Page 1 A Guide to the Procurement of Trusted Systems: An ... - csirt

Therefore, the specific TCSEC requirements necessary to meet a Certain
division/class rating must be identified, without stating that the B2
product is desired. The desire for the decreased risk normally inherent in
an EPL product, however, can and should be reflected as a strong evaluation
weighting factor for source selection.
3.8.3 MULTIPLE-ENTITY SYSTEMS
A system may be composed of two or more entities, each of which uses different
division/class security requirements. Some examples of the rationale for doing
this are provided in NCSC-TG-021,"Trusted Database Management
Interpretation" and also in Appendix A of NCSC-TG-00s, "Trusted Network
Interpretation." The reason could also be that, as a system evolves, a
higher level of security may be mandated for a new part (entity) of the system
(called "Y") than was mandated for the existing entity (called "X").
Rebuilding the entire system is often not practical. The alternative is to
consider X and Y as distinct connected entities.
3.8.3.1 ENTITY PROTECTION
Distinct connected entities X and Y must be isolated from one another in a
security sense. They each must meet their distinct security requirements.
Communications by each to the other must be shown to meet an interface
policy given for each. The interface policy must reflect the outgoing/incoming
security policies, mutual trust, cascading effect, and least privilege
considerations. If additional security requirements above those from the TCSEC
have been imposed (e.g., a two-person rule), these requirements must be
considered in the interface policy.
3.8.3.2 ENTITIES WITH THE SAME DIVISION/CLASS
Even two connected B3 systems may have to be treated as distinct entities. One
B3 system may have resulted from an uncleared minimum user clearance with
maximum Secret data sensitivity and the other B3 system may have resulted from
a Confidential minimum user clearance and maximum Top Secret data
sensitivity (see Enclosure 4 of DoD Directive 5200.28). Cascading risk would
probably require the combined system to be evaluated using Class A1 criteria.
3.8.4 RECOMMENDATIONS
As stated before, this set of four acquisition documents does not deal with
this complicated situation of acquiring multiple security entity systems
because DoD policy has not been finalized. This document series only deals
with single system-entities. Successfully evaluated products will be said to
"possess" a division/class (e.g., Class B3). System entities will be said to
require some minimum division/class level (e.g., Class B3) requirements.
System entities having successfully passed certification evaluation against
a minimum division/class set of requirements will be identified, but those
entities cannot be called, for example, Class B3 entities or systems. Instead,
use "B3" for Class B3-evaluated products and "systems (or system entities)
certified against Class B3 requirements" for the cases treated in this
document set.
3.8.5 WHAT TO DO IN THE MEANTIME
Page 50