13-3 Flashcards
MIST SP 800-35 is an overview of information security with 6 phases of the IT security life cycle are defined. these 6 phases include
initiation assessment solution implementation operations closeout
NIST SP 800-30 rev 1 Guide for Conducting Risk Assestment has 9 steps in i the process
change characterization threat ID Vulnerability ID control analysis likelihood determination impact analysis risk determination control recommendations result documentation
_________ is the unified information framework for the entire federal goverment that Is replacingthe legacy DIACAP within the federal agencies.
risk management framework
this was a dod procedure for ID, implement, validate, certify and managing IA capabilities and services, expressed as AI controls
DIACAP
the orange book is a common name of one of several books published by the DOD. because the book is color coded the entire series is referred to as the ____________
rainbow series
the full name fo the orang ebok is
defense trusted computer system evaluation criteria (DOD-5200.28-STD)
the orange book outlines the criteria for rating various OS, but it notoriously difficult to
find
this catagory is for any system that does meet the specifications of any other category. any system that fails to receive a higher classification gets a __________
D classification / minimal protection
applies to trusted computing bases with optional object protection
C Discretionary Protection
the 2 subcategories of discretionary protection
C1 - Discretionary Security Protection
C2 - Controlled Access Protection
this is C protection with bit more added to it. this includes
DAC for users at same security level periodic check of TCB Username / Password protection protected Os mode tested security documentation for user security, system security and security testing
The ____ requires users to identify themsaleve to it before beginning to perform any otheractions the TCB is expected to mediate
TCB
the 2 subcatagories of mandatory protection
b1-Labeled security protection
b2 - structured protection
highly secure mainframe operating system
Honeywell Multics
this is a very secure component to network OS. the Verdix Secure LAN is a network component that is capable of interconnecting host systems operating at different ranges of security levels allowing a multilevel secure MLS Lan operation
CRYPTEK VSLAN
