NCJ Number
134920
Journal
Security Management Dated: (February 1992) Pages: 42,44-46
Date Published
1992
Length
4 pages
Annotation
Security, privacy, and integrity are related terms that refer to the policies and mechanisms that protect computer systems from outside intruders. A total computer security policy must balance the need-to-know requirements of the user with the sensitivity of the information he is allowed to access.
Abstract
Multilevel security systems working within the framework of a total policy can provide more secure and cost-effective methods of managing information. The multilevel security mode of operation increases flexibility and offers significant cost benefits. Computer security managers need to consider the goals of their organization, the value of the company's information assets, the vulnerabilities of their current system or network, the physical environment in which their system operates, their visitor and personnel screening process, and the potential costs of a security breach. Before determining what their specific needs are, managers must understand some basic terms including least privilege, discretionary access, labeling, mandatory access, accountability, assurance, integrity, and encryption. Beneficial techniques for a computer security program recommended by the author include limiting terminal access, auditing, and limiting log-on attempts.