Page 1 A Guide to the Procurement of Trusted Systems: An ... - csirt

Output must be marked with a plain language version of the object's
sensitivity level (e.g., English language security classification banner at
the top and bottom of each page).
3.2.2.2.1.7 Mandatory Access Control (Class B1 and above):
From Mandatory Access Control (MAC) rules, subjects (e.g., users, programs)
are allowed access (e.g., read, write, change, delete) to objects (e.g.,
data). A subject's clearance level must always be consistent with an
object's sensitivity level. Thus, subjects may read from an area (e.g., main
memory) with an equal or lesser sensitivity level, and may write to an area
with an equal or greater sensitivity level.
3.2.2.2.1.8 Subject Sensitivity Labels (Class B2 and above):
During an interactive session, the TCB must keep the terminal user informed of
changes in the "current working security level." Terminal users may request
a display of the complete sensitivity label for processes they are using.
3.2.2.2.1.9 Device Labels (Class B2 and above):
The TCB must keep track of the minimum and maximum security level
assignments of all physically attached devices (e.g,., terminals, printers).
These assignments are often called "classmarks".
3.2.2.2.2 ACCOUNTABILITY
Accountability is the ability to trace actions affecting security to the
responsible party. This feature ensures the user's dialogue is with the TCB
and not with a masquerading program (e.g., during log-in).
3.2.2.2.2.1 Identification and Authentication (all classes):
Users must identify themselves (e.g., provide user-identifications) to the
system and the TCB must authenticate the user's identity (e.g., passwords).
3.2.2.2.2.2 Audit (Class C2 and above):
The TCB must record all security- relevant events (e.g., changes to device
classmarks) in a TCB-protected area called the "audit trail."
3.2.2.2.2.3 Trusted Path (Class B2 and above):
The TCB must provide a means to identify itself clearly to the user.
3.2.2.2.3 ASSURANCE
Assurance provides the steps necessary to demonstrate that the security policy
has been correctly implemented.
3.2.2.2.3.1 System Architecture (all classes):
The system architecture must separate TCB processes (e.g., reference
monitor) from user processes (e.g., application programs). The system
Page 38