Reengineering the Certification and Accreditation Process: Security is Free

摘要

The purpose of this paper is twofold: first, to show that Certification and Accreditation can be a value-added process that can help improve system security. Second, to show that security, when it is considered part of the system design, does not increase the cost of the system.