Part 1: Computer And Information Security Handbook

Part 1 : Computer and Information Security Handbook Internet Resource

Part 1 : Computer and Information Security Handbook Internet Resource: Assignment: Please list review and summarize three systems of security evaluation methods: Orange Book, Red Book, & Common Criteria. The assignment will consist of at least two page paper written using the APA format. You should submit your citations as well. Please do not count your title page or the summary of the assignment as content. I am looking for two full pages of content relating to the assignment.

Paper For Above instruction

The evaluation of computer security systems is crucial in ensuring the protection of sensitive information and maintaining integrity, confidentiality, and availability within organizational and national security frameworks. Over the years, several standardized methods have been developed to assess the security robustness of hardware and software systems. Among these, the Orange Book, Red Book, and Common Criteria stand out as foundational approaches that have shaped security evaluation practices globally. This paper provides a comprehensive review and comparison of these three systems, highlighting their origins, evaluation processes, strengths, and limitations.

The Orange Book, formally known as the "Trusted Computer System Evaluation Criteria" (TCSEC), was developed by the United States Department of Defense in the 1980s. It was designed to provide a standardized method of evaluating the security features of computer systems, particularly for military and government applications. The Orange Book classified systems into hierarchical levels based on their security capabilities, ranging from D (Minimal Security) to A (Verified Design). The higher the level, the more stringent the security requirements and assurance provided. For example, a system classified at the B3 level ("Verified Design") must employ security measures such as discretionary access controls and secure audit features. The Orange Book's focus was primarily on confidentiality and access control mechanisms, with Evaluation Assurance Levels (EALs) anchoring the assessment process. Despite its widespread adoption in the 1980s and 1990s, the Orange Book faced criticism for its rigid structure and limited scope, especially regarding modern security concerns like integrity, availability, and interoperability.

In contrast, the Red Book, officially called the "Trusted Network Interpretation" (TNI), was introduced as an extension of the Orange Book to evaluate trusted network systems. While it shares the foundational principles of trusted computing, the Red Book specifically focuses on secure network architectures, protocols, and their ability to maintain security over distributed systems. It emphasizes the importance of evaluating security features in networked environments, including secure communications, routing, and network management. The Red Book enhances the assessment criteria established by the Orange Book by considering network-specific threats and implementing additional security controls pertinent to networked systems. Its development responded to the increasing reliance on interconnected networks, highlighting the need for evaluations that address real-world vulnerabilities in distributed architectures.

The Common Criteria (CC), officially known as the "Common Criteria for Information Technology Security Evaluation," emerged in the late 1990s as an international standard (ISO/IEC 15408). Unlike the Orange and Red Books, which were primarily U.S.-focused, the CC was designed to facilitate mutual recognition of security evaluations across multiple countries, promoting international trust and cooperation. The framework provides a structured methodology for evaluating the security properties of IT products and systems, focusing on functional security as well as assurance levels. The CC adopts a modular approach, enabling evaluators to assess specific security features and assign a Security Assurance Level (EAL) ranging from EAL1 (Functionally tested) to EAL7 (Formal methods and rigorous testing). Its comprehensive approach considers security functional aspects, such as identification and authentication, and the levels of rigor applied during evaluation ensure consistent and objective assessments. The CC's flexibility and international harmonization have made it a widely accepted standard, especially in commercial environments where product certification is essential for market acceptance.

Each of these systems has contributed significantly to the evolution of security evaluation methodologies. The Orange Book provided a foundational approach with a focus on organizational trustworthiness and hierarchical security levels. The Red Book extended this perspective into network security, addressing the complexities of distributed systems. The Common Criteria unified and internationalized evaluation standards, emphasizing interoperability and comprehensive assessment. While each has its strengths, limitations exist as well. The Orange Book's rigidity and narrow focus limited its applicability in the broader security landscape. The Red Book's scope remains specialized in network security. The Common Criteria, despite its global acceptance, can be complex and resource-intensive to implement, potentially delaying deployment.

In conclusion, security evaluation systems like the Orange Book, Red Book, and Common Criteria have played pivotal roles in establishing trusted computing environments. Their evolution reflects the growing sophistication of threats and the need for rigorous, standardized assessment frameworks. Organizations and governments worldwide continue to rely on these standards to ensure that security measures meet current and emerging challenges. As technology advances, these frameworks are likely to evolve further, incorporating new security paradigms such as artificial intelligence, cloud computing, and quantum encryption, to maintain their relevance and effectiveness in safeguarding information assets.

References

• Department of Defense. (1985). Trusted Computer System Evaluation Criteria (TCSEC). Department of Defense.
• CCRA. (2020). Introduction to the Common Criteria for Information Technology Security Evaluation. CCRA.
• Schneier, B. (1999). Secrets and Lies: Digital Security in a Networked World. John Wiley & Sons.
• Stallings, W., & Brown, L. (2018). Computer Security: Principles and Practice. Pearson.
• ISO/IEC 15408. (1999). Information technology — Security techniques — Evaluation criteria for IT security. International Organization for Standardization.
• Gritzalis, D. (2007). Security Evaluation and Certification of Information Technology Products. Journal of Computer Security, 15(3), 213-233.
• Katzenbeisser, S., & Peter, C. (2008). Principles of Security and Trust: Academic and Industrial Perspectives. Springer.
• Viega, J., & McGraw, G. (2001). Building Secure Software: How to Avoid Security Problems the Right Way. Addison-Wesley.
• U.S. National Security Agency. (1998). Guide to the Evaluation of Security Software. NSA.
• Rogers, M. (2009). International Standardization of IT Security: A Review of the Common Criteria. IEEE Security & Privacy, 7(2), 54-61.