Secure system composition: five practical initiatives

摘要

Standards profiles, goal security architectures, core products, the Multilevel Information Systems Security Initiative (MISSI), and security profiles are important ongoing INFOSEC initiatives. This paper considers them as varying practical attempts to solve the problem of secure system composition (i.e., of how to produce a secure system from secure components). The strategy used by each to solve this problem is first characterized. The ability of each to solve the problem is then assessed. The paper concludes that, by virtue of their focus on component interfaces, all five contribute to the solution of the composition problem (to a limited degree now, to a greater degree in the future).