Home / Research Paper / The Security Manager of Medical Credentials Company, Research Paper Example

The Security Manager of Medical Credentials Company, Research Paper Example

Pages: 4

Words: 1105

C-2 Requirements – Controlled Access Protection

These requirements are mainly used for commercial products and most Operating System sellers use controlled access protection (Bordetsky, & Hayes-Roth,2007).

Functional Requirements

Security Audit. These will record information such as date and type of event, type of event and the outcome of the event – success or failure.
User Data Protection. Achieved through Discretionary Access Control Policy, Discretionary Control Functions, Object Residual Information Protection and Subject Residual Information Protection.
User subject Binding Identification and Authentication. Focuses on: User attribute definition, Strength of Authentication Data, Authentication, Protection Authentication Feedback and Identification
Security Management. Involves: Revocation of Object Attributes and Security, Static Attribute Initialization, Management of the Audited Events, Management of User Attributes, Revocation of User Attributes, Management Roles, Management of Object Security Attributes, Management of the Audit Trail Management of Authentication of Data (Meyer, 2003).
Protection of the TOE Security Functions. It involves: Abstract Machine Testing, Reference Mediation, Domain Separation and Reliable Time Stamps

Assurance Requirements

Configuration Management. Its concerned with: Authorization Controls and the Configuration Management Documentation.
Delivery and Operation. It consists of: Delivery Procedures, Installation and Start-up Procedures.
It carries out: The Functional Specifications, High Level Design, and Correspondence Demonstration,
Guidance Documents. It consists of: Administrator Guidance and User Guidance.
Life Cycle Support. It carries out Identification of Security Measures and therefore the engineers should provide a Security Documentation.
Security and Testing. Entails an analysis of the Test Coverage, depth of the Testing, Functional Testing and independent Testing.
Vulnerability Assessment. Consist of: Guidance Documentation, Strength of TOE Security Function Evaluation and Developer Vulnerability Analysis.

B-3 Requirements – Security Domains

Access Control Systems and Methodology. It is involved with protecting computer resources from unauthorized or modification while still providing those resources to the authorized users.
Telecommunications and Network Security. Focuses on communications and network protocols and the weaknesses in each.
Business Continuity Planning and Disaster Recovery Planning. Deals with issues such as natural disasters and putting measures such as backup media that would ensure business continuity.
Security Management Practices. Its primary focus is security awareness which means educating the IT staff and the end users about various security threats, their effects and measures.
Security Architecture and Models. Focuses on having security policies and procedures in place.
Law, Investigation and Ethics. Covers the legal issues associated with computer security and procedures followed like where to report a crime and also know what would constitute substantial evidence.
Application and Systems Development Security. Covers things like Database security models and issues such as integrity of programmers.
It involves encryption of data and it’s the most widely used. Its also explains various types of encryption and the calculations behind them and most importantly – securing your security key.
Physical security. This involves ensuring that IT equipment such as servers, workstations are secure through security guards and locking doors.

Differences Between Controlled Access Protection and Security Domain

section

C-2 Requirements

B-2 Requirements

Differences/Similarities

(1-2 sentences)

DAC

Involves: Revocation of Object Attributes and Security Management Roles

Management of the Audit Trail, Management of the Audited Events, Management of User Attributes, Management of Object Security Attributes, Static Attribute Initialization,

Management of Authentication of Data, Revocation of User Attributes,

Its primary focus is security awareness which means educating the IT staff and the end users about various security threats, their effects and measures.

B-2Mainly deals with the security systems of an operating system during and after development. While 1 DEALS with more of the standards that a Strong security system follows

2.0

in both it, Covers the legal issues associated with computer security and procedures followed like where to report a crime and also know what would constitute substantial evidence

Object Reuse

User subject Binding Identification and Authentication. Focuses on: User attribute definition, Strength of Authentication Data, Authentication, Protection Authentication Feedback and Identification (Hummel, 2009)

2.0) C2-Discretionary protection: minimal protection, covers testing and documentation

Business Continuity Planning and Disaster Recovery Planning. Deals with issues such as natural disasters and putting measures such as backup media that would ensure business continuity

2.0 B2- Controlled access protection: C1+ objects reuse + audit.

Most common for commercial products

Many OS vendors B2 protection

3.0 Business Continuity Planning and Disaster Recovery Planning. Deals with issues such as natural disasters and putting measures such as backup media that would ensure business continuity.

In Both ,Types of threats dealt with are mainly man-made such as viruses

2.0 both, Entails an analysis of the Test Coverage, depth of the Testing, Functional Testing and independent Testing.

Labels

none

Levels B2 onwards requires maintaining the mapping between requirements, design, detailed design and coding. vulnerability assessments

No analysis of design level vulnerability assessment

Assessment of cryptographic capabilities Requiring security assessment during design and development

Procedures for delivery, generation and distribution procedures

Secure startup and operations procedures

Architecture chucks:

Tamper proof reference displays

Process segregation

Principle of least honor

Well defined user interfaces

Systems integrity

Required recognized methods, but no permitted formal methods

2.0. Security target, informal description of architecture, testing

B2: Informal description of detailed design and ToE.

B2: More stringent requirements on detailed design + correspondence between source code and security requirements

Etc.

1.Suitability of requirements: condition

Consistency

Coverage: can the threats be shielded by

environmental assumptions +

Security necessities

2. Security and Testing. Entails an analysis of the Test Coverage, depth of the Testing, Functional Testing and independent Testing.

3.0 User Data Protection. Achieved through Discretionary Access Control Policy, Discretionary Control Functions, Object Residual Information Protection and Subject Residual Information Protection.

2.0 e. Security Architecture and Models. Focuses on having security policies and procedures in place

3.0

.It involves encryption of data and it’s the most widely used. Its also explains various types of encryption and the calculations behind them and most importantly – securing your security key.

Binding requirements: relates on enforcement,

Do the enforcement mechanisms appropriately enforce security policy?

Are the enforcement mechanisms equally supportive?

2.0 both Consist of: Guidance Documentation, Strength of TOE Security Function Evaluation and Developer Vulnerability Analysis that ensures Authorization Controls and the Configuration Management Documentation.

Security Domain more effective and hence the most preferred form of security:

It’s more general though expensive, it caters for the overall organization not only the present threats but future once (Tamara, 2005). Caters for all sorts of security threats from viruses to thefts and even goes to sort of insuring your data from theft and natural disasters

Provides a guideline of the legal issues, the procedures to be followed and knowledge of net forensics

References

Bordetsky, A., & Hayes-Roth, R. (2007). Extending the OSI model for wireless battlefield networks: a design approach to the 8th Layer for tactical hyper-nodes. International Journal of Mobile Network Design and Innovation (IJMNDI), 2(2), 5-12.

Deal, R. (2008). Cisco Certified Network Associate study guide (exam 640-802). New York: McGraw-Hill Professional.

Hummel, S. (2009, May 14). Ezine Articles. Retrieved February 3, 2011, from Network Design Process – Effective Network Planning and Design: http://ezinearticles.com/?NetworkDesign-Process—Effective-Network-Planning-and-Design&id=2348088

Meyer, M. (2003). Mike Meyers’ A+ Guide to PC Hardware. New York: McGraw-Hill Professional.

Tamara, D. (2005). Network+ Guide to Networks. Boston: Cengage Learning.