2. Chapter 18: Introduction to Assurance Dr. Wayne Summers Department of Computer Science Columbus State University Summers_wayne@colstate.edu http://csc.colstate.edu/summers

3. 2 Assurance and Trust  An entity is trustworthy if there is sufficient credible evidence leading one to believe that the system will meet a set of given requirements. Trust is a measure of trustworthiness, relying on the evidence provided.  Security assurance, is confidence that an entity meets its security requirements, based on specific evidence provided by the application of assurance techniques.  Information assurance – ability to access information and preserve the quality and security of that information.  Trusted system – system that has been shown to meet well-defined requirements under an evaluation by a credible body of experts who are certified to assign trust ratings

4. 3 Assurance, policy, and mechanisms Policy ^ | Assurance | v Mechanisms  Statement of requirements that explicitly defines the security expectations of the mechanism(s)  Provides justification that the mechanism meets policy through assurance evidence and approvals based on evidence  Executable entities that are designed and implemented to meet the requirements of the policy

5. 4 Need for Assurance  Problem sources –Requirements definitions, omissions, and mistakes –System design flaws –Hardware implementation flaws –Software implementation errors, program bugs, compiler bugs –System use and operation errors, inadvertent mistakes –Willful system misuse –Hardware, communication, equipment malfunction –Environmental problems, natural causes, acts of God –Evolution, maintenance, faulty upgrades, decommissions

6. 5 Assurance and Trust  Requirement – statement of goals that must be satisfied  Policy assurance – evidence establishing that the set of security requirements in the policy is complete, consistent, and technically sound.  Design assurance – evidence establishing that a design is sufficient to meet the requirements of the security policy  Implementation assurance - evidence establishing that a implementation is sufficient to meet the requirements of the security policy  Operational/administrative assurance - evidence establishing that the systems sustains the security policy requirements during installation, configuration, and day- to-day operation

7. 6 Building Secure and Trusted Systems  Life Cycle –Conception (proof of concept) –Manufacture –Deployment –Fielded Product Life  Waterfall Life Cycle Model –Requirements Definition and Analysis –System & Software Design –Implementation and Unit Testing –Integration and Systems Testing –Operation and Maintenance

8. 7 Other Models of Software Development  Exploratory Programming  Prototyping  Formal Transformation  Systems Assembly from Reusable Components  Extreme Programming