Page 1 A Guide to the Procurement of Trusted Systems: An ... - csirt

the source language, although the function performed will be correctly done.
Linkers (sometimes called "Linkage Editors") can also be a security concern,
since access to unintended data areas can Occur through "external reference"
directives. Finally, some languages incorporate what is known as "run-time
packages," chiefly to perform input-output operations. Run-time packages
must be included within the security-relevant boundary, especially at the
higher TCB divisions/classes.
3.3.2 THE PROCESS
Figure 3-2 illustrates the software development process in terms of
documentation required. Different terms are used for some of the design
documents, but the document requirements are similar, if not identical. For
example, the terms Functional Description, "A" Specification, and System
Specification, are usually used interchangeably. Note that the process is
iterative, and flows from very general top-level policy and capabilities
requirements statements, down to very precise implementation details.
Security Policy
*
Security Policy Model
*
Functional Description
("A" Specifications
Descriptive Top Level Specification (DTLS)
Formal Top Level Specification (FTLS, A1 only))
*
System/Subsystem Specifications
("B" Specification)
*
Unit Specifications
("C" Specification)
Figure 3-2 Security Protection in the Software Development Process
3.3.3 MANAGING SOFTWARE DEVELOPMENT
As noted above, the key to success with software is structure and
discipline. Some of the specific success factors follow:
3.3.3.1 DESIGN DOCUMENTATION
Documentation must start from the initial statement of requirements and
continue through to the details of implementing, operating, and maintaining
the system. The root is in the initial statement of requirements.
3.3.3.1.1 SECURITY POLICY
An explicit statement of the security policy should be enforced by the AS. The
policy should be documented in the specification (requirements) section of the
RFP, and should clearly state the security enforcement rules by which the
system will operate.
3.3.3.1.2 MODEL
Page 42