| Information Assurance and the Defense in Depth: A Study of Infosec Warriors and Infosec Cowboys |
2003 |
161 pages |
| Authors:
Jonathan M. Fox; ARMY COMMAND AND GENERAL STAFF COLL FORT LEAVENWORTH KS
|
 | This study investigates the Army's ability to provide information assurance for the NIPRNET. Information assurance includes those actions that protect and defend information and information systems by ensuring availability, integrity, authentication, confidentiality, and non-repudiation. The study examines how the military's defense in depth policy provides information assurance with a system of layered network defenses. The study also examines current practices used in the corporate world to provide information assurance. With ... |
|
| Internet Civil Defense: Feasibility Study |
17 DEC 2002 |
121 pages |
| Authors:
Ron LaPorte; Nathaniel Mass; Francois Sauer; DEFENSE ADVANCED RESEARCH PROJECTS AGENCY ARLINGTON VA
|
| Internet Civil Defense (ICD) is designed to substantially enhance national preparedness and response to both terrorism and natural disasters. ICD is a national (and ultimately, international) system of information sharing, education and analysis via the Internet to connect the general public, community networks, emergency responders, local and national investigative authorities, and scientific experts and public health officials around the globe in real time for the common purpose of increasing public ... |
|
| Internet Civil Defense: Financial Plan |
17 DEC 2002 |
46 pages |
| Authors:
Ron LaPorte; Nathaniel Mass; Francois Sauer; DEFENSE ADVANCED RESEARCH PROJECTS AGENCY ARLINGTON VA
|
| The Internet Civil Defense (ICD) System is designed to substantially enhance national preparedness and response to both terrorism and natural disasters. ICD is a national (and ultimately, international) system of information sharing, education and analysis via the Internet to connect the general public, emergency responders, local and national investigative authorities, and scientific experts and public health officials around the globe in real time for the common purpose of increasing public ... |
|
| Internet Civil Defense: Feasibility Study |
09 DEC 2002 |
119 pages |
| Authors:
Ron LaPorte; Nathaniel Mass; Francois Sauer; DEFENSE ADVANCED RESEARCH PROJECTS AGENCY ARLINGTON VA
|
| Internet Civil Defense (ICD) is designed to substantially enhance national preparedness and response to both terrorism and natural disasters. ICD is a national (and ultimately, international) system of information sharing, education and analysis via the Internet to connect the general public, community networked cells, emergency responders, local and national investigative authorities, and scientific experts and public health officials around the globe in real time for the common purpose of increasing ... |
|
| Internet Civil Defense: Financial Plan |
09 DEC 2002 |
46 pages |
| Authors:
Ron LaPorte; Nathaniel Mass; Francois Sauer; DEFENSE ADVANCED RESEARCH PROJECTS AGENCY ARLINGTON VA
|
| The Internet Civil Defense (ICD) System is designed to substantially enhance national preparedness and response to both terrorism and natural disasters. ICD is a national (and ultimately, international) system of information sharing, education and analysis via the Internet to connect the general public, emergency responders, local and national investigative authorities, and scientific experts and public health officials around the globe in real time for the common purpose of increasing public ... |
|
| Computer Network Defense: DOD and the National Response |
02 DEC 2002 |
49 pages |
| Authors:
James M. Jenkins; AIR WAR COLL MAXWELL AFB AL
|
| This research paper examines the strategic framework for defense of the National Information Infrastructure (NII). Explored within the paper are the growing importance and dependency of the United States upon information technology and its associated infrastructure, possible threats to the information infrastructure, the implications of those threats, and currently employed defensive measures and their effectiveness. In addition, it provides five recommendations for improvements in the national strategic defensive posture: (1) ... |
|
| HOMELAND SECURITY: Information Technology Funding and Associated Management Issues |
DEC 2002 |
38 pages |
| Authors:
Carl Levin; Susan Collins; Joel C. Willemssen; GENERAL ACCOUNTING OFFICE WASHINGTON DC
|
| This General Accounting Office (GAO) report to the Senate Permanent Subcommittee on Investigations, Committee on Governmental Affairs identifies information technology (IT) funding targeted for purposes related to homeland security for fiscal years 2002 and 2003. The report discusses IT funding for those departments and agencies that will play a key role in homeland security, and also reports on IT management issues facing these departments and agencies. In brief, GAO identified ... |
|
| Privacy Analysis of the Internet Protocol |
DEC 2002 |
56 pages |
| Authors:
William Quentrille; Ronald Watro; Charles Lynn; Jennifer Mulligan; Tushar Saxena; BBN LABS INC CAMBRIDGE MA
|
| The motivating problem for this research is the situation in which a group of US military facilities exchange encrypted communication over public networks. The traffic flow on such networks can be a source of covert information flow to eavesdroppers that monitor the public networks. Even simple measurements of the quantity of traffic arriving at a remote location can be indicative of imminent activity at that site. More sophisticated traffic analysis ... |
|
| Network Survivability Analysis Using Easel |
DEC 2002 |
|
| Authors:
Alan M. Christie; CARNEGIE-MELLON UNIV PITTSBURGH PA SOFTWARE ENGINEERING INST
|
 | The survivability of large, complex networks such as the Internet is an increasing concern, but such networks are difficult to analyze because they are topologically complex, highly non-linear in their responses, and inherently unbounded (i.e., no node in the network can have global knowledge). This report will describe how to develop statistically valid networks and, as an example of their use, apply them to the simulation of virus propagation It ... |
|
| Zero Trust Intrusion Containment for Telemedicine |
DEC 2002 |
26 pages |
| Authors:
Arun K. Sood; Yih Huang; Robert Simon; Elizabeth White; Kevin Cleary; GEORGE MASON UNIV FAIRFAX VA
|
| Intrusion Management Systems (IMS) serve to protect complex computer systems from unauthorized intrusions. Our objective is the design and analysis of 'zero-trust' Intrusion Tolerant Systems. These are systems built under the extreme assumption that all intrusion detection techniques will eventually fail. Our approach, Self-Cleansing Intrusion Tolerance (SCIT), centers around two key concepts: zero trust and system self-cleansing. Our zero trust principle assumes that a successful intrusion may have taken place ... |
|
| Information System Security: Government Information Security Reform Act Implementation: Defense Advanced Research Projects Agency Management Support System |
25 NOV 2002 |
61 pages |
| Authors:
INSPECTOR GENERAL DEPT OF DEFENSE ARLINGTON VA
|
|
| AFRL/Cornell Information Assurance Institute |
13 NOV 2002 |
25 pages |
| Authors:
Fred B. Schneider; CORNELL UNIV ITHACA NY DEPT OF COMPUTER SCIENCE
|
| The AFRL/Cornell Information Assurance Institute supports a broad spectrum or research aimed at developing a science and technology base to enhance information assurance and networked information systems trustworthiness system and network security, reliability, and assurance. The institute also rosters closer collaborations between Cornell and AFRL researchers, as well as facilitating technology transfer and exposing Cornell researchers to problems racing the Air Force. |
|
| Multi-Community Cyber Defense (MCCD) |
NOV 2002 |
41 pages |
| Authors:
Randall Smith; BOEING PHANTOM WORKS SEATTLE WA OPEN SYSTEMS ARCHITECTURE
|
| This program developed and demonstrated automated technologies enabling security devices to cooperatively respond to network intrusions across small-to-very-large-scale networks while spanning administrative domains. Theatre-wide network defense is achieved by enabling cooperative intrusion tracking and by sharing attack-related information and response recommendations between neighboring domains. This effort extended the Intruder Detection and Isolation Protocol (IDIP), which uses intrusion detection systems and cooperating boundary controllers within a single administrative domain to track ... |
|
| Information Tools for Security Protection |
NOV 2002 |
25 pages |
| Authors:
David Rosenthal; Peter Samsel; Cheryl Barbasch; ODYSSEY RESEARCH ASSOCIATES INC ITHACANY
|
| This report describes the three tools built for the Information Security Tools project. Each of these tools provides a way of helping a user uncover potential security problems arising from the composition of parts of a system. The intent of this work was to provide tools usable by trained, but not necessarily expert, security personnel. The System Security Analysis Tool helps a user to model and analyze the security of ... |
|
| Tracking and Tracing Cyber-Attacks: Technical Challenges and Global Policy Issues |
NOV 2002 |
|
| Authors:
Howard F. Lipson; CARNEGIE-MELLON UNIV PITTSBURGH PA SOFTWARE ENGINEERING INST
|
| In the cyber world, the current state of the practice regarding the technical ability to track and trace Internet- based attacks is primitive at best. Sophisticated attacks can be almost impossible to trace to their true source using current practices. The anonymity enjoyed by today's cyber-attackers poses a grave threat to the global information society, the progress of an information-based international economy, and the advancement of global collaboration and cooperation ... |
|
| Information System Security: Security Controls for the Defense Procurement Payment System |
11 OCT 2002 |
28 pages |
| Authors:
INSPECTOR GENERAL DEPT OF DEFENSE ARLINGTON VA
|
|
| Public-Sector Information Security: A Call to Action for Public-Sector CIOs |
01 OCT 2002 |
|
| Authors:
Don Heiman; NATIONAL ASSOCIATION OF STATE CHIEF INFORMATION OFFICERS LEXINGTON KY
|
| This report expands upon the themes and issues raised at a forum on Security and Critical Infrastructure Protection sponsored by the National Association of State Chief Information Officers (NASCIO) with the support of the IBM Endowment, Forum participants included state chief information officers, government information technology managers, and other key state government staff, At the forum, held in November 2001, conference participants identified a series of actions designed to combat ... |
|
| Trustworthy Refinement Through Intrusion-Aware Design |
OCT 2002 |
|
| Authors:
Robert J. Ellison; Andrew P. Moore; CARNEGIE-MELLON UNIV PITTSBURGH PA SOFTWARE ENGINEERING INST
|
| High confidence in a system's survivability requires an accurate understanding of the system's threat environment and the impact of that environment on system operations. Unfortunately, existing development methods for secure and survivable information systems often have a patchwork approach in which the focus is on deciding which popular security components to integrate rather than making a rational assessment of how to address the attacks that are likely to compromise the ... |
|
| SEI Independent Research and Development Projects |
OCT 2002 |
|
| Authors:
Steve Cross; Eileen Forrester; Scott Hissam; Rick Kazman; Linda Levine; CARNEGIE-MELLON UNIV PITTSBURGH PA SOFTWARE ENGINEERING INST
|
| Each year, the Software Engineering Institute (SEI) undertakes several Independent Research and Development (IR&D) projects. These projects serve to (a) support feasibility studies investigating whether further work by the SEI would be of potential benefit and (b)support further exploratory work to determine if there is sufficient value in eventually funding the feasibility study work as an SEI initiative. Projects are chosen based on their potential to mature and/or transition software ... |
|
| Life-Cycle Models for Survivable Systems |
OCT 2002 |
|
| Authors:
Richard C. Linger; Howard F. Lipson; John McHugh; Nancy R. Mead; Carol A. Sledge; CARNEGIE-MELLON UNIV PITTSBURGH PA SOFTWARE ENGINEERING INST
|
| Today's large-scale, highly distributed, networked systems improve the efficiency and effectiveness of organizations by permitting whole new levels of organizational integration. However, such integration is accompanied by elevated risks of intrusion and compromise. Incorporating survivability capabilities into an organization's systems can mitigate these risks. Current software development life-cycle models are not focused on creating survivable systems, and exhibit shortcomings when the goal is to develop systems with a high degree ... |
|
| Building a Dynamic Interoperable Security Architecture for Active Networks |
OCT 2002 |
90 pages |
| Authors:
Roy H. Campbell; M. D. Mickunas; ILLINOIS UNIV CHAMPAIGN GRANTS AND CONTRACTS ADMINISTRATION
|
| Security is viewed as one of the major obstacles to the widespread deployment active networks. A significant challenge is to develop mechanisms to change software state on routers dynamically, without sacrificing protection guarantees. The Seraphim projects leverages the inherent dynamism in the paradigm to build dynamic security mechanisms for active networks. Seraphim's security architecture is component based, dynamically extensible, and reflective, and supports a variety of policy strategies and enforcement ... |
|
| Survivability Architectures |
OCT 2002 |
167 pages |
| Authors:
John C. Knight; VIRGINIA UNIV CHARLOTTESVILLE DEPT OF COMPUTER SCIENCE
|
| Many large information systems have evolved to a point where organizations rely heavily upon them. In some cases, such systems are so widespread and so important that the normal activities of society depend upon their continued operations. Management of transportation systems such as air traffic control, telecommunications, nationwide control of power distribution, and the financial system are examples. Military information systems are similar in that many military functions are dependent ... |
|
| Cyber-Forensic Research Experimentation and Test Environment (CREATE) |
OCT 2002 |
112 pages |
| Authors:
Gary R. Gorden; Chester D. Hosmer; UTICA COLL OF SYRACUSE UNIV NY
|
| The objective of this effort was to develop methodologies and standards for cyber forensics methods and tools. The current cyber forensic certification/validation efforts are described along with a best practices model. The potential for an Information Analysis Center (lAC) in computer forensics was explored. Finally, the International Journal of Digital Evidence, an online journal, was established to report the research findings in these areas as well as other cyber forensics ... |
|
| Ensuring Survivable Information Services: Architecting, Diagnosing and Reconfiguring |
OCT 2002 |
36 pages |
| Authors:
Howard Shrobe; MASSACHUSETTS INST OF TECH CAMBRIDGE ARTIFICIAL INTELLIGENCE LAB
|
| The central premise of this work is that a significant shift of focus and approach is necessary in order to deal with the emerging threat of information attacks on the critical infrastructures of our society. A range of studies, for example those conducted by the RAND Corporation and by a DARPA ISAT project, raised the concern that a concerted information attack by a skillful and motivated opponent could lead to ... |
|
| Advanced Security Proxy Technology for High Confidence Networks: Advances in Trust Negotiation |
OCT 2002 |
130 pages |
| Authors:
William Winsborough; TRUSTED INFORMATION SYSTEMS INC GLENWOOD MD NAI LABS
|
| This effort addresses the recent trend to fight battles with a coalition of forces from many different commands and countries. This also applies to the business world where companies are cooperating more in order to get new, innovative products on the marketplace, and insure that they all interface together. In order to exchange information between coalitions of organizations (businesses) that have no shared infrastructure and only limited mutual trust, there ... |
|
| A Practical Approach to Integrating Information Security into Federal Enterprise Architecture |
OCT 2002 |
|
| Authors:
John DiDuro; Robert Crosslin; Debra Dennie; Paul Jung; Christopher Louden; LOGISTICS MANAGEMENT INST MCLEAN VA
|
| Security is a critically important consideration in government today. Managers are faced with a variety of security concerns driven by various laws, statutes, and regulations; agency policy; increased threat of terrorism; increased reliance on information technology; and issues of public trust. Security threats are cross-cutting, affecting IT planning, capital investment, systems design, operations, and IT governance. Failure to address security threats can interfere with a government organization's ability to carry ... |
|
| Misleading Information Detection Through Probabilistic Decision Tree Classifiers |
26 SEP 2002 |
22 pages |
| Authors:
Gordon Dakin; Sankar Virdhagriswaran; CRYSTALIZ INC CONCORD MA
|
| This report details our work in detecting misleading information which has focused on the detection of creative accounting practices through the analysis of SEC filing data. We have adopted a decision-tree approach to detecting red-flag conditions associated with creative accounting practices. Decision trees provide a natural way to express expert knowledge of red-flag evidence, and the resulting classifications can be explained in human terms. Focusing on the diagnostic analysis of ... |
|
| Kernel Loadable Wrappers for Information Assurance |
SEP 2002 |
42 pages |
| Authors:
Richard O'Brien; Terry Mitchem; Raymond Lu; Ryan Leonard; SECURE COMPUTING CORP SAINT PAUL MN
|
| Employing kernel loadable wrappers is an approach for selectively securing operating system functionality to provide robustness and security. Kernel loadable wrappers are loadable kernel modules that hook into system interfaces to perform pre-call and post-call processing. Their key features are that they are unbypassable, since they are in the kernel, and they are easy to install, requiring no modification to the operating system kernel. They can be used to make ... |
|
| Network Survivability Analysis of the Navy and Marine Corps Intranet (NMCI) |
SEP 2002 |
225 pages |
| Authors:
Alex B. Fahrenthold; NAVAL POSTGRADUATE SCHOOL MONTEREY CA
|
| NMCI is a mechanism to transform the Navy and Marine Corps information systems and prepare 21st century warfare. Just as the Internet has transformed business and commerce around the globe, NMCI may transform the U. S. Navy and Marine Corps by harnessing the power of an integrated network. The Navy and Marine Corps Intranet constitutes the first major step into a truly network- centric warfare environment and makes them full ... |
|
| An Event-Trace Language for Software Decoys |
SEP 2002 |
|
| Authors:
Georgios Fragkos; NAVAL POSTGRADUATE SCHOOL MONTEREY CA
|
| Cyberspace is becoming the battlespace of the future, and military practices, like deception, seem to be suitable for defending information systems from attacks, In this thesis, we explore the concept of intelligent software decoys, which employ a form of software-based military deception. We developed a prototype of a high-level language for specifying intelligent software decoys. Our approach involves two stages. The specification language is intended to be part of a ... |
|
| Windows XP Operating System Security Analysis |
SEP 2002 |
|
| Authors:
Meftun Goktepe; NAVAL POSTGRADUATE SCHOOL MONTEREY CA
|
| Windows XP, released in October 2001, brought new features to improve the work environment throughout organizations. The purpose of this research is to determine if Windows XP, when used as a workstation operating system in domain- based networks, provides adequate security policy enforcement for organizations. In this research we performed a security analysis of the Windows XP operating system, assessed its vulnerabilities and made recommendations for XP configurations and use ... |
|
| A Method for Mitigating Denial of Service Attacks on Differentiated Services Networks |
SEP 2002 |
101 pages |
| Authors:
Matthew J. Braun; NAVAL POSTGRADUATE SCHOOL MONTEREY CA
|
| This thesis presents a method for countering Denial of Service (DoS) attacks in networks that provide Quality of Service (QoS) guarantees using Differentiated Service (DiffServ). This approach uses feedback from the DiffServ provider to initiate packet signing at the source. The signature allows the DiffServ provider to distinguish valid packets from malicious packets. This mechanism can also be used to provide key management for other digital signature methods, such as ... |
|
| Evaluation of Enterprise Application Integration (EAI) and Web Services at Fitting Out and Supply Support Assistance Center (FOSSAC Under NMCI |
SEP 2002 |
97 pages |
| Authors:
Jeffrey L. Lark; Mark A. Reyes; NAVAL POSTGRADUATE SCHOOL MONTEREY CA
|
| Information technology has woven itself into the fabric of every organization. As organizations grow and develop specialized needs, specialized software applications emerge to address the needs. Often the business processes take shape around the capabilities of the software applications and the technology infrastructure, until the two are inseparable from one another. When an organization decides to incorporate new processes or upgrade its information architecture, the new system may lack compatibility ... |
|
| XML Based Adaptive IPSEC Policy Management in a Trust Management Context |
SEP 2002 |
|
| Authors:
Raj Mohan; NAVAL POSTGRADUATE SCHOOL MONTEREY CA
|
| TCP/IP provided the impetus for the growth of the Internet and the IPsec protocol now promises to add to it the desired security strength IPsec provides users with a mechanism to enforce a range of security services for both confidentiality and integrity, enabling them to securely pass information across networks, Dynamic parameterization of IPsec further enables security mechanisms to adjust the level of security service "on-the-fly" to respond to changing ... |
|
| Enterprise Implementations of Wireless Network Technologies at the Naval Postgraduate School and Other Military Educational Institutions |
SEP 2002 |
212 pages |
| Authors:
Joseph L. Roth; NAVAL POSTGRADUATE SCHOOL MONTEREY CA
|
| The purpose of all information systems is to assist people in transitioning data into information, and then information into knowledge. In order to reach IT modernity, three things need to occur: a convergence of single open platform data exchange (e.g., Extensible Markup Language (XML)), the development of new doctrine to manage this information (e.g., Net Centric Warfare), and the creation of a robust mobile secure network (e.g., 802.11). The heart ... |
|
| The Impact on Quality of Service When Using Security-Enabling Filters to Provide for the Security of Run-Time Virtual Environments |
SEP 2002 |
151 pages |
| Authors:
Ernesto J. Salles; NAVAL POSTGRADUATE SCHOOL MONTEREY CA
|
| The Naval Postgraduate School is developing NPSNET-V, a Run-Time Extensible Virtual Environment (RTEVE) framework. RTEVEs differ from traditional VEs in that applications within the environment can both discover and use new object types and behaviors at runtime. As the use of this technology has become more valuable to organizations, the need for adequate security has arisen, particularly for sensitive military and commercial applications. The level of security measures employed by ... |
|
| Semantic and Syntactic Object Correlation in the Object-Oriented Method for Interoperability |
SEP 2002 |
259 pages |
| Authors:
Stephen F. Shedd; NAVAL POSTGRADUATE SCHOOL MONTEREY CA
|
| In today's military interoperability is not a luxury, it is a necessity. Unfortunately, differences in data representation between various systems greatly complicate the task of achieving interoperability between them. Young's Object-Oriented Method for Interoperability (OOMI) describes a model- based, computer-aided methodology for resolving modeling differences among heterogeneous systems in order to enable system interoperability. The OOMI architecture and tool suite provide a high level of automation that will reduce the ... |
|
| Security Agility for Dynamic Execution Environments |
SEP 2002 |
19 pages |
| Authors:
Tim Fraser; Mike Petkac; Lee Badger; TRUSTED INFORMATION SYSTEMS INC GLENWOOD MD NAI LABS
|
| The Security Agility for Dynamic Execution Environments project developed practical solutions to problems faced by traditional applications in environments governed by dynamically reconfigurable security policies, In such environments, applications that are unaware of the security policy's dynamic nature may crash or misbehave when confronted with security policy changes that revoke their resources. They may fail to recover when subsequent security policy changes restore their access to resources. They may fail ... |
|
| Demonstration of Quality of Security Service Awareness for IPsec |
SEP 2002 |
37 pages |
| Authors:
Evdoxin Spyropoulou; Timothy E. Levin; Cynthia E. Irvine; NAVAL POSTGRADUATE SCHOOL MONTEREY CA
|
| Quality of Security Service (QoSS) refers to the ability to provide security services according to user and system preferences, policies and conditions. Thus, security can be managed as a responsive "service" for which quantitative measurement of service "efficiency" is possible. We present our demonstration of how a specific underlying security mechanism, IPsec, can be modulated to provide different levels for security in response to changing QoSS requirements. |
|
| Use of the Common Vulnerabilities and Exposures (CVE) Vulnerability Naming Scheme |
SEP 2002 |
6 pages |
| Authors:
Peter Mell; Tim Grance; NATIONAL INST OF STANDARDS AND TECHNOLOGY GAITHERSBURG MD COMPUTER SECURITY DIV
|
| This document provides guidelines for federal organizations' acquisition and use of security-related information technology (IT) products and services. NIST's advice is provided in the context of larger recommendations regarding security assurance. |
|
| Using the Technology Readiness Levels Scale to Support Technology Management in the DOD's ATD/STO Environments |
SEP 2002 |
|
| Authors:
Caroline P. Graettinger; Suzanne Garcia; Jeannine Siviy; Robert J. Schenk; Peter J. Van Syckle; CARNEGIE-MELLON UNIV PITTSBURGH PA SOFTWARE ENGINEERING INST
|
| In early 2002, the Communications Electronics Command (CECOM) Manager of the Army Tactical Wireless Network Assurance (TWNA) Science and Technology Objective (STO) FY03-07, hereafter referred to as STO, requested assistance from the Software Engineering Institute (SEI) in improving STO methods for assessing the maturity of new information assurance technologies. The STO was seeking to use technology maturity, as measured by the Technology Readiness Levels (TRLs) scale, as a metric in ... |
|
| Network Survivability Analysis of the Navy and Marine Corps Intranet (NMCI) |
SEP 2002 |
225 pages |
| Authors:
Alex B. Fahrenthold; NAVAL POSTGRADUATE SCHOOL MONTEREY CA
|
| NMCI is a mechanism to transform the Navy and Marine Corps information systems and prepare 21st century warfare. Just as the Internet has transformed business and commerce around the globe, NMCI may transform the U.S. Navy and Marine Corps by harnessing the power of an integrated network. The Navy and Marine Corps Intranet constitutes the first major step into a truly network- centric warfare environment and makes them full participants ... |
|
| Diamond HASP Trusted Computing Exemplar |
SEP 2002 |
14 pages |
| Authors:
Cynthia E. Irvine; Timothy E. Levin; George W. Dinolt; NAVAL POSTGRADUATE SCHOOL MONTEREY CA
|
| The National Information Infrastructure is weak; there are no high security, high assurance, off-the-shelf products available that can be used to strengthen it; and the National capability to design and construct such trusted computer systems and networks has atrophied. The purpose of the Trusted Computing Exemplar project is to provide a worked example to show how trusted computing systems and components can be constructed. A prototype high assurance development framework ... |
|
| Information Assurance Reliability Model (IARM) |
SEP 2002 |
|
| Authors:
Roberta L. Gotfried; Robert J. Moore; Mark J. Kuckelman; RAYTHEON ELECTRONIC SYSTEMS EL SEGUNDO CA
|
| The objective of this effort is to design, develop, document, demonstrate, evaluate, and deliver science-based methods for information assurance (IA) design and assessment. The ultimate goal of the proposed research is to improve the IA reliability and robustness of systems overall and their ability to withstand asymmetric attacks. This can be achieved by means of scientific methods and modeling techniques that assist in specifying requisite IA protection of a system, ... |
|
| Application of Operating System Concepts to Coordination in Pervasive Sensing and Computing Systems |
SEP 2002 |
|
| Authors:
Jesse M. Davis; Joseph B. Evans; Benjamin J. Ewy; Larry M. Sanders; KANSAS UNIV LAWRENCE INFORMATION AND TELECOMMUNICATION TECHNOLOGY CENTER
|
| Viewgraphs of presentation on the applications of operating systems concepts to coordinate sensing and computing systems. |
|
| Trends in HPC and HPEC Convergence |
SEP 2002 |
|
| Authors:
Richard Games; MITRE CORP BEDFORD MA
|
| Viewgraphs from presentation on current trends in the convergence between high performance computing and high performance embedded computing. |
|
| Diamond High Assurance Security Program: Trusted Computing Exemplar |
SEP 2002 |
14 pages |
| Authors:
Cynthia E. Irvine; Timothy E. Levin; George W. Dinolt; NAVAL POSTGRADUATE SCHOOL MONTEREY CA DEPT OF COMPUTER SCIENCE
|
| Over the past decade, the U.S. Government has not been significantly involved in high assurance Trusted Computing acquisitions and research. During this time, the Government's focus on commercial off the shelf procurements helped to fuel explosive advances in commercial technology, but it also contributed to the lack of progress in the ability of commercial systems to appropriately protect themselves and the data with which they are entrusted. While industry has ... |
|
| Information System Security: Government Information Security Reform Act Implementation: Defense Security Assistance Management System |
30 AUG 2002 |
31 pages |
| Authors:
Shelton R. Young; Kimberley A. Caprio; Tilghman A. Schraden; Kathryn L. Palmer; Walter S. Bohinski; INSPECTOR GENERAL DEPT OF DEFENSE ARLINGTON VA
|
| To gather data on assessments of the effectiveness of DoD information assurance policies, procedures, and practices, DoD developed a GISR Act collection matrix for automated information systems. DoD selected a sample of 560 automated information systems from the almost 4,000 automated information systems in DoD. For those 560 systems, DoD reported the aggregate results of the assessments for FY 2001 in "GISR Report FY01: Government Information Security Reform Act, Report ... |
|
| Damage Assessment and Recovery from Information Warfare Attacks |
27 AUG 2002 |
6 pages |
| Authors:
Brajendra Panda; Thomas Wiggins; NORTH DAKOTA STATE UNIV FARGO DEPT OF COMPUTER SCIENCE AND OPERATIONS RESEARCH
|
| Sensors at different Air Force operation sites collect information on various system parameters and send to the Air Force Computer Emergency Response Team (AFCERT) for analysis. Due to the massive amount and complex nature of data involved, this process, however, is inefficient and time consuming. It is rather desirable that each site pre-processes the data before transmitting to the AFCERT. For efficient processing of data at both local and global ... |
|
| EXPORT CONTROLS: More Thorough Analysis Needed to Justify Changes in High Performance Computer Controls |
AUG 2002 |
36 pages |
| Authors:
GENERAL ACCOUNTING OFFICE WASHINGTON DC
|
| In January 2002, the President announced that the control threshold above which computers exported to countries such as China, India, and Russia would increase from 85,000 MTOPS to 190,000 MTOPS. When the President changes the threshold, the National Defense Authorization Act of 1998 requires that the President provide a justification to Congress. The justification should, at a minimum, address the extent to which computers capable of performance between the established ... |
|
Management and Standards
