Page 1 A Guide to the Procurement of Trusted Systems: An ... - csirt

4.2.5 ACQUISITION SYSTEM PROTECTION PROGRAM (ASPP)
4.3 RISK ASSESSMENT
4.3.1 RISK INDEX
4.3.1.1 DATA SENSITIVITY
4.3.1.2 USER CLEARANCE
4.3.1.3 REQUIRED TRUSTED COMPUTING BASE
4.3.2 SECURITY MODE OF OPERATION
4.3.2.1 DEDICATED SECURITY MODE
4.3.2.2 SYSTEM HIGH SECURITY MODE
4.3.2.3 PARTITIONED SECURITY MODE
4.3.2.4 MULTILEVEL SECURITY MODE
4.4 COST/BENEFIT ANALYSIS
4.4.1 PERFORMING THE ANALYSIS
4.4.2 SATISFYiNG SECURITY REQUIREMENTS
4.4.3 RELATION TO SYSTEM LEVEL ANALYSES
4.4.4 EXAMPLES OF TRADEOFFS
4.5 THREAT ASSESSMENT
4.5.1 THE SYSTEM THREAT ASSESSMENT REPORT (STAR)
4.5.2 FORWARDING THE INFORMATION
4.5.3 VALIDATION BY THE DIA
4.5.4 CLANDESTINE VULNERABILITY ANALYSIS
4.6 RISK ANALYSIS
4.6.1 DIFFICULTIES
4.6.2 PERFORMING A SUBJECTIVE ANALYSIS
4.6.3 FACTORS IN A RISK ANALYSIS METHODOLOGY
4.7 SAFEGUARD SELECTION AND IMPLEMENTATION
4.7.1 DEVELOPER RESPONSIBILITIES
4.7.2 THE DEVELOPMENT ENVIRONMENT
4.7.3 REGULATIONS THAT APPLY TO DEVELOPMENT
4.8 REFERENCES
5 SECURITY TEST AND EVALUATION
5.1 INTRODUCTION
5.2 SECURITY TEST AND EVALUATION
5.2.1 TERMS
5.2.1.1 EVALUATION
5.2.1.2 SECURITY TEST AND EVALUATION
5.2.1.3 ENDORSE
5.2.2 ST&E AND THE ACQUISITION PROCESS
5.2.3 USE OF EVALUATED PRODUCTS
5.2.4 THE EVALUATION PROCESS
5.2.4.1 THE EVALUATED PRODUCTS LIST
5.2.4.2 PRODUCT TYPES
5.2.5 TEST AND EVALUATION (T&E) AND THE LIFE-CYCLE PROCESS
5.2.5.1 DETERMINATION OF MISSION NEED
5.2.5.2 CONCEPT EXPLORATION AND DEFINITION
5.2.5.3 DEMONSTRATION AND VALIDATION
5.2.5.4 ENGINEERING AND MANUFACTURING DEVELOPMENT
5.2.5.5 PRODUCTION AND DEPLOYMENT
5.3 THE TESTING PROCESS
5.3.1 DEVELOPMENTAL TEST AND EVALUATION
5.3.1.1 QUALIFICATION TEST AND EVALUATION (QT&E)
5.3.1.2 PREPRODUCTION QUALIFICATION TEST (PPQT)
5.3.1.3 PRODUCTION QUALIFICATION TEST (PQT)
Page 6