Handbook of Infosec Terms 2.0

home *** CD-ROM | disk | FTP | other *** search

/ Handbook of Infosec Terms 2.0 / Handbook_of_Infosec_Terms_Version_2.0_ISSO.iso / text / csspab / 90-rpt.txt < prev next >

Wrap

Text File | 1995-09-15 | 117.0 KB | 2,834 lines

1990 Annual Report of the National Computer System Security and Privacy Advisory Board March 1991 TABLE OF CONTENTS Executive Summary. . . . . . . . . . . . . . . . . . . . . . . i I. Introduction . . . . . . . . . . . . . . . . . . . . . . . 1 Board's Establishment and Mission . . . . . . . . . . 1 Board's Charter . . . . . . . . . . . . . . . . . . . 1 Membership. . . . . . . . . . . . . . . . . . . . . . 2 II. Major Issues Discussed. . . . . . . . . . . . . . . . . . 4 NIST's Computer Security Budget . . . . . . . . . . . 4 Data Categorization . . . . . . . . . . . . . . . . . 4 E-Mail Security and Privacy . . . . . . . . . . . . . 5 Computer Security Evaluation Criteria . . . . . . . . 5 Computer Security Guidelines (Handbook). . . . . . . 6 III. Advisory Board Correspondence. . . . . . . . . . . . . . 7 NIST's Computer Security Budget . . . . . . . . . . . 7 Development of Computer Security Guidelines . . . . . 7 Information Technology Security Evaluation Criteria . . . . . . . . . . . . . . . . . . . . 7 Exhibits. . . . . . . . . . . . . . . . . . . . . . . 8 IV. Future Advisory Board Activities. . . . . . . . . . . . . 31 V. Conclusions. . . . . . . . . . . . . . . . . . . . . . . . 33 Appendices . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Executive Summary This Annual Report documents the activities of the National Computer System Security and Privacy Advisory Board during 1990, its second year. The Board, which met three times during the year, was established by Congress through the Computer Security Act of 1987 to identify emerging computer security issues. Dr. Willis Ware of RAND has served as Chairman of the Board since March of 1989. The Board formally identified three areas of emerging concern and has issued letters containing the Board's positions and recommendations to appropriate executive and congressional officials. These were: - NIST's Computer Security Program Budget; - the Information Technology Security Evaluation Criteria; and - the Need for Computer Security Guidelines. The Board also established a work plan for 1991 which identified candidate topics for in-depth examination, including: - Computer Security Guidelines - NIST Plans and Activities; - Privacy - EC Green Paper; - Implementation of the Computer Security Act of 1987; - Software Engineering and Reliability; - Security and the Public Switched Network; - Use of Security Products and Features; - Rewrite of NSDD-145 and the NIST/NSA Memorandum of Understanding; - Computer Emergency Response Team (CERT); - Digital Signature; and - International Hacking. With such a list of important topics to examine, plus the ever growing relevant new issues and public policy questions, it is clear that much work lies ahead for the Board in 1991 and beyond. I. Introduction Board's Establishment and Mission The passage of the Computer Security Act of 1987 (P.L. 100-235, signed into law on January 8, 1988 by President Reagan) established the Computer System Security and Privacy Advisory Board. The Board was created by Congress as a federal public advisory committee in order to: identify emerging managerial, technical, administrative, and physical safeguard issues relative to computer systems security and privacy. Appendix A includes the text of the Computer Security Act of 1987, which includes specific provisions regarding the Board. The Act stipulates that the Board: - advises the National Institute of Standards and Technology and the Secretary of Commerce on security and privacy issues pertaining to federal computer systems; and - reports its findings to the Secretary of Commerce, the Director of the Office of Management and Budget (OMB), the Director of the National Security Agency (NSA), and appropriate committees of Congress. Board's Charter The Board was first chartered on May 31, 1988 and was rechartered on May 30, 1990 by U.S. Department of Commerce Assistant Secretary for Administration Thomas Collamore. (See Appendix B for the text of the current charter.) It should be noted that because of the time necessary for the rechartering, the Board meeting scheduled for June could not be officially noticed in the Federal Register. Since a committee must have a current charter in order to notice a meeting, and since at least 15 days notice is required, the decision was made on May 8, 1990 to cancel the June meeting. Consistent with the Computer Security Act of 1987, the Board's scope of authority extends only to those issues affecting the security and privacy of unclassified information in federal computer systems or those operated by contractors or state or local governments on behalf of the federal government. The Board's authority does not extend to private sector systems (except those operated to process information for the federal government) or systems which process classified information or Department of Defense unclassified systems related to military or intelligence missions as covered by the Warner Amendment (10 U.S.C. 2315). Membership The Board is composed of twelve computer security experts in addition to the Chairperson. The twelve members are, by statute, drawn from three separate communities: - four experts from outside the federal government, one of whom is a representative of a small- or medium- size firm; - four non-government employees who are not employed by or a representative of a producer of computer or telecommunications equipment; and - four members from the federal government, including one from the National Security Agency of the Department of Defense. Currently, Dr. Willis H. Ware, a senior researcher of the Corporate Research Staff of RAND, serves as Chairman of the Board. He was appointed in July 1989 following consultation with Congress which determined that it was inappropriate for a NIST official to chair the Board. As of December 1989, the full membership of the Board was as follows: - Chairman Willis H. Ware, RAND - Federal Members Bill D. Colvin, National Aeronautics and Space Administration Roger M. Cooper, Department of Agriculture Patrick Gallagher, National Security Agency (nominated) Rhoda R. Mancher, Department of Veterans Affairs - Non-federal, Non-Vendor Robert H. Courtney, RCI Inc. John A. Kuyers, Ernst and Young (renominated) Eddie L. Zeitler, Fidelity Security Services, Inc. (vacancy) - Non-federal Steven B. Lipner, Digital Equipment Corp. Lawrence L. Wills, International Business Machines Corp. Jack L. Hancock, Pacific Bell (vacancy) NIST's Associate Director for Computer Security, Mr. Lynn McNulty, serves as the Board's Secretary and is the Designated Federal Official (DFO) under the Federal Advisory Committee Act. The DFO is responsible for ensuring that the Board operates in accordance with applicable statutes and agency regulations. Additionally, the DFO must approve each meeting and its agenda. Through the Secretariat, NIST provides financial and logistical support to the Board as stipulated by the Computer Security Act of 1987. During 1990, the terms of Mr. Walter Straub (Rainbow Technologies, Inc.) and Mr. Robert Morris (National Security Agency) expired. Additionally, Mr. Jack Simpson (Mead Data Central, Inc.) resigned on March 9, 1990. NSA chose Mr. Patrick Gallagher, Director of the National Computer Security Center, as their designated representative member on the Board. As of December, 1990, NIST's nominations to fill existing Board vacancies were still being processed. II. Major Issues Discussed The following section summarizes the discussions held by the Board in 1990. Additionally, the Board accomplishes a lot of informal, non-decisional, background discussion and preparation for meetings by e-mail between meetings. The Board's activities also complement the other activities of the Board's members, several of whom are quite active in many aspects of these topics. Note that the minutes and agenda from the March, September, and December meetings are included as Appendices C to E, respectively. The required Federal Register notices for the meetings are presented in Appendix F. The substantive work of the Board during 1990 was devoted to various topics related to the security of federal unclassified automated information systems. Among the most important were: - NIST's Computer Security Program Budget; - Data Categorization; - E-Mail Privacy and Security; - Computer Security Evaluation Criteria; and - Computer Security Guidelines. NIST's Computer Security Budget In 1989, the President had requested a substantial increase for NIST's computer security program. In late September 1989, the proposed increase for NIST's computer security program was cut by conference committee action. This led to discussions among Board members as to the inadequacy of the current budget, $2.5 million at the time. The Board decided at its December 1989 meeting to send a letter to Congress stressing the need for a higher funding level. The letters could not be formally approved until March 1990 since the letters had to be adopted by the Board in open session. The President's budget for FY-91 requested an increase for the computer security program, which ultimately resulted in an increased $1 million for the program. Data Categorization Since June of 1989, the Board has discussed the issue of data categorization of unclassified information. This topic continued to be one of interest in 1990, although members of the Board hold widely divergent opinions as to the desirability and feasibility of developing a standard government-wide categorization scheme. During the year, several Board members argued against the desirability of defining or categorizing sensitive information. The essence of their position was that all information held by government agencies has some degree of sensitivity, as defined in terms of its unauthorized disclosure, loss of integrity, or inadvertent or intentional destruction. It was stated that in most instances the development of sensitivity policies have focused entirely upon the confidentiality aspects of the problem to the exclusion of integrity and availability requirements. Any Board recommendation would serve to continue this pattern of confusing the fundamental security issues affecting the protection of unclassified information. The underlying concern was to develop a policy that would supplement the requirement expressed in the Computer Security Act of 1987 to protect "sensitive" information. In December 1990, during an extensive session on the topic, representatives from five government agencies were invited to share their positions on the topic with the Board. As with the Board itself, their positions varied; however, while most believed that such a scheme would be useful, they disagreed as to the feasibility of actually developing a scheme that would be useful across all agencies. A representative from the Canadian government also shared their experiences with a statutory based categorization scheme which is working very well. The Board continues to examine this issue recognizing the importance of this issue and its far reaching implications. As of December, the Board asked two of its members to look further into the issue and report back in March 1991. E-Mail Security and Privacy At the suggestion of Mr. Cooper at the September meeting, the Board developed a session to e-mail privacy and security issues at the December meeting. The Board heard from representatives of the E- Mail Industry Association, American Bar Association, and a public interest group, the Computer Professionals for Social Responsibility. Action by the Board on this matter was anticipated for 1991. Computer Security Evaluation Criteria Two distinct items are included in this category: 1) the European- developed draft Information Technology Security Evaluation Criteria (ITSEC) and the NIST response to that document and 2) the NIST and NSA effort to develop appropriate standards and guidelines for U.S. Government use. At the September meeting, the Board examined the ITSEC and heard one vendor's reactions to it. The Board also was presented with NIST's official position on the document as relayed to the Europeans in a letter in August. In December, NIST provided the Board with an update on the ITSEC's progress and the European Community-sponsored conference held in Brussels in September on it. The Board was also informed of efforts by NIST and NSA to arrive at a common response to the ITSEC. The Board, agreeing on the significance of the ITSEC effort and resulting possible implications for U.S. international trade, voted to send a letter to the Secretary of Commerce outlining their position on the U.S. government's role. (See next chapter for text of the letter and the response.) Intertwined with the ITSEC topic was a discussion of what NIST should be doing, if anything, to develop a appropriate standards and guidelines for the federal government's use. Positions ranging from the need to modify the Orange Book to the non-usefulness of such a document were vigorously debated. In December, NIST and NSA announced their joint effort to develop a single federal criteria document, which would not begin with the Orange Book as an initial approach. NIST stressed that there was much that could be learned from users of trusted systems and that it would be holding a conference to gather the "lessons learned." Computer Security Guidelines (Handbook) In mid-1990, Mr. Courtney suggested to Board members that they endorse a recommendation to NIST to develop a set of computer security guidelines to aid federal agencies in the selection of cost-effective security measures. He also prepared a draft outline for NIST's use. After discussion of the outline at the September meeting, and minor modifications, the Board recommended to the Director of NIST that he give the development of such a document high priority. The Director responded that NIST would be examining ways to meet the need addressed by the Board. III. Advisory Board Correspondence During FY-89, the Board issued letters reporting the Board's findings on the three important issues: - the level of funding of NIST's computer security program budget; - the draft European Information Technology Security Evaluation Criteria; and - the development of computer security guidelines. Also, the Chairman conducted correspondence with the Department of Commerce's General Counsel regarding the legal constraints on the Board. Finally, the Secretary of Commerce forwarded the Board's 1989 Annual Report to the Congress and Administration officials. NIST's Computer Security Budget On April 20, 1990, the Board issued a letter to Congressional officials on the state of NIST's computer security program budget and recommended that it be increased, as the President requested in his FY-91 budget request. The Board's letter was forwarded to the Congress by the Secretary of Commerce. The increase was ultimately approved and in FY-91 the program budget was increased by $1 million to $3.5 million. Development of Computer Security Guidelines On October 10, 1990, following action at its September meeting, the Board issued a letter to the Director of NIST recommending that NIST develop and issue a comprehensive set of computer security guidelines. The Board also provided NIST with a proposed outline of the envisioned publication. On October 26, 1990, Dr. Lyons responded that he was reviewing alternatives to meet the need developed by the Board. NIST now plans to use the outline as the basis for a Computer Security Handbook, to be developed under contract to NIST. Information Technology Security Evaluation Criteria The Board also issued its findings on October 20, 1990, regarding the draft European-developed Information Technology Security Evaluation Criteria document. The Board recommended that this important trade issue be coordinated among all concerned federal agencies. Also, the Board sought active protection of U.S. interests via the International Standards Organization process. Secretary of Commerce Mosbacher replied on December 18, 1990 that the Department would be following this important issue. Exhibits The Board's correspondence and replies (when received) are included in the following exhibits: Exhibit I Apr 20, 1990 Budget letter from Chairman Ware (No replies were received.) Exhibit II May 22, 1990 Budget letter from Secretary of Commerce Mosbacher to the Honorable Robert C. Byrd, et al. Exhibit III May 24, 1990 Transmittal of 1989 Annual Report by Secretary Mosbacher (No replies were received.) Exhibit IV Apr 9, 1990 Letter from Chairman to U.S. Department of Commerce General Counsel on legal issues Exhibit V May 17, 1990 Answer from General Counsel to Chairman Ware Exhibit VI Oct 10, 1990 Chairman's letter to NIST Director Lyons regarding computer security guidelines (Handbook) Exhibit VII Oct 20, 1990 Board letter to Secretary Mosbacher regarding the Information Technology Security Evaluation Criteria Exhibit VIII Oct 26, 1990 answer to the Board from NIST Director Lyons Exhibit IX Dec. 18, 1990 answer from Secretary Mosbacher to the Board Exhibit I THE NATIONAL COMPUTER SYSTEM SECURITY AND PRIVACY ADVISORY BOARD Established by the Computer Security Act of 19877 APR 20 190 Honorable Robert C. Byrd Chairman, Committee on Appropriations United States Senate Washington D.C. 20510-6025 Dear Mr. Chairman: The Computer System Security and Privacy Board, established under Section 21 of the Computer Security Act of 1987 (P.b. 100-235], herewith conveys its finding, as stipulated under Section 21(b) (3) of the Act, on the issue of budget support for the National Institute of Standards and Technology (NIST), I and its National Computer Systems Laboratory (NCSL). Through the Act, Congress assigned to the NIST/NCSL responsibility in Section 20(a) "to (develop] standards, guidelines, .... methods and techniques for cost-effective security...(in Federal computer systems]." At our recent meetings, the Board discussed the funding level of NIST/NCSL for the computer security program to meet the Congressionally mandated goal. Congress did not provide FY-90 funding commensurate with the relevant technical and managerial issues that must be addressed. The Board believes that the current funding level of 52.5 million for the NIST/NCSL computer security program is inadequate, a view consistent with the White House support of a $6.0 million funding level in FY-90. With limited funding, Congress must appreciate that issues which led to the passage of legislation will not be promptly addressed, and that adequate solutions will be delayed. With the integration of computer systems into all aspects of our daily lives and the national economy, the failure to address system protection and security controls could have potentially serious consequences for the nation. Moreover, money spent on improving the security posture of government computer systems will be more than recouped from savings that result from more effective and safer system operation with more reliable and accurate data. For these reasons, we solicit your support for the President's proposal to increase FY-91 funding to the NIST/NCSL program. The Board is available to explore the issue further or to amplify its views on the matter. Sincerely, Willis R. Ware Chairman Addressees to receive the recommendations on the computer security budget of the National Institute of Standards and Technology, U.S. Department of Commerce, from the Computer System Security and Privacy Advisory Board: Honorable Ernest F. Hollings Chairman, Committee on Commerce, Science, and Transportation United States Senate Washington, D.C. 20510-6125 Honorable Jamie L. Whitten Chairman, Committee on Appropriations House of Representatives Washington, D.C. 20515-6015 Honorable Robert A. Roe Chairman, Committee on Science, Space, and Technology House of Representatives Washington, D.C. 20515-6301 Honorable John Conyers, Jr. Chairman, Committee on Government Operations House of Representatives Washington, D.C. 20515-6143 Exhibit II May 22, 1990 Honorable Robert C. Byrd Chairman, Committee on Appropriations United States Senate Washington, DC 20510-6025 Dear Mr. Chairman: I am please to submit the enclosed report on the computer security budget for the National Institute of Standards and Technology from the Computer System Security and Privacy Advisory Board, U.S. Department of Commerce, in compliance with the Computer Security Act of 1987. Sincerely Robert A. Mosbacher Honorable Robert C. Byrd Chairman, Committee on Appropriations United States Senate Washington, DC 20510-6025 Honorable Ernest F. Hollings Chairman, Committee on Commerce, Science and Transportation United States Senate Washington, D.C. 20510-6125 Honorable Jamie L. Witten Chairman, Committee on Appropriations House of Representatives Washington, D.C. 20515-6301 Honorable Robert A. Roe Chairman, Committee on Science, Space, and Technology House of Representatives Washington, DC 20515-6301 Honorable John Conyers, Jr. Chairman, Committee on Government Operations House of Representatives Washington, D.C. 20515-6143 Exhibit III May 24 1990 Honorable John Conyers, Jr. Chairman, Committee on Government Operations House of Representatives Washington, D.C. 20515-6143 Dear Mr. Chairman: I am pleased to submit the Annual Report of the Computer System Security and Privacy Advisory Board, U.S. Department of Commerce, for calendar year 1989, in compliance with the Computer Security Act of 1987. Sincerely, Robert A. Mosbacher Honorable Robert C. Byrd Chairman, Committee on Appropriations United States Senate Washington D.C. 20510-6025 Honorable Ernest F. Hollings Chairman, Committee on Commerce, Science, and Transportation United States Senate Washington, D.C. 20510-6125 Honorable Jamie L. Whitten Chairman, Committee on Appropriations House of Representatives Washington, D.C. 20515-6015 Honorable Robert A. Roe Chairman, Committee on Science, Space, and Technology House of Representatives Washington, D.C. 20515-6301 Exhibit IV THE NATIONAL COMPUTER SYSTEM SECURITY AND PRIVACY ADVISORY BOARD Established by the Computer Security Act of 1987 APR 09 1990 Wendell L. Willkie II, Esquire General Counsel U.S. Department of Commerce Washington, DC 20230 Dear Mr. Willkie: During a recent meeting of the Computer System Security and Privacy Advisory Board (CSSPAB) established under Section 3 of the Computer Security Act of 1987 (Public Law 100-235), several items of CSSPAB functioning were discussed at length in public session with Mr. Michael Rubin of your office. Admittedly, some of these things are interpretive in nature or even uncertain in view of the words of the law and its legislative history. Accordingly, on behalf of the Board, I am formally soliciting an official departmental written legal opinion on the following questions. Your guidance will great. assist the effective functioning of the CSSPAB and will hopefully resolve confusion which has arisen as to its proper role, relationship to the Department of Commerce, and obligations under various laws. l. What is the relationship between the CSSPAB and the Federal Advisory Committee Act? Is it necessary that the CSSPAB be established pursuant to the procedures of the Federal Advisory Committee Act, or does the Computer Security Act in and of itself provide a sufficient basis for the CSSPAB to function? 2. In view of the wording of PL 100-235, what is the relationship between the CSSPAB and the Department of Commerce? Although the CSSPAB resides within the Department, does it follow that the Department must establish the CSSPAB's charter and set its agenda? To what degree does the Board have any independence from the Department? Do the members of the Board have the power to amend the CSSPAB's charter? To what extent are the DOC administrative review and approval procedures for correspondence relevant to CSSPAB? 3. The duties of the CSSPAB include the statutory responsibility to report its findings to the Secretary of Commerce, the Director of the Office of Management and Budget, the Director of the National Security Agency, and appropriate the committees of the Congress. The question has arisen whether these reporting requirements are sequential or concurrent. Can the CSSPAB, for example, reports its findings directly to the Congress or must it report its findings to Congress through the Secretary? Is it legally Significant that Congress did not use the preposition "through" but Stated "to...the Congress" when it described the Board's reporting requirements? 4. The CSSPAB is Comprised of the Chairman and twelve members, four of whom are required to be Federal employees. If the Board were to make findings Concerning a specific legislative proposal affecting computer security and Communicated these findings in its reports to Congress, how can the Board protect its Federal members from running afoul of the anti- lobbying provisions of 18 USC 1913? Must the Federal members abstain from all votes affecting legislative issues? 5. The non-Federal members are concerned over the application of the Procurement Integrity Act to their activities with the Board. While the PIP Act has been suspended for one year, there was an overlap period of time in which the statute was in existence. We would like a summary of the Act's application to our activities during that period of time. I would appreciate your prompt consideration of these questions In the event it is considered inappropriate for the Commerce General Counsel to provide advice to the Board on these issues, who would be the proper authority? Would it be inappropriate for the CSSPAB to seek legal advice from the Office of Legal Counsel of the Justice Departments Would it be wise to Solicit an opinion from the DOJ in addition to that from your office? I thank you in advance for your time and consideration of these issues. Your guidance is much appreciated. Sincerely, Willis H. Ware Chairman Exhibit V UNITED STATES DEPARTMENT OF COMMERCE Office of the General Counsel Washington. D.C. 20230 MAY 17 1990 Mr. Willis H. Ware The National Computer System Security and Privacy Advisory Board NIST Technology Building, Room B154 Gaithersburg, Maryland 20899 Dear Mr. Ware: This is in response to your letter to the General Counsel requesting a written opinion on several issues concerning the status and operation of the Computer Systems Security and Privacy Advisory Board (CSSPAB) (Board). for the sake of clarity, each of your questions is set forth below, followed by the corresponding answer. Question 1 What is the relationship between the CSSPAB and the Federal Advisory Committee Act? is it necessary that the CSSPAB be established pursuant to the procedures of the Federal Advisor Committee Act, or does the Computer Security Act in and of itself provide a sufficient basis for the CSSPAB to function? Answer The Computer Security Act of 1987 provides for the establishment of the CSSPAB. P.L. 100-235, 3(2) , 101 Stat. 1727, 15 U.S.C. s 278g-4. The Board consists of a chairman, eight members from outside the Federal government and four members from the Federal government. The members are appointed by the Secretary of Commerce. The duties of the CSSPAB are: 1) to identify emerging managerial, technical, administrative, and physical safeguard issues relative to computer system security and privacy; 2) to advise the National institute of Standards and Technology and the Secretary of Commerce on security and privacy issues pertaining to Federal computer systems; and 3) to report its findings to the Secretary of Commerce, the Director of the Off ice of Management and Budget, the Director of the National Security Agency, and the appropriate committees of the Congress. 15 U.S.C. S 278g-4(b). The Federal Advisory Committee Act (FACA) (5 U.S.C. App. 2) imposes certain procedural and administrative requirements on advisory committees. The definition of advisory committee includes any committee, board, commission, conference, panel, task force, or other similar group established by statute in the interest of obtaining advice or recommendations for any Federal agency. 5 U.S.C. App. 2 S 3(2). The requirements of the FACA are applicable to every advisory committee "except to the extent that any Act of Congress establishing such advisory committee specifically provides otherwise." 5 U.S.C. App. 2 4. Since the CSSPAB is tacked with advising the National institute of Standards and Technology (NIST) and the Secretary of Commerce on security and privacy issues pertaining to Federal computer systems, it is an advisory committee. The legislation establishing the CSSPAB provides that it is established within the Department of Commerce. 15 U.S.C. 278g-4(a). The legislation also does not exempt the CSSPAB from any of the FACA's provisions. Consequently, the FACA's requirements are fully applicable to the CSSPAB. The CSSPAB is subject to all of the provisions of the FACA and the CSSPAB cannot meet or take any other action until the procedural and administrative requirements of the FACA have been satisfied. Question 2 in view of the wording of PL-235, what is the relationship between the CSSPAB and the Department of Commerce (DOC)? Although the CSSPAB resides within the Department, does it follow that the Department must establish the CSSPAB's charter and set its agenda? To what degree does the Board have any independence from the Department. Do the members of the Board have the power to amend the Board's charter? To what extent are the HOC administrative review and approval procedures for correspondence relevant to CSSPAB? Answer As stated above, the CSSPAB is an advisory committee Within.the Department of Commerce. The FACA requires each agency to "exercise control and supervision over the establishment, procedures, and Accomplishments of advisory committees established by that agency." 5 U.S.C. App. 2 S 8(b). Agencies are also required to file a charter for each advisory committee. ID. 9(c). Charters for advisory Committees over which the Department has jurisdiction are required to be prepared and filed in accordance with the procedures set forth in Part 2, Chapter 2, Section 3 of the Departments (Committee Management handbook. The CSSPAB's charter must be prepared and filed in accordance with these procedures. The FACA also provides that a designated Federal official or employee must attend each meeting of an advisory Committee and that no advisory committee shall conduct any meeting in the absence of that officer or employee. Advisory committees are prohibited from holding meetings except with the advance approval of the designated Federal official. Further, the agenda of every advisory committee meeting must be approved by this official. 5 U.S.C. App. 2 S 10 (e), (f). Accordingly, the CSSPAB is prohibited from operating independently of the Department of Commerce. The meetings and agenda of CSSPAB must be approved by the appropriate Department official. The CSSPAB's charter also cannot be amended by the members. Any charter amendment must be effected in accordance with the procedures set forth in Part Two, Chapter Two, Section D of the Department's Committee Management Handbook, which requires the approval of amendments by the Assistant Secretary for Administration. Likewise, since the CSSPAB reports through the Director of NIST, the administrative review and approval procedures applicable to the correspondence of advisory committees within the jurisdiction of the Department are fully applicable to the CSSPAB Question 3 The duties of the CSSPAB include the statutory responsibility to report its findings to the Secretary of Commerce, the Director of the Office of Management and Budget, the Director of the National Security Agency and the appropriate committees of Congress. The question has arisen whether these reporting requirements are sequential or concurrent. Can the CSSPAB, for example, report Its findings directly to Congress or must it report its findings to Congress through the Secretary? is it legally significant that Congress did not use the preposition "through" but stated "to.....the Congress" when it described the Board's reporting requirements? Answer The Computer Security Act does require the CSSPAB to report to several entities in addition to the Secretary of Commerce. However, nothing in the legislation or in the legislative history indicates that the reporting to the various entities is to be concurrent. Although the statute establishing the CSSPAB does not explicitly require that all reports shall be made through the Department, the reporting requirements must be viewed in light of the placement of the CSSPAB within the Department of Commerce. The CSSPAB is required to submit its reports in accordance with the CSSPAB charter. The charter provides that the Board report "through the Director of [NIST]." This requirement is consistent with the position of the CSSPAB as an advisory committee within the Department. Thus, the CSSPAB cannot report directly to Congress but must report through the Director of NIST as required by the CSSPAB charter. We view the requirement that the CSSPAB report to entities other than the Secretary as an expression of congressional intent that the other entities be kept informed, not as a mandate for the CSSPAB to operate independently of the Department in which it has been established. Question 4 The CSSPAB is comprised of the Chairman and twelve members, four of whom are required to be Federal employees. If the Board were to make findings concerning a specific legislative Proposal affecting computer security and communicated these findings in its reports to Congress, how can the Board protect its Federal members from running afoul of the anti-lobbying provisions of 18 U.S.C. 1913? Must the Federal members abstain from all votes affecting legislative issues? Answer 18 U.S.C. 1913 provides that: No part of the money appropriated by any enactment of Congress shall, in the absence of express authorization by Congress, be used directly or indirectly to pay for any Personal SerVice, advertisement,. telegram, telephone, letter, printed or written matter, or other device, intended or designed to influence in any manner a Member of Congress, to favor or oppose, by vote or otherwise, any legislation or appropriation by Congress, whether before or after the introduction of any bill or resolution proposing such legislation or appropriation; but this shall not prevent officers or employees of the United States or of its Departments or agencies from communicating to members of Congress on the request of any Member, or to Congress, through the proper official channels, requests for legislation or appropriations which they deem necessary for the efficient conduct of public business (emphasis added). This law specifically authorizes Federal officials to communicate their views on pending legislation to Congress "through proper official channels." The CSSPAB is required by law and its charter to report to the appropriate Committees of Congress regarding computer systems security and privacy issues. The CSSPAB may have occasion to make findings or recommendations regarding specific legislative proposals affecting computer security. The communication of any such findings or recommendations in a report to Congress (through the Director of NIST as required by the CSSPAB charter) would be a communication through a proper official channel. Consequently, the Federal members.of the CSSPAB would not be in contravention of 18 U.S.C. S 1913 and need not abstain from votes affecting legislative issues. Question 5 The Non-Federal members are concerned over the application of the Procurement integrity Act to their activities with the Board. while the PIP Act has been suspended for one year, there was an overlap period of time in which the statute was in existence. We would like a summary of the Act's application to our activities during that period of time. Answer The Procurement Integrity Act of 1988 became effective July 16, 1989. Congress suspended the provisions of the Act from December 1, 1989 through November 30, 1990. The Administration hopes that before November 30th, new legislation will be enacted to supersede the more troublesome aspects of the suspended Act. It is expected that any new legislation would exempt members of advisory boards or committees from its coverage. As you recognize, between July 16, 1989 and November 30, 1989, the Act affected the activities of any procurement of official who participated personally and substantially in any phase of an agency procurement. For purposes of the Act, procurement officials of an agency included consultants, experts, or advisers (other than a competing contractor) who acted on behalf of, or provided advice to, the procuring agency with respect to a procurement. You must therefore determine whether non-Federal Board members participated personally and substantially in the conduct of any Federal agency procurement. Personal and substantial participation in a procurement may have occurred if Board members provided advice to an agency about contract specifications or related procurement matters between July 16, 1989, and November 30, 1989. If a Board member's advice constituted active and significant involvement in activities directly related to a procurement, the Board member became a procurement official for purposes of that procurement. As a procurement official, the Board member's activities were affected in the following ways: o He was barred from seeking employment with or business opportunities from a competing contractor or its agents until December 1, 1989 or the conclusion of the procurement, whichever event came first. o He was prohibited from participating in any manner on behalf of a competing contractor in negotiations leading to the award, modification, extension of a contract for such procurement until December 1, 1989. o He was prohibited from participating personally and substantially on behalf of the competing contractor in the performance of such contract until December 1, 1989. o He was barred-from seeking or receiving, directly or indirectly, any money, gratuity, or other thing of value from any competing contractor or its agents. In addition, any member of the Board who was given authorized or in addition, any proprietary Unauthorized access to or source selection information regarding any agency procurement was barred from knowingly disclosing such information, directly or indirectly, to any person other than a person authorized by the head of such agency or the contracting officer to receive such information. This prohibit. applied without regard to one's status a£ a procurement official Should the suspended Act take effect again on November 30, 1990, questions might arise about its continuing application to activities that occurred between July 16, 1989 and November 30, 1989. In this event, you might wish to consult us for additional advice. As a final matter, let me assure you that it is entirely appropriate for the CSSPAB to seek advice from this office. Since the CSSPAB an advisory committee within the Department of Commerce, advice of its status and operation must be based upon an interpretation of Departmental requirements as well as the establishing legislation. Please feel free to contact this office again if you have additional questions on this matter. Sincerely, Dan Haendel Deputy General Counsel Exhibit VI THE NATIONAL COMPUTER SYSTEM SECURITY AND PRIVACY ADVISORY BOARD October 10, 1990 Dear Dr. Lyons: The Computer System Security and Privacy Advisory Board was established within the Department of Commerce by the Computer Security Act of 1987, P.L. 100-225. The charter of the Board establishes a specific objective for the Board to advise the national Institute of Standards and Technology (NIST) and the Secretary of Commerce on security and privacy issues pertaining to Federal computer systems. The purpose of this letter is to advise you of the unanimous concern of the Advisory Board that information security guidelines be written and published by FIST. We feel that these guidelines are a basic building block of the governments information infrastructure program and will provide the necessary detailed guidance to Federal agencies to ensure proper safeguards for unclassified systems. There are numerous laws and regulations requiring attention to computer security and privacy, but the missing link is the proposed FIST guidelines. 1. Privacy Act of 1974 (P.L. 92-579) -- Provides for the protection and accuracy of information about individuals. 2. Federal Managers Financial Integrity Act (P.L. 97-225) -- Requires the use of internal controls to reduce fraud, waste and abuse. 3. OMB Circular A- 123 -- Requires the establishment and periodic review of internal controls. 4. OMB Circular A-130 -- Assigns government-wide security responsibilities and describes minimum agency security program components. 5. OMB Circular 90-08 -- Provide guidance to Federal agencies on computer security Planning. 6. Computer security Act of 1987 (P.L. 100-235) -- Assigns primary responsibility for Providing guidance and assist for unclassified computer security. 7. President's FY-91 Budget, managing for Integrity and efficiency Section -- Describes the need for data integrity and accuracy Clearly the concerns of the Congress and the Office of Management and Budget regarding the need for improved computer security of the Government's unclassified systems have been repeatedly addressed. The Board shares these concerns and has identification the lack of a Comprehensive computer security guideline as adversely affecting the Government's ability to effectively and efficiently implement these laws and regulations. Such guidelines would have immediate government-wide benefits in the strengthening of Controls, resulting in improved computer security. Recognizing the technical and fiscal resource constraints of NIST, and other competing Priorities, the Advisory Board has independently Produced an outline of these guidelines (enclosed). We are now requesting that you recognize this need, and Consider whatever managerial alternatives are at your disposal to expedite the writing and issuance of these guidelines. Thank you for your time and consideration of. our recommendation I am available to discuss this with you at your convenience. Sincerely, Willis H. Ware Chairman Enclosure ENCLOSURE A SYSTEMATIC APPROACH TO INFORMATION SECURITY 1. Purpose It is intended that this document be used as a handbook to guide the selection and implementation of security measures in data processing and data communications environments. It does not provide exhaustive treatment of every aspect of computer and telecommunications security. It does provide references to other material which can be used to augment that presented here. A major difference between this material and other, similar efforts is that it offers guidance to specific references in its bibliography as a function of the particular problem being addressed. For example, if the problem is control of access to data at the record and field level , the reader will not be directed to the many papers on generalized access control at the file or data set levels, but rather to references to papers on only that aspect of access control. It has been our experience that it can be irritating and very time consuming to be given broadly-based references which force the reader to acquire and read many papers to find which, if any of them, contain the desired, specific information. 2. Scope It is intended that this handbook provide material and references which will assist in identifying, implementing, and assessing the relative cast and adequacy of security controls in data processing and telecommunications environments. 3. Definitions of Key Terms There is no broad agreement on what is meant by many of the most commonly used computer security-related terms, such as integrity, quality, value, accountability, auditability, access control, and even data and computer security. An understanding of such terms constitutes a virtual sine qua non for the usefulness of the following material. 4. Computer Security Policy Statements Treat here the need for policy statements, guidance in the preparation and issuance, and sample policies which have proven effective. Include here comments on enforcement. 5. Assigning Responsibility for Computer Security Guidance in the selection of organizational configurations for managing computer security programs and the assignment of responsibilities for security. 6. The Importance of a Rational and Systematic Approach to Computer Security Unless the computer security program is conceived as a wholly coherent, properly integrated set of measures it will not yield adequate security at a reasonable cost. This point must be made as forcefully as possible. This is a very important topic. There are virtually no steps-in-the-right. direction which are meaningfully effective until they have been augmented by other measures essential to their effectiveness. For example, we have seen many systems in which there have been implemented password schemes which do nothing, that is, they support neither access control nor activity logs. 7. Economics of Security It is important that those-securing systems understand that solutions to security problems which cost more than simply tolerating those same problems are not cost-effective. There are times when the implementation of controls which are not cost- effective are dictated by other considerations, but these are relatively rare and should be the exceptions rather than the rule. 8. Threats and Vulnerabilities It is all but impossible to implement cost-effective or even just adequately effective security measures without a proper understanding of the threats to and vulnerabilities of the systems involved. Failure to fully grasp both the threats and vulnerabilities seems to us.the greatest single cause for failures to properly secure information systems. 9. Risk Analyses This section should contain descriptions of and references to the more prominent or commonly used of the many different schemes for assessing risks in a data processing environment and some notes of caution about their use. 10. Human Resources 11. Employee Awareness Programs Treatment-of the need for, identification of materials and their sources, and suggestion for their use. 12. Data Categorization Here should be addressed the matter of marking or labelling data to indicate the nature and degree of their sensitivities. We use the term categorization to avoid using classification because that latter term has military or intelligence implications related to protection against only unauthorized disclosure. There are more data which are sensitive to accidental or intentional modification or destruction than there are data sensitive to disclosure. 13. Personal Identification and Authentication It is important to emphasize here the near-total dependence of many other controls on adequate personal identification schemes which are practicable of implementation in the work environments being secured. Fairly exhaustive treatment of the various schemes for personal identification is needed here without sending the reader to find too many other papers before he fully understands what this is all about. 13.1 Supporting physical security 13.2 Supporting system, application, data base and network protection 14. Access Control for the protection of: 14.1 system controls 14.2 data bases 14.3 applications 14.4 networks 15. Individual accountability (logging and log processing) 16. System Integrity 16.1 Hardware 16.2 Programs 16.2.1 System Control Programs 16.2.2 Application code 16.2.2.1 Purchased 16.2.2.2 In-House Generated 16.3 Physical Security 16.4 Contingency Planning 16.4.1 Emergency Response Measures 16.4.2 Back-Up Plans 16.4.3 Recovery Plans 16.5 Security Procedures and Practices 16.6 Protection against Electromagnetic or Acoustic Eavesdropping 16.7 Protection against Communications Intercept This section should include enough guidance in cryptography to understand those aspects essential to the selection and implementation of appropriate means. In addition, it should provide enough information to relieve fear that cryptography is too complex, costly or burdensome for most conventional systems. References to more detailed treatments of cryptography are important. 17. Message Authentication and Digital Signatures 18. Microcomputer Security Physical and logical. Include comments on legal/ethical issues involving software. 19. Security in Local Area Networks 20. Viruses, Worms, Trojan Horses, etc. 21. The importance of Federal, National and International Standards in the Selection and Implementation of Security Measures to Assure Quality and Availability 22. Monitoring Security Measures and Controls Describe here the very important role of the internal audit function in seeing that all appropriate security controls have been selected and implemented. Exhibit VIII UNITED STATES DEPARTMENT OF COMMERCE National Institute of Standards and Technology (formerly National Bureau of Standards) Gaithersburg, Maryland 20899 OFFICE OF THE DIRECTOR OCT 26 1990 Dr. Willis Ware Chairman, Computer System Security and Privacy Advisory Board The Rand Corporation 1700 Main Street P.O. Box 2138 Santa Monica, CA 90406-2138 Dear Dr. Ware: Thank you for your recent recommendation from the Computer System Security and Privacy Advisory Board on the need for the National Institute of Standards and Technology (NIST) to issue computer security guidelines. We at NIST share the Board's interest in seeing that timely computer security standards and guidelines are developed and promulgated. The outline developed by the Board appears to provide a useful framework for those seeking to utilize appropriate computer security measures. I will be meeting with James Burrows, Director of the National Computer Systems Laboratory, to discuss alternatives for the development of a document to meet the needs identified by the Board. I have asked him to keep the Board apprised of our progress on this matter. Let me take this opportunity to emphasize my appreciation for the continued efforts of the Board to improve the level of computer security in the federal government. I look for-bard to receiving further reports from the Board. Sincerely, John W. Lyons Director Exhibit IX THE NATIONAL COMPUTER SYSTEM SECURITY AND PRIVACY ADVISORY BOARD Established by the computer Security Act of 1987 OCT 20 1990 Honorable Robert A. Mosbacher Secretary of Commerce Washington, DC 20230 Dear Mr. Secretary: Pursuant to its responsibility under the Computer Security Act of 1987, the Computer System Security and Advisory Board wishes to call the following issue to your attention. The European Community has developed and circulated for comment a draft Information Technology Security Evaluation Criteria document. This proposed standard is similar to but different in important ways from the U.S. Trusted Computer System Evaluation Criteria. Both are intended as guidance to computer vendors in developing secure computer systems and products. Since much of U.S. industry is multi-national, the possibility of a European standard significantly different from a U.S. posture is an important issue. Such divergence could: a) Impact the ability of the U.S. computer industry to market in Europe; and b) Impact multi-national users who operate computer systems in various countries which may be required to use local Standardization. The situation is properly being monitored by the National Institute of Standards and Technology (NIST) and the National Computer Security Center of the National Security Agency (NSA). However, we believe this is an important emerging issue and therefore we strongly recommend that you: a) Actively coordinate this issue within the government including such departments as the U.S. Department of State, International Trade Administration and Office of the U.S. Trade Representative; and b) Actively protect the interests of U.S. industry via our international representation in the International Standards Organization arena. It is of the utmost national importance that the efforts of NIST and NSA be sustained, encouraged, and supported. Sincerely, Willis H. Ware Chairman Exhibit X December 18, 1990 Dr. Willis Ware Chairman, Computer System Security and Privacy Advisory Board c/o The Rand Corporation 1700 Main Street P.O. Box 2138 Santa Monica, CA 90406-2138 Dear Dr. Ware: Thank you for your letter regarding the recommendations of the Computer System Security and Privacy Advisory Board concerning the draft information Technology Security Evaluation Criteria developed by the European Community. I have asked the Office of the Under Secretary for Technology to examine the important issues raised in your letter. Also, the National Institute of Standards and Technology is working with the Europeans to address United States' concerns with their draft criteria. I would like to take this opportunity to express my appreciation for the continued efforts of the Board to improve the level of computer security in the federal government. I look forward to receiving further reports from you. Sincerely, Robert A. Mosbacher IV. Future Advisory Board Activities At its December meeting, the Board discussed a number of agenda topics for its 1990 meetings. Among the more important topics and questions of possible interest are: Computer Security Guidelines and Standards The Board would like to continue to receive updates of NIST plans and programs for an international solution/harmonization of computer security requirements and continue to monitor European developments. Also to be included are updates from NSA on Orange Book experiences and plans for any additional guidance and standards. NIST Plans and Activities Includes regular updates of status of completing guidelines document suggested by the Board and updates on current NIST projects and workplans, including priorities, schedule for rewrite of outdated guides, and work deferred due to lack of resources. Privacy - EC Green Paper This topic includes a briefing of EC Green paper vis-a-vis U.S. position which should include status report from Congress. Also, included are briefings on current privacy issues by organizations, individuals with competing views, and possibly Congressional staff. Implementation of the Computer Security Act of 1987 Subsumed under this heading are various related issues the Board would like to address in 1991. These include an examination of Office of Management and Budget policies, including the anticipated rewrite of OMB Circular A-130. Also of interest is the role of the Inspector General in computer security. Computer security training and its effectiveness are also to be studied. Lastly, the Board would look into the status of OMB/NIST/NSA security planning agency visits. Software Engineering and Reliability Much attention is focussed on security environments, products and data bases. Less has been said about the quality and reliability of application software. An April, 1990 Congressional report (Bugs in the Program) questions whether the federal government is capable of developing software as reliable as it needs. The Board would like to be briefed on the state-of-the-art in software reliability. Security and the Public Switched Network A number of studies have highlighted the vulnerabilities of the public switched network. At the moment, much activity is taking place behind closed doors on this issue, particularly in the National Security Emergency Preparedness arena. At some point this issue needs to be surfaced and examined by the Board. Use of Security Products and Features A study conducted by the President's Council on Integrity and Efficiency indicated that many security functions and features were either unused or misused by system administrators and users. The experience of emergency response teams further bears this out. The Board would like to examine what must be done to change this and whether better guidelines are needed on how to use basic security tools such as passwords. Rewrite of NSDD-145 and the NIST/NSA Memorandum of Understanding The Board would like to continue to receive written updates or briefings by NSA/NIST on the status of the NIST/NSA Memorandum of Understanding and the recent Presidential directive on computer and telecommunications security. Computer Emergency Response Team (CERT) The Board believes that it would be useful to hear from NIST, other participants in the CERT program as well as victims of malicious software attacks. Periodic briefings on the CERT system and what lessons can be learned to improve security would be useful. Since most incidents occur because accepted routine security practices are not followed, should this not be well publicized, as an awareness or training tool? Digital Signature It is likely that during 1991 the Board will have the opportunity to examine the new digital signature algorithm. International Hacking Cases continue to be uncovered such as those that Cliff Stoll documented seems to be happening. Hackers continue to exploit the same old vulnerabilities that Stoll and many others have documented. Where is the accountability for taking care of known problems? Second, there appears to be continuing organizational confusion on the international hacking problem (i.e., who in the government, if anyone, is or should be responsible?) V. Conclusions During its second year, the Board continued to build the foundation toward progress in the years ahead. It developed a work plan and established its priorities. The Board has begun to examine those issues which it should study further and has heard from a number of agencies and organizations as to its role and duties. While the Board has initiated an action plan to identify emerging computer security and privacy issues, much remains to be accomplished in successfully addressing the challenges of the 1990s. APPENDIX A Computer Security Act of 1987 See Separate File APPENDIX B Charter of the COMPUTER SYSTEM SECURITY AND PRIVACY ADVISORY BOARD See Separate File APPENDIX C AGENDA March 13-14 Meeting of the Computer System Security and Privacy Advisory Board Marriott Hotel Gaithersburg, Maryland Tuesday, March 13, 1990 9:00 Computer Security Issues Update Lynn McNulty, Board Secretary 9:30 Review of Revision of NSDD-145 Lynn McNulty 10:00 Review of Board's Progress Willis Ware, Board Chairman 10:30 Break 10:45 Discussion of Export Draft Paper Willis Ware, Board Chairman 12:00 Lunch 1:15 National Computer Security Center FY-1990 Program Patrick Gallagher, Director National Computer Security Center 2:30 Break 2:45 Board Discussion 3:15 Update on Computer Security and Telecommunications Council Activities Stuart Katzke Chief, NIST Computer Security Division Closed Session 3:30 NIST Five-year Budget/Plan Update Stuart Katzke Chief, NIST Computer Security Division 4:30 Close first Day End of Closed Session Wednesday, March 14, 1990 9:00 Board Discussion of Civil Orange Book Alternatives Leader(s) to be Determined 10:15 Break 10:30 Discussion of Civil Orange Book Alternatives cont. 11:45 Lunch 1:00 Board Open Discussion with NIST Director Dr. John Lyons 2:00 Subcommittee Reports and Public Participation (as necessary) CSSPAB Work Plan Subcommittee Update Larry Wills Information Categorization Subcommittee Update Rhoda Mancher NIST FY-90 Plan Review Subcommittee Update Robert Courtney 2:30 New Topics or Continuation of Prior Discussions 3:30 Close of Meeting MINUTES OF THE MARCH 13-14, 1990 MEETING OF THE COMPUTER SYSTEM SECURITY AND PRIVACY ADVISORY BOARD March 13, 1990 Call to Order The fifth meeting of Computer System Security and Privacy Advisory Board, held on March 13-14, 1990 at the Marriott Hotel in Gaithersburg, Maryland, was called to order at. 9:00 a.m. by Chairman Willis Ware. Eleven members were in attendance in addition to the Chairman. (One vacancy exists on the Board due to the resignation of Mr. Simpson.) Mr. Lynn McNulty, Board Secretary, reviewed the agenda and future Board meeting dates. The next five meetings will be held as follows: June 14-15, 1990 Beckman Center, Irvine, CA September 11-12, 1990 Reston, VA December 11-12, 1990 Washington, DC area March 19-20, 1991 West Coast June 18-19, 1991 Washington, DC area September 18-19, 1991 TBD Mr. McNulty announced that the process to renew the charter (which expires on May 31, 1990) would be initiated shortly to allow sufficient time for processing through the Department of Commerce. (Under the Federal Advisory Committee Act, no advisory committee can operate without a valid charter.) Any comments from the Board on the charter were requested by April 1, 1990. Also, Board members were requested to submit nominations to fill the vacancy to the Secretary as soon as possible. (ACTION - BOARD MEMBERS) Computer Security Issues Update During a review of current computer security news, it was announced that NIST was assuming the sponsorship of the federal Computer Security Educators Forum. The Board expressed its concern about the already limited funds and personnel available to the National Computer Systems Laboratory (NCSL) and recommended that NCSL not assume this undertaking. NCSL personnel responded that sponsorship entailed little additional work and would be useful as a vehicle to increase the training and awareness aspects of the computer security program at nominal expense. Many members recommended that NCSL contact the Office of Personnel Management to see if it would be willing to assume this role. The recent Department of Defense license of RSA public key cryptography was briefly discussed. A DoD visitor, Mr. Viktor Hampel, indicated DoD's flexibility on the issue and the willingness of the Protection of Logistics/Unclassified Program to brief the Board at a future meeting. (ACTION - SECRETARY) OMB Circular 90-xx Update Mr. Gene Troy, Manager of the Agency Assistance Group of NCSL's Computer Security Division, reported briefly on the progress of drafting OMB Circular 90-xx on computer security planning. Highlights of the proposed Circular include the modification of the NIST/NSA computer security plan review process. Agencies will continue to maintain existing plans and prepare plans for new systems. An internal review mechanism will be established to assure that the plans are completed. A team-from OMB, NIST, and NSA will visit agencies to review these plans and discuss pertinent security issues. It is OMB's goal to have the document ready for Mr. Darman's signature by May 1, 1990. The Board also asked that Mr. Edward Springer of OMB be invited by the Board Secretary to attend the second day of the meeting. Review of Board's Progress The Chairman opened the discussion by noting that bureaucratic constraints have sometimes hampered advisory bodies like the Board from making as much progress as would have been desirable. Mr. Kuyers expressed strong personal concern about the Board's inability to act independently as he believed intended by Congress. He also expressed a sense of personal frustration about the lack of progress made by the Board and all of the administrative processing necessary to transmit the Board's findings through the Secretary of Commerce. Also, there was general concern about the timeliness of getting Board letters issued. The delay appears to have been due to a combination of drafting and redrafting cycles as well as the requirement to issue Board findings through the Secretary of Commerce. It was noted that Mr. Rubin, Deputy Chief Counsel (of the Department of Commerce) for NIST, would-be able to meet with the Board late in the day to review pertinent legal issues. In discussing ways to increase the Board's efficiency, Mr. Zeitler suggested that small subcommittees be established to develop draft white papers for discussion at each meeting. Board Actions - Approval of Export Control and NIST Budget Letters The Chairman prefaced his remarks by indicating that he was a member of the National Research Council's Computer Science and Technology Board, which is also addressing export controls. He indicated the need for the record to show that he is in favor of a public airing of the export control issue. He also indicated that if the Board had a problem with his participation in the discussion he would recuse himself for the duration. Hearing no objection, the discussion began. The Secretary distributed copies of the draft export control and NIST budget letter for the Board's consideration. Modifications were proposed by the members in the areas of application software integrating cryptologic features and syntax. After the NCSC presentation, the letters were revised and distributed to the Board for a vote. A vote was held on the budget and export letters. However, the Board later decided to modify the letters again. The Board also voted, in public session, to unanimously accept the 1989 Annual Report. The next day, on March 14, 1990, the Board, in a public session voted of 8 in favor with 4 (federal member) abstentions, agreed to forward the budget letter, as modified. The version of the export letter to be sent to the executive branch was unanimously approved. The version to be sent to Congress was approved with a vote of 9 in favor with 3 (federal member) abstentions. The Chairman stated for the record that in approving these letters the Board, to the best of its knowledge, has acted in full compliance with applicable laws, Commerce regulations, and its charter, as verbally discussed by the Deputy Chief Counsel for NIST. In accordance with the Federal Advisory Committee Act, copies of these approved letters were requested and were made available to members of the public and press in attendance. National Commuter Security Center - Mr. Patrick Gallagher Mr. Patrick Gallagher, Director of the National Computer Security Center (NCSC), presented an overview of the Center's FY-90 activities. He was accompanied by Mr. Terry Ireland and Mr. Tom Malarkey. Mr. Ireland discussed NCSC's COMPUSEC research while Mr. Malarkey discussed the various documents issued by the Center. He indicated that a number of NCSC developed documents may be useful to the civilian side of government and had been offered to NIST. In response to a Board question, Mr. Gallagher indicated that the Center's budget was $40 - $45 million and was staffed by approximately 200 people. In discussing integrity criteria, Mr. Gallagher said that developing an integrity model could take a year, perhaps less, depending upon the acceptance of a specific model. Mr. Lipner suggested building a prototype system incorporating controls along the lines of the Clark/Wilson model and publishing the results within one year. NCSL's Dr. Katzke said that NCSC and NIST are looking into the integrity issue and focusing on the development of an integrity document, expected by the end of April 1990. Computer and Telecommunications Security Council (CTSC) Update - Dr. Katzke Dr. Katzke updated the Board on the activities of the CTSC and his reorientation of the Council toward an affiliation of Working Groups. Any recommendations or decisions resulting from the working groups will be issued as CTSC documents and announced by NIST press releases. Mr. Wills requested that the Board receive a briefing on the professional certification of computer security professionals. (ACTION - SECRETARY) Dr. Katzke indicated that he will be pleased to provide the Board with updates on the CTSC as progress occurs. NIST Five Year Budget/Plan Update - Dr. Katzke During a brief closed session, Dr. Katzke briefed the Board on planned budgets for NIST's computer security program. No decisions or recommendations were made by the Board as a result of this briefing. Board Legal Issues Mr. Michael Rubin, Deputy Chief Counsel for NIST, briefed the Board on the intent of the Computer Security Act, with particular emphasis on the reporting requirements of the Board's documents. The Board automatically falls under the rules of the federal Advisory Committee Act and was established within the Department of Commerce. Mr. Rubin explained that Board decisions can only be made during open session of the Board. A report or letter has no status until the Board has met in public meeting, properly noticed in the federal Register, and voted upon it. The Board appreciates the intent of the FACA and the necessity to conduct government business in open session and will fully comply. The Department has taken the view that advisory committees are part of the Executive Branch and, therefore, subject to its constraints. The Department also holds the view that any transmittal or reports or correspondence has to be routed through the Department of Commerce. The Department has taken the view that advisory committees are part of the Executive Branch and, therefore, subject to its constraints. Mr. Rubin noted that the Justice Department also supports this position. It was recommended that each of the federal members consult with his agency attorneys to determine how to handle Board issues, and in particular, the possible appearance of "lobbying." following Mr. Rubin's departure, the Board's discussion continued. Board members noted that very few other advisory committees have a direct statutory reporting authority to the head of an agency and to the Congress. It was suggested that this might be taken to Congress for a further explanation of their intent. Mr. Colvin pointed out that he believes the Board has the right to request a legal opinion from the Department of Justice regarding the Board's reporting mechanism. The purpose of this request would be twofold: 1) to protect the federal members of the Board and 2) to protect the non-federal members with regard to the federal Integrity in Procurement Act. He suggested that the method of pursing this would be to submit a request to the Director of NIST and ask him to forward it to the Commerce General Counsel. The Chairman asked Mr. Colvin to draft an appropriate letter. (ACTION - MR. COLVIN) March 14, 1990 Civil Orange Book Alternatives Following a briefing by Ms. Lisa Carnahan concerning the Board's e- mail system, Mr. Lipner led the Board in a discussion of alternatives for a civilian orange book. He expressed the opinion that the current active international efforts in this area, particularly in the integrity arena, underscore the need for U.S. action by responsible private and public organizations. During the wide-ranging discussion, Mr. Courtney suggested that a civilian yellow book could probably be developed and offered to develop an outline for the Board's consideration within thirty days. (ACTION - MR. COURTNEY) Also, it was agreed that the Board should send a letter to NIST emphasizing its concerns on the integrity issue. Mr. Courtney agreed to draft such a letter for the Board's consideration. (ACTION - MR. COURTNEY) It became clear that the Board needed more time to consider this issue and would like to do so at the next meeting. (ACTION - SECRETARY) Mr. Burrows expressed his view that NIST should begin with a civilian yellow book. The Chairman questioned Mr. Burrows regarding putting manpower on the effort required to turn Mr. Courtney's outline into a document. Discussion with the Director NIST After lunch, Mr. Burrows introduced Dr. Lyons to the Board. Dr. Lyons presented a brief overview of current NIST activities, its budget, and its redirection into the advanced technology program. He remarked that, in spite of the past budget shortfalls, NCSL's computer security program had done well. He was pleased that the President's budget included a request for an additional $2.5 million. Mr. Cooper raised the Board's concerns with export control and the issue of cryptography, particularly in light of international efforts in the computer security standards arena. Dr. Lyons responded that the whole issue of computer exports had changed a great deal in the past 18 months. Mr. Morris asked Dr. Lyons how the Board can help NIST. Dr. Lyons replied that NIST has a number of advisory groups and that they assist by reviewing program plans and putting ■tasks in priority order. Evaluation of NIST programs, whether good or bad, is also useful. Technical details and assessment reports are of particular benefit. Reports are useless if they deal with increasing the budget by threefold. Dr. Lyons expressed NIST appreciation for the Board's efforts and welcomes all their comments and reports. People-to-People Tour of USSR on System Control Issues Mr. Wayne Madsen, who will be participating in a "People-to-People" visit to the USSR, gave a presentation on his upcoming trip. He explained the Soviets' interest about information concerning advanced technology, including: microcomputer security, PIN security, viruses, risk assessment, network security risks, auditing, and computer crime. Board members expressed their desire to invite Mr. Madsen back to give a follow-up report on his visit. -The Board then voted upon the revised versions of the export and NIST budget letters, as discussed above.) Board future Activities Mr. Larry Wills conducted a brief overview of future board activities. Among the items of interest to the Board: NIST resources, NSDD-145 re-write, the NIST/NSA Memorandum of Understanding, proliferation of competing national computer security standards, public key cryptography, network security, privacy, telecommunications security, OMB Circular A-130, NIST Security programs, the data categorization and labelling issue, and self- assessment. Also, the Board expressed interest in having a presentation on the training aspects of the Computer Security Act. The Board is interested in hearing whether such training has been effective. Central agencies could be asked for input in writing. The Chairman and the Secretary will look into the issue for the September meeting. (ACTION - CHAIRMAN AND SECRETARY) OMB Perspective on OMB Bulletin go-xx In response to the Board's request to hear directly from OMB regarding its draft Bulletin 90-xx, Mr. Edward Springer of the Office of Information Policy discussed with the Board the status of the draft Bulletin. Of particular concern was the perceived lack of accountability as to what happens if the agencies do not comply with the directive. Mr. Springer stated that OMB has the option to take non-compliance to a high level of agency management, and to make sure that the agency's budget is appropriately handled. Mr. Kuyers recommended that the enforcement issue be stated more bluntly. Public Participation Mr. Viktor Hampel of DoD restated his concerns regarding DoD's license to-use public key cryptology and Mr. Wayne Madsen expressed the opinion that privacy, as this relates to the confidentiality of information resident on computer systems will become a significant issue during this decade. He stated that Congress will probably revise the Privacy Act of 1974. Close There being no additional business or comments, the Chairman adjourned the meeting at approximately 3:00 p.m. Lynn McNulty Secretary CERTIfIED as a true and accurate summary of the meeting Willis Ware Chairman APPENDIX D Computer System Security and Privacy Advisory Board September 11-12, 1990 Agenda 9:00 Welcome & News Update Ed Roback, Acting Board Secretary 9:10 Chairman's Remarks Willis Ware, Chairman I. Information Technology Security Evaluation Criteria 9:15 Overview of the Information Technology Security Evaluation Criteria (ITSEC) Gene Troy, Manager, Agency Assistance Group, NIST 9:30 Position of U.S Government for Unclassified Systems Community James Burrows, Dir., National Computer Systems Laboratory 10:15 Break 10:30 A Vendor's Reaction to the ITSEC William R. Whitehurst International Business Machines Corp. 11:00 Discussion 11. Data Categorization Issues 11:30 Data Categorization Discussion 12:30 Lunch 111. Civilian Guidance Document 1:45 Questions/Clarification of A Proposed Outline for Commuter Security Guidelines Robert Courtney 2:00 Discussion of A Proposed Outline for Commuter Security Guidelines IV. Board's Progress Report 3:45 Status of Board's Work Efforts V. USSR Visit Update 4:10 Update of "People-to-People" Visit to USSR Wayne Madsen 4:30 Close 5:00 (Impromptu Social Hour) September 12, 1990 VI. National Research and Educational Network 8:30 Congressional Perspectives on NREN Michael R. Nelson Professional Staff Member Senate Committee on Commerce, Science, and Transportation 9:00 National Research and Educational Network - Information Briefings Dr. Charles Brownstein Acting Assistant Director for Computer Information Science and Engineering National Science Foundation 10:15 Break 10:30 Public Policy Issues Raised by National Networks Prof. Lance J. Hoffman The George Washington University VII. Need for Government Commuter Security Professional Series 11:15 Computer Security Professional Series Ed Roback, NIST VIII. Planning Session for 1990-1991 Program Year 11:35 Future Issues and Subcommittee Identification 12:00 Lunch IX. NSDD-145 Rewrite and Role of NIST and NSA 1:15 Role of NIST and NSA in the Post-NSDD-145 Era Bob Courtney X. Discussion 1:45 Board Discussion - Continued & Pending Items 3:15 Presentation of Certificates of Appreciation 3:30 Close MINUTES OF THE SEPTEMBER 11-12, 1990 MEETING OF THE COMPUTER SYSTEM SECURITY AND PRIVACY ADVISORY BOARD September 11, 1990 Call to Order The sixth meeting of the Computer System Security and Privacy Advisory Board was called to order at 9: 00 a.m. by the Chairman, Dr. Willis Ware. All portions of the meeting were open to the public. All members were present with the exception of Messrs. Kuyers, Lipner and Morris, who were unable to attend. Also, Mr. Michael Rubin, Deputy Chief Counsel for the National Institute of Standards and Technology (NIST), was available during the meeting to answer any legal issues which may have arisen; none did. Mr. Ed Roback of NIST served as Acting Board Secretary for the meeting in Mr. McNulty's absence. Opening remarks were delivered by Mr. Roback. First, he welcomed Mr. Patrick Gallagher, Director of the National Computer Security Center of the National Security Agency (NSA), who has been nominated by the Director of NSA to serve on the Board. Secondly, it was announced that the Board has been officially rechartered by the Assistant Secretary for Administration for another two years, to expire in May 1992. Also, the July 10, 1990, computer security hearings were discussed, as was the possibility of government furloughs. The furloughs and possible budget cuts may affect the December Board meeting. Information Technology Security Evaluation Criteria Mr. Gene Troy, Head of the Agency Assistance Group of NIST's Computer Security Division, gave the Board a summary overview of the draft European-developed Information Technology Security Evaluation Criteria (ITSEC). (See Attachment A.) Next, he reviewed NIST's efforts to evaluate the ITSEC and arrive at a position on the document. NIST's comments on the ITSEC were provided to the Europeans in a letter dated August 2, 1990. Mr. Troy's comments included the need for the clustering of functionality and correlation of levels of functionality and assurance. Additionally, the ITSEC was critiqued from both the user and vendor perspective. Finally, Mr. Troy explained NIST's position that a significant number of supporting documents need to be developed to complement the ITSEC, including the selection of specific security mechanisms for a specific threat environment, and the need for specific instructions for the performance of evaluations against the ITSEC. Discussion followed the formal presentation. The ITSEC clearly proposes conducting computer security evaluations in a dramatically different way from the Orange Book approach. The link between the development and manufacturing process and the resulting level of security is also linked by the ITSEC approach. Additionally, Mr. Burrows pointed out that it is clear that the European Community (EC) has many concerns regarding health, safety, and the environment, which they link to secure software. Traditionally, the U.S. approach has been to let the user be responsible for such consequences and not have the government regulate them. Mr. Burrows also discussed the body of knowledge that the National Computer Security Center (NCSC) has amassed over the years by conducting Orange Book evaluations. It appears that the benefits of this experience is not available to those outside of the Center, although it may be of great potential benefit to the EC. Many additional questions regarding the ITSEC remain unanswered. Who will do the evaluations and who will bear the costs? Can manufacturers conduct their own evaluations? The development of international criteria should not be rushed until we are sure we have learned what we can from our experiences with the Orange Book. Mr. William Whitehurst of IBM followed with a presentation of a vendors perspective of the ITSEC. (See Attachment B.) He opened with an overview of the concerns of European nations with the Orange Book and the NCSC evaluation process. The current process is viewed as controlled by the Defense Department and restricted to U.S. vendors. Additionally, the Orange Book focuses primarily on confidentiality and not on integrity or availability issues. Next, the resulting consequences of multiple criteria on international users was presented. Requirements for transnational information flow may not be met if various conflicting criteria are developed and implemented. Also, managers of transnational networks will have to reconcile differences in criteria when configuring systems. Evaluations to varying national criteria will also be expensive, length and resource intensive. This may force the development of expensive unique products for each market while other products may be unacceptable in certain markets. Also, security incompatibilities, availability of products and barriers to international data flow may result. Specific impacts of trusted systems criteria and evaluation upon vendors were then discussed. IBM would like to see the development of a single world-wide harmonized international criteria with associated evaluations by government agencies. Such a desired result would include international recognition of national evaluations, which would be designed to be consistent and compatible. Evaluations of products are seen as the critical factor in the success of a criteria. Also, IBM believes that existing Orange Book security criteria and the associated evaluations have had limited impact. For example, basic requirements (individual accountability, segregation of duties, and integrity of information and auditability) have not changed. Other specific IBM concerns included: an undue emphasis upon assurance-correctness; inadequate descriptions of functionality; unlikelihood of mutually acceptable mapping of ITSEC to Orange Book criteria; inconsistent evaluations; the lack of provision for levels of proof; and the lack of distinction between products and systems. Following the presentation, the Board continued its discussion, focusing upon the EC-sponsored meeting to be held on ITSEC on September 25-26, 1990. Mr. Burrows will be representing NIST at the meeting and will participate as a panel member. There has also been a proposal by the EC to form work groups consisting of two members from each EC nation to work over the next two years to define and develop the evaluation process and ways for the evaluation to be mutually recognized throughout the EC when the evaluation is performed within the EC. Mr. Burrows said that the EC has not invited the U.S. to be part of their internal process. Mr. Gallagher indicated his concern that efforts be taken to protect proprietary information and processes of U.S. businesses as an international standard is developed. Mr. Burrows asked if the NCSC would be willing to share information and experiences it has gained from conducting evaluations with others, including the Europeans. Mr. Gallagher said that he would have to take a look at the proposal, but did not see any fundamental reason that the NCSC could not share what it had done. In discussing what actions the Board should take, Mr. Zeitler stressed the need for the Board to develop a position that points out that this issue is an important one for the U.S. to continue to monitor and participate in the process. Later, the Board unanimously agreed to send a letter to the Secretary of Commerce identifying its concerns. (See Attachment C.) Planning for the Board's 1991 Activities Mr. Roback reviewed items identified to be of interest to the Board for its 1990 meetings. Many of these items have been examined, although not at the level of detail desirable. It was agreed that Messrs. Colvin, Wills and McNulty would work to develop a list of topics for meetings for the next year. (ACTION - COLVIN, WILLS, and MCNULTY) Computer Security Guidelines Mr. Courtney briefly presented his outline for the development of proposed computer security guidelines. A rational and systematic approach to computer security is required. The Board agreed that the outline was good and the Board should encourage NIST to complete the entire document. Mr. Courtney asserted that the completed document would be approximately 150 pages. Mr. Zeitler felt that the document should be issued as a NIST guideline or standard. Ms. Mancher asked if every aspect of computer security would be covered in the guideline. It was agreed that was the goal of the document. The Chairman was interested in ensuring that the outline will accommodate a system under development as well as systems already in place. Mr. Courtney indicated that it would handle both. Mr. Colvin felt that this document should be given the highest priority for NIST to produce. Mr. Burrows agreed that NCSL would try to produce the document; however, because of the present budgetary situation and with no new funding expected, it may not be possible to pursue this effort on the timetable the Board would like. Later, the Board adopted a letter to the Director of NIST transmitting the Board's outline and recommending that NIST fund its completion. (See Attachment ■D.) People-to-People Visit to the USSR Mr. Wayne Madsen returned to brief the Board on the results of his recent visit to the USSR. He focused upon concerns the Soviets have in the computer security area. (See Attachment E.) Progress Report of Board's Activities Mr. Roback reviewed a list of accomplishments by the Board since its inception. These included: issuing a recommendation for computer security to be a MBO, which was incorporated into the President's management plan; issuing recommendations on the new OMB circular on computer security planning; issuing recommendations on NIST's budget level; and hearing from federal agencies on the development of large new systems. The Chairman asked the Board to consider whether the Board is looking at the right issues commensurate with the Computer Security Act of 1987 and the interests and concerns of the membership. Comments that members may have should be sent to the Chairman. (ACTION - ALL MEMBERS) Mr. Courtney stressed the need for improved communication among Board members. Other ideas suggested included: the need to look at small manageable issues one at a time; the need to hear directly from federal agencies regarding their problems; the need for identifying the functions of a computer security officer; and the need to examine practical areas such as computer security awareness. Privacy was also identified as an area requiring attention. The Chairman suggested that each issue should have a champion who knew enough about the issue to develop a short position paper for the Board's consideration before delving headlong into the issue. During the discussion, NIST's Dr. Katzke pointed out that the Small Business Administration had published some material regarding information security and risk management. He agreed to provide those documents to the Board (ACTION - KATZKE) Additionally, the Board briefly considered whether a quasi-government entity should be created to handle public/private sector issues relating to security. Mr. Zeitler volunteered to look into how regulatory agencies were established for the banking industry, which might provide a model for the security community. (ACTION - ZEITLER) September 12, 1990 Mr. Cooper raised his concerns about e-mail privacy and the need for the Board to examine the issue. It was agreed that the issue would be considered at the December meeting. (ACTION - SECRETARY) National Research and Education Network (NREN) Mr. Michael R. Nelson, Professional Staff Member of the Senate Committee on Commerce, Science, and Transportation, provided an overview of the Congressional perspective on NREN. (The views he presented were his own and not necessarily those of the Committee.) The High Performance Computing Act, S. 1067, would fund the development of NREN, which would be an extension of the National Science Foundation (NSF) network. Computer security responsibilities are specified for NIST in S. 1067, although no increase in authorization for NIST is included. However, it is expected that an increase in appropriations for NIST would occur for the NREN work. Board members emphasized the need for this additional funding. Dr. Charles Brownstein, Acting Assistant Director for Computer Information Science and Engineering, National Science Foundation, provided an overview of NREN from the NSF's perspective. (See Attachment F.) An overview of NSFNET and the many definitionS of network were discussed. Also, the architecture of the present Internet and the types of usage on the NSFNET were briefed. Types of institutions connected to the network, the Federal Networking Council, and the genesis of NREN were discussed as well. See the attachment previously cited for further details. Professor Lance Hoffman of the George Washington University, provided the Board with an overview of the security and policy implications of national and international networks. (See Attachment G.) His presentation was adapted from an Office of Technology Assessment study on security and privacy in the design and management of NREN: Topics covered included: the emergence of a new era in world-wide communications, the present window of opportunity to provide security and privacy in NREN from its inception, existing networks and services, emerging technical, policy and legal issues, the adequacy of existing policy setting mechanisms, and similar experiences from which NREN may benefit. Professor Hoffman concluded his remarks with a recommendation that an eclectic conference gathering people from many disciplines would be an appropriate way to start to address these issues. During discussion following the presentations the Chairman summarized the Board's interest in having periodic briefings on the status of NREN. However, there was general agreement that it would be premature for the Board to take any position on the network. Computer Security Professional Series Mr. Roback provided the Board with a brief overview of a study for which NIST has been collecting federal position descriptions (PDs), which focuses on whether a separate position designation series should be estabLished for computer security positions. First has collected approximately one hundred PDs from the civilian side of government. No analysis has been conducted yet. Creating a separate series requires convincing the Office of Personnel Management that computer security is a distinct career field and subject matter discipline. It was also mentioned that a good definition of what a computer security position entails is required. The Board agreed to discuss this issue in some detail at the December meeting. (ACTION - SECRETARY) Formal Approval of Board Letters The Board reviewed the final text of the letters to the Director of NIST and the Secretary of Commerce on the Computer Security Guidelines and ITSEC, respectively. The Board unanimously adopted each letter. Data Categorization Data Categorization had been a prior topic of discussion among Board members who wished to reemphasize their desire to focus on the topic. After a brief discussion, the Board agreed that it was not able to work on the topic in detail at this meeting; however, it would be the subject of study at the December meeting. Board members requested examples of how agencies categorize unclassified information. Mr. Cooper volunteered to give an overview of existing schemes at the December meeting. Dr. Katzke will assist in this effort. (ACTION - COOPER and KATZKE.) Miscellaneous Mr. Burrows informed the Board that there was a topic that would be useful for the Board to discuss which is classified. He encouraged all members who did not have active security clearances to submit their documents or to forward existing clearances to NIST. Once the majority of Board members have done so, the classified topic can be discussed. (ACTION - SECRETARY) On another topic, the Chairman stated for the record that no non- federal Board members were involved in procurement activities that fell under the procurement integrity act, which was in effect for a portion 1989. Close There being no additional business, the Chairman adjourned the meeting at 2:15 p.m. Lynn McNulty Secretary CERTIFIED as a true and accurate summary of the meeting Willis Ware Chairman APPENDIX E Meeting of the Computer System Security and Privacy Advisory Board December 11-12, 1990 Holiday Inn Crowne Plaza, Crystal City, Virginia Tuesday. December 11, 1990 9:00 Meeting Overview Lynn McNulty Executive Secretary 9:10 Remarks from the Chair Willis Ware Chairman E-Mail Security and Privacy 9: 15 E-Mail Industry Perspectives Mike Cavanagh Executive Director, E-Mail Industry Association and Gary Levine Chairman, E-Mail Industry Association Security Committee 10:00 Break 10: 15 Legal and Academic Perspectives George Trubow The John Marshall Law School (Chicago, IL) 11:00 Computer Professionals for Social Responsibility on E-Mail Privacy Marc Rotenberg Director, Washington Office, CPSR 11:30 Discussion 12:00 Lunch Commuter Security Personnel 1:30 Overview of Issues Lynn McNulty Board Secretary 1:40 Federal Agency Panel James Oberthaler Patent Trademark Office U.S. Department of Commerce Col. Al Kondi U.S. Army Steve Smith Federal Aviation Administration U.S. Department of Transportation Information Technology Security Evaluation Criteria & NIST/NSA Efforts 2:30 James H. Burrows Director, National Computer Systems Laboratory, NIST Patrick R. Gallagher Director, National Computer Security Center, NSA National Research Council Retort 3:30 Computers at Risk - Safe Computing in the Information Age Marjorie Blumenthal National Research Council 4:30 Close Wednesday, December 12. 1990 Data Categorization 8:30 Issue Overview Roger Cooper 8 : 45 Federal Agency Panel - Federal Computer Security Program Managers John Tressler U.S. Department of Education Jules Romagnoli U.S. Department of State Dolph Cecula Bureau of the Census U.S. Department of Commerce John Hornung U.S. Customs Service 10:00 Break 10:15 Agnes Schryer Treasury Board Secretariat, Administrative Policy Branch Government of Canada 10:45 Bruce Bucklin Acting Chief Technical Operations Section Drug Enforcement Administration 11:15 Discussion 12:00 Lunch Board's 1991 Work Plan 1:30 Subcommittee Report of Draft Prioritized Items for 1991 Agenda Bill Colvin and Larry Wills Board Members 2:00 Discussion 2:30 Public Participation (as necessary) 3:00 Close MINUTES OF THE DECEMBER 11-12, 1990 MEETING OF THE COMPUTER SYSTEM SECURITY AND PRIVACY ADVISORY BOARD December 11, 1990 Call to Order The seventh meeting of the Computer System Security and Privacy Advisory Board was called to order at 9:00 a.m. by the Chairman, Dr. Willis Ware. All portions of the meeting were open to the public. All members were present with the exception of Mr. Hancock who was unable to attend. Opening remarks were delivered by Mr. Lynn McNulty, Executive Secretary. He expressed the Board's welcome to Mr. Steve Walker, of Trusted Information Systems, who has been nominated for membership and was in attendance. Mr. Gallagher, the designated representative from the National Security Agency, asked whether he and Mr. Walker would be receiving formal appointments to the Board. Mr. McNulty responded that the appointments were still at the Department of Commerce for clearance. It was also announced that the third nominee for membership is Mr. Charles McQuade of SIAC, Corp. E-Mail Security and Privacy Mike Cavanagh, Executive Director of the E-Mail Industry Association (EIA) and Mr. Gary Levine, Chairman of EIA's Security Committee provided the Board with EIA's perspectives on e-mail security and privacy issues. Mr. Cavanagh delivered a prepared statement (Attachment A). EIA has identified the following four key recommendations: 1) the need for a public key cryptographic- based digital signature; 2) the need to waive export restrictions on RSA and DES and to develop unlimited export licenses; 3) the need to foster greater use of security and authentication in government networks; and 4) the need for Congress to establish a taskforce to enable legal recognition of digital signatures. Professor George Trubow of the John Marshall Law School gave an overview of the various legal issues surrounding privacy, confidentiality and security. There are three legal areas of privacy: 1) tort law 2) Constitutional law; and 3) informational privacy. Tort law deals with civil wrongs including tort of "intrusion in the seclusion" of an individual. Publication of a private fact is one example. Constitutional law mostly deals with autonomy of individuals making choices about themselves. The only Constitutional reference to informational privacy is found in the 4th Amendment (Search and Seizure). It is important to bear in mind however, that the Constitution is a constraint on the actions of government, not private organizations. Informational privacy essentially deals with laws and regulations regarding the protection of information (e.g., Freedom of Information Act and the Privacy Act of 1974). The Electronic Communications Privacy Act (ECPA) of 1988 is significant and provides protection in three ways: l) makes it illegal to intercept communications, 2) protects against disclosure of intercepts, and 3) prohibits use of intercepted information. ECPA becomes important as it authorizes interception during the "normal course of business use." Current law has loopholes and leaves employees in the private sector unprotected. What is needed is something to cast a better balance between "permissible" private activities and privacy concerns. If the Board accepts that work is needed, it should bring the issue to the attention of anyone it can. The Chairman asked how the Board could get at the problem. Professor Trubow replied that ECPA could be modified by Congress. Mr. Marc Rotenberg, Director of the Washington Office of Computer Professionals for Social Responsibility presented his personal views regarding e-mail privacy. (See Attachment B.) Commuter Security Personnel Mr. McNulty introduced the discussion on federal agency recruitment and staffing of computer security positions. NIST has been collecting position descriptions for federal agency full-time computer security positions. While a full report is not yet available, preliminary analysis shows that there is a clear lack of consistency across agency boundaries regarding the personnel series in which these positions are assigned. Members of the panel included the following computer security program managers: Mr. Steve Smith, Federal Aviation Administration, Col. Al Kondi, U.S. Army, and Mr. James Oberthaler, Patent and Trademark Office (PTO), U.S. Department of Commerce. Each speaker provided a brief overview of their agency and its computer security program. Mr. Smith has personnel in various series, including the 334, 080, 3091 and 1801 series. (See Attachment C.) Col. Kondi has a staff of 22 people in both the 080 and 334 series. Across the Army there are about 300 full time INFOSEC personnel (approximately 150 in COMPUSEC and 150 in COMSEC). Mr. Oberthaler has recently set up a new program at PTO. His office has a staff of five, all in the 334 series. He views the 334 series as a broad category and, consequently, did not agonize over the choice of series. One major issue PTO had to confront was how to gain the necessary visibility for a program to be successful. In the ensuing discussions, Mr. McNulty said that NIST would have a draft of the personnel issues paper at an upcoming Board meeting. (ACTION - Mr. McNulty) It was also mentioned that in the next issue of Access, the International Information System Security Certification Consortium would announce its certification program for security professionally, which ties into the issue before the Board. Information Technology Security Evaluation Criteria & NIST/NSA Efforts Mr. James Burrows opened the discussion of the draft European Information Technology Security Evaluation Criteria (ITSEC) and MIST's current efforts in this area. A summary of the September 1990 meeting in Brussels was presented. Most comments received by the Europeans emphasized that although the ITSEC described features which would look useful to a user, the features were not adequately linked together. Also, the European Community appears to want to gain at least two years experience with a draft criteria document before adopting it in final. Mr. Burrows also emphasized that the Europeans do not have to invite the U.S. in to participate. However, it may be to their advantage to do so if the U.S. had something to offer, such as the experiences of users of trusted systems, which NIST is working to obtain. Dr. Katzke announced that this topic would be discussed at the next Board meeting when NIST's work plan is presented. (ACTION -NIST) NIST utilized the Board meeting to present a press release, announcing the joint intention of NIST and the National Security Agency (NSA) to develop a federal criteria document. Messrs. Burrows and Gallagher jointly announced their plans. (See Attachment D.) They will be co-chairing a conference in February to look at experiences with trusted systems. Mr. Burrows also stressed that it was not NIST's intention to simply add to the Orange Book, but that a wholesale re-examination of federal requirements would be undertaken. Dr. Ware summed up the Board's comments as collectively expressing a sense of urgency and volunteered that the Board would do whatever it could to assist the effort. National Research Council Report Ms. Marjorie Blumenthal of the National Research Council (NRC) and Staff Director of the System Security Study Committee presented an overview of the recent NRC report Commuters at Risk - Safe Computing in the Information Age. The report was sponsored by the Defense Advanced Research Projects Agency. Of particular interest to the Board in the report were: - concerns with export controls on cryptography and high assurance level trusted systems; - the recommendation for the founding of an Information Security Foundation; and - the recommendation to promulgate a comprehensive set of Generally Accepted System Security Principles to provide a clear articulation-of essential security features, assurances, and practices. As the report was released just prior to the Board's meeting, members had not had sufficient time to fully review the study. Therefore, it was agreed that the Board would defer taking a position. Wednesday. December 12 1990 Data Categorization Mr. Cooper introduced the discussion of data categorization by noting the importance of establishing a sound intellectual underpinning for categorization and that agencies were developing categorization schemes with or without guidance from NIST. This results in many uncoordinated and incompatible systems. Five agency representatives were invited to the meeting to share their thoughts and agency's experiences with categorization. Mr. John Tressler of the U.S. Department of Education indicated that his department had a High/Medium/Low categorization scheme used to remind users of their responsibilities for the protection of information. This system is primarily based upon statutory requirements for confidentiality protection. It would, however, be useful to add integrity and availability to the definition. (See Attachments E (l) & (2). Mr. Jules Romagnoli of the U.S. Department of State's Office of Information Systems Security began by discussing the difficulty with working with the definition of "sensitive unclassified" information. At the Department, a formalized category of sensitive unclassified information, "Limited Official Use," exists. However, discrepancies exist between protection of printed information and that stored on magnetic media. The Department has studied the aggregation of unclassified information and found it to be sensitive in the aggregate. Mr. Dolph Cecula, Director of Security at the Census Bureau, U.S. Department of Commerce, said that specific legislation protects census data. Employees take a non-disclosure oath every six months. Information is designated "Census Confidential." A study was conducted in 1973 which looked at categorizing personal information - and failed due to its complexity. Today, functional managers do not understand the definition of sensitive information in OMB Circular A-130. However, in the Census Bureau all employees understand that Title 13 data requires protection. Census systems are treated as though they contain Title 13. Mr. John Hornung of the U.S. Customs Service, said that basic Treasury Department directives provide requirements for the protection of information. Some systems have Limited Official Use information as well as law enforcement information. Other Treasury agencies have additional categories. For example, the IRS has tax information as a separate category. Mr. Cooper noted that while he was at Treasury, it was determined that data categorization was not possible. The panel was asked if a government-wide policy would be useful. Mr. Romagnoli said that there is a need for some standardization, particularly for sharing information. Mr. Cecula agreed that standard categories are needed. There was significant disagreement among Board members as to whether standard categorization is desirable or achievable. Next, Ms. Agnes Schryer of the Administrative Policy Branch, Treasury Board Secretariat of the Government of Canada presented an overview of Canada's unclassified data categories. Theirs is a model based upon appropriate levels of protection. Their sensitive information is "designated" as requiring protection and is marked "PROTECTED." The bulk of this information is personal. Designated information is further delineated with A/B/C markings. (See Attachment F for further information on Canada's scheme.) Employee discipline standards are linked to the protection of designated information. Approximately 60-70% of the government's employees are subject to an "enhanced reliability status" background check. Her advice offered to the Board was to aim for a legislative basis, as was accomplished in Canada, for the categorization scheme. Overall, categorization has proven useful for the Canadians. Mr. Bruce Bucklin, Acting Chief of the Technical Operations Section at the Drug Enforcement Administration presented a strawman approach to data categorization. He emphasized that the material presented was already under revision and viewed this as an ongoing process, which only began in June of 1990. The tentative conclusion they have reached is that four categories is too many while one is not enough. Mr. McNulty asked what the current status was. Mr. Bucklin replied that two categories may be adequate. Their effort is expected to be completed by May, 1991 and is currently utilizing a staff of eight to ten full-time people. The Board agreed that it may wish to take action with regard to data categorization. However, at this time the Board did not have a clear direction in which to proceed. However, it was agreed that Messrs. Lipner and Zeitler would meet to discuss the issue and prepare a recommended course of action. (ACTION - Messrs. Lipner and Zeitler.) Board's 1991 Work Plan Mr. Colvin provided an overview of the Board's proposed work plan for 1991 that he and Mr. Wills had developed. (See Attachment H.) Mr. Wills stressed that members should bear in mind that major privacy legislation may be passed within the next year. In reviewing the document it was agreed that the "Implementation of the Computer Security Act of 1987" should be the highest priority. The meeting was adjourned at 2:30 p.m. Lynn McNulty Secretary CERTIFIED as a true and accurate statement of the meeting Willis Ware Chairman