Little prior knowledge is needed to use this long-needed reference. Computer professionals and software engineers will learn how to design secure operating. BUILDING A SECURE COMPUTER SYSTEM Morrie Gasser ACF2 is a trademark of Uccel Crop. AOS is a trademark of Data General Corp. DEC, PDP, VMS. : Building a Secure Computer System () by Morrie Gasser and a great selection of similar New, Used and Collectible Books.

Author: Goltilabar Nikobei
Country: Belize
Language: English (Spanish)
Genre: History
Published (Last): 4 December 2005
Pages: 395
PDF File Size: 5.82 Mb
ePub File Size: 13.67 Mb
ISBN: 900-1-19173-975-5
Downloads: 78779
Price: Free* [*Free Regsitration Required]
Uploader: Goltisho

If one of your users accesses your system via a modem on a personal computer, how do you ensure buiilding the personal computer has not been penetrated by an outsider via that modem?

Champion Principles of Information Security, 5th Edition 1 Learning Objectives Upon completion of this material, you computeg be able to: Many of these controls do not substantially increase the security of the system, but they do foster the notion that morrrie is painful.

This document discusses many of the computer security concepts covered in this book. The Criteria is a technical document that defines many computer security concepts and provides guidelines for their implementation.

Although the steps identified in this book fully support the Trusted Computer System Evaluation Criteria produced by the National Computer Security Center, the technical elements of an objective evaluation are not tied to any particular organization or class of users.

First, repeated entry of the password greatly increases the risk that someone will be looking over the user s shoulder when the password is entered. External controls can be divided into three classes: These procedures allow the government to assign different degrees of trust to different people, depending on the needs of their particular job and the depth of their investigation.

This gasesr is a supplement to the Cyber Security: The data routing infrastructure More information. Technical Systeem Plain talk about security When it comes to Cloud deployment, security is top of mind for all concerned.

While most of the technical concepts in the Criteria are covered in this book, we will pay little attention to its rating scale. The components inside the system are of two types: The Department of Homeland Security, More information.


Building a Secure Computer System

For example, even the most primitive multiuser systems today have password protection. Some sophisticated features appear in research systems that are used daily at universities, proving that the concepts are viable, but for various reasons not the fault of the researchers the systems remain one-of-a-kind. We introduce widely used security-specific concepts and terminology.

While great strides have been made since the early s toward ensuring secrecy and integrity, little progress has been made in solving denial of service because the problem is fundamentally much harder: Eugene Schultz Payoff Firewalls: However, creating a secure wireless network has often been Robust security is a requirement for many companies deploying a wireless network. Worse, contracts are often written in such a way that the first version is the final product, and additional money is rarely available for performance tuning.

Fads in morrir computer security area can have a serious negative effect on the overall progress toward achieving good security, because progress stops when people think they have the answer.

Enterprise effectiveness of digital certificates: This discussion is based primarily. Network Working Group Request for Comments: This appendix is one of More information. This book distinguishes the technical aspects buildint computer security, and identifies the significance of the vulnerabilities being addressed.

Unfortunately, many of those building computer systems took the position that internal computer controls those that are embodied in software within the operating system could effectively limit the access of users to authorized information only.

To use this website, you must agree to our Privacy Policyincluding cookie policy. Internal and external controls go hand in hand, and it is possible to trade off a control in one area for a control in the other.

Threats and Attacks Modifications by Prof. Agsser would be fighting a losing battle, except that security need not be an isolated effort: Vendors commonly adopt the attitude that a customer who wants security badly enough should be willing to live with the inconvenience. When one person in the group leaves the company, the password must be changed and the new password manually distributed.


Vendors often implement security enhancements in response to specific customer demands. The National Computer 4. Buildlng few customers are willing to pay extra for security, vendors have had little incentive to invest in extensive security enhancements.

Chapter 1 Introduction 1 Chapter 1: But of course there is hope: Before the problem of data security became widely publicized in the media, most people s idea More information. Security measures are supposed to thwart someone who tries to break the rules; but because of poorly integrated ad hoc solutions, security measures often interfere with an honest user s normal job.


Physical security Personnel security Procedural security Physical security controls locked rooms, guards, and the like are an integral part of the security solution for a central computing facility, but they alone cannot address the security problems of multiuser distributed systems. Even when the system builder made a major and concerted effort the find and patch all the holes, the technical controls were usually penetrated with ease.

Now, as more businesses connect to the Internet as a service to their internal. This appendix is one of. While the definition of computer security used in this book does, therefore, include both secrecy and integrity, the closely related area termed denial of service is rarely discussed here.

Several vendors have made a considerable investment in internal security enhancements to their operating systems without cost add-ons.

Building a Secure Computer System – Morrie Gasser – Google Books

Fortunately it is now understood that policy can be mathematically modeled abstractly, so that a wide range of end-user policies are represented by a single model.

We probably cannot change the way the world works, but understanding why it works the way it does can help us avoid the typical pitfalls and choose acceptable security solutions. Unfortunately, they also appeal to people who like More information. But there is also an important technical reason.