Page 1 A Guide to the Procurement of Trusted Systems: An ... - csirt

attitude should be "Show me, please" throughout the test effort. For the
internal TCB-provided security protection features, DoD 5200.28-STD
requirements should be reviewed for testing each division/class. A team of
experts should be assembled to help test. Also, Chapter 5 of this document,
"Security Test and Evaluation," should be reviewed.
3.3.3.4 CONFIGURATION MANAGEMENT
Configuration Management (CM) for TCB software is only required for TCB
Classes B2 and above. However, CM should be required for all acquisitions,
whenever possible. CM is the only way to achieve a structured and
disciplined approach to software management, regardless of the TCB division/
class. The situation is likely that some CM will be required in every program.
The requirement extends to the TCB software by including a Statement of Work
task. The Program Manager should also participate in the Configuration Control
Board (CCB), which is the committee that reviews all changes to established
baselines. Note that the documented procedures for control of changes do not
need to be as extensive for the lower TCB division/classes (C1 through B1).
Configuration control must extend to distribution, delivery, installation,
Operation, and maintenance.
3.3.3.5 AUDIT
Auditing of security-relevant events is required for all TCB division/
classes (C2 and above). The early identification of audit requirements and
strategy is necessary to ensure that the accountability requirements are
satisfied for the TCB division/class, and to ensure they are included in the
TCB design. The NSA publication NCSC-TG-001,"A Guide To Understanding Audit In
Trusted Systems," describes the specific audit requirements for each TCB
division/class, including the events that must be audited and the specific
information that must be recorded.
3.3.3.6 PASSWORD GENERATION AND MANAGEMENT
One of the major requirements of all TCB division/classes is accountability.
The CSC-STD-002-85, "DoD Password Management Guideline," and NCSC-TG-017, "A
Guide to Understanding Identification and Authentication," provide sound
practices that will help satisfy the accountability requirement. Ensure
accountability is included in all AIS RFP requirements. Also ensure the
information provided in the Trusted Facility Manual and Security Features
User's Guide is consistent with the principles in this guideline.
3.3.3.7 TCB IMPLEMENTATION CORRESPONDENCE
The process of assuring that the TCB is "properly done" is called
"correspondence." The technique used is to map the TCB design back to the
security policy model at the B1 and above levels. In addition, the TCB Class
A1 requirement calls for mapping the TCB design down to the TCB source code.
3.3.4 CLASSIFIED SOFTWARE
If any of the software being developed is classified, be sure to check Block
11c, Receipt and Generation of Classified Documents and Other Material, of the
DD Form 254, Contract Security Classification Specification. Trusted
Page 44