 | 28 | 29 | *
system integrity | 30 | * | * | * | * | *
security testing | 31 | 32 | 33 | 34 | 35 | 36
design specification and verification | · | · | 37 | 38 | 39 | 40
covert channel analysis | · | · | · | 41 | 42 | 43
trusted facility management | · | · | · | 44 | 45 | *
configuration management | · | · | · | 46 | * | 47
trusted recovery | · | · | · | · | 48 | *
trusted distribution | · | · | · | · | · | 49
Documentation | C1 | C2 | B1 | B2 | B3 | A1
security features user's guide | 50 | * | * | * | * | *
trusted facility manual | 51 | 52 | 53 | 54 | 55 | *
test documentation | 56 | * | * | 57 | * | 58
design documentation | 59 | * | 60 | 61 | 62 | 63

· | no requirements for this class
# | new or enhanced requirements for this class
* | no additional requirements for this class

refer to the Orange Book glossary for an explanation of each term