1. S.S. Yau CSE465-591 Fall 2006 1 Classified Systems

2. S.S. Yau 2CSE465-591 Fall 2006 Classified Systems Early 1980s: DoD is concerned about the confidentiality of classified information on computers with multiple users (time sharing systems) Early 1980s: DoD is concerned about the confidentiality of classified information on computers with multiple users (time sharing systems) Mid 80s to mid 90s: Mid 80s to mid 90s: The Orange Book (or TCSEC): standard reference for computer security for DoD The Orange Book (or TCSEC): standard reference for computer security for DoD The Red Book: covering Trusted Network Interpretation (TNI) of the Orange Book The Red Book: covering Trusted Network Interpretation (TNI) of the Orange Book The whole “rainbow series” The whole “rainbow series” http://www.iwar.org.uk/comsec/resources/standards/rai nbow/rainbow.html http://www.iwar.org.uk/comsec/resources/standards/rai nbow/rainbow.html http://www.iwar.org.uk/comsec/resources/standards/rai nbow/rainbow.html http://www.iwar.org.uk/comsec/resources/standards/rai nbow/rainbow.html

3. S.S. Yau 3CSE465-591 Fall 2006 DoD Classification Scheme Data classification based on need for confidentiality Data classification based on need for confidentiality Levels based on potential damage if compromised, and defines treatment rules Levels based on potential damage if compromised, and defines treatment rules Top secret Top secret Secret Secret Confidential Confidential Unclassified Unclassified Unclassified includes Unclassified includes Sensitive But Unclassified (SBU); e. g., medical, salary, performance review data Sensitive But Unclassified (SBU); e. g., medical, salary, performance review data For Official Use Only (FOUO). Not subject to release under the Freedom of Information Act (FOIA). May include company proprietary information. For Official Use Only (FOUO). Not subject to release under the Freedom of Information Act (FOIA). May include company proprietary information.

4. S.S. Yau 4CSE465-591 Fall 2006 Classified Information Management Accountability for classified data Accountability for classified data Declassification/Downgrade Declassification/Downgrade Sanitization/Purging Sanitization/Purging Destruction Destruction

5. S.S. Yau 5CSE465-591 Fall 2006 References M. Merkow, J. Breithaupt, Information Security: Principles and Practices, Prentice Hall, August 2005, ISBN 0131547291 M. Merkow, J. Breithaupt, Information Security: Principles and Practices, Prentice Hall, August 2005, ISBN 0131547291 Matt Bishop, Introduction to Computer Security, Addison-Wesley, 2004, ISBN: 0321247442 Matt Bishop, Introduction to Computer Security, Addison-Wesley, 2004, ISBN: 0321247442 Matt Bishop, Computer Security: Art and Science, Addison- Wesley, 2002, ISBN: 0201440997 Matt Bishop, Computer Security: Art and Science, Addison- Wesley, 2002, ISBN: 0201440997