Evaluation, Assurance, Classified Systems.ppt

CS 996 Information Security Management Evaluation, Assurance, Classified Systems Dr. William Hery hery@ CS 996 Spring 2004 Terminology Security Capabilities are what a product is supposed to do for security Assurance is the level of trust that it really does Assurance is the hard problem! Evaluation is the process of determining the assurance level of a product Certification and Accreditation is the process of deciding that an entire system is secure enough to process a given class of data (this is in a later talk) The NSA on Assurance A lot of you are making security products that are an att