NCJ Number
62304
Date Published
1979
Length
9 pages
Annotation
AUTOMATED COMPUTER SECURITY ANALYSIS TECHNIQUES ARE DISCUSSED, AND THE DEVELOPMENT AND APPLICATION OF A SERIES OF SIMULATION CODES USED IN COMPUTER SECURITY ANALYSIS AND DESIGN ARE DESCRIBED.
Abstract
GREATER DEPENDENCE IS BEING PLACED ON COMPUTERIZED SYSTEMS FOR SAFEGUARDING ORGANIZATIONS IN BOTH PRIVATE AND PUBLIC SECTORS AND FOR SAFEGUARDING NUCLEAR MATERIALS. THE COMPUTER SECURITY SIMULATION KNOWN AS SECSIM ESTABLISHES A DECISION FRAMEWORK TO ANALYZE SECURITY RISKS IN TERMS OF THE ACTUAL OR PERCEIVED VALUE OF WHAT IS TO BE PROTECTED. THIS IS FOLLOWED BY AN EXAMINATION OF THE THREAT ENVIRONMENT AND THE INCORPORATION OF COUNTERMEASURES TO REDUCE THE PROBABILITY OF PENETRATION IN EACH THREAT AREA. CONCEPTUAL DESIGNS FOR POTENTIAL SYSTEM ARCHITECTURES HAVING IMPROVED PROTECTION MECHANISMS ARE THEN BUILT INTO SECSIM SECURITY MODULES. A SECURITY SIMULATION PROFILE CAN BE GENERATED FROM SECSIM MODULES THAT INDICATES STRENGTHS AND WEAKNESSES OF A PROTECTIVE SYSTEM. A RELIABILITY SIMULATION CODE KNOWN AS RELSIM GENERATES PROJECTIONS OF RELIABILITY PERFORMANCE FOR COMPUTER SYSTEMS AND ASSOCIATED NETWORK ARCHITECTURES. SECSIM PROGRAMS ARE CAPABLE OF RUNNING IN REAL TIME TO GIVE CURRENT ESTIMATES OF SYSTEM EFFECTIVENESS IN A DYNAMIC THREAT/COUNTERMEASURE ENVIRONMENT. AS INDIVIDUAL PROTECTION LEVELS CHANGE, SECSIM MODULES CAN BE RECONFIGURED AND RERUN TO GENERATE AN UPDATED SECURITY PROFILE. BECAUSE SECSIM PROGRAM MODULES ARE WRITTEN IN FORTRAN, THEY ARE PORTABLE AND CAN BE RUN ON MOST LARGE (MAINFRAME) MACHINES AND MINICOMPUTERS. THEY DO NOT DEPEND UPON THE EXISTENCE OF AUXILIARY SIMULATION CODES. FACILITY INDEXES DERIVED USING AUTOMATED COMPUTER SECURITY ANALYSIS SHOULD BE VIEWED AS EXTREMELY SENSITIVE INFORMATION BECAUSE THEY REPRESENT THE VERY ESSENCE OF FACILITY VULNERABILITY. SUPPORTING DATA AND ILLUSTRATIONS ARE PROVIDED, AND REFERENCES ARE CITED. (DEP)