if i am on amoxicillin can i take nyquil carlosfloresmusic.com does coming off zoloft cause anemia how many of olanzapine 7.5mg to overdose mixing acepromazine with prednisone atorvastatin 40 mg price in india eastriverpartners.info dickhopper.com can you smoke cigarettes while taking ciprofloxacin prozac and lamictal cause tremors ondansetron 8 mg false positive amphetamine cardizem cd 240 mg qd prednisone taper schedule medication for ra flare is 20mg of prednisone a low dose cara minum obat glucophage xr segtucson.com cytotec uso 7 semanas harga cytotec abortion thuoc mobic capsules 7.5 accutane 10 mg a week flagyl 250 mg uses depo and zithromax kamagra oral jelly where to buy in johor malaysia where to get viagra samples difference between singulair and generic metronidazole 500 mg first trimester femara tablet price in pakistan how long is the shelf life of bactrim csipropertyservices.com celexa without food rupture tm and otic antibiotic NEOHAIRINDO.COM what stores carry lamisil gel generic flagyl 400 when will one ovulate after taking clomid for 7days albuterol under 2 years old getting off nolvadex cycle topiramate sclerderma africanamericanimages.us clopidogrel overdose are chloramphenicol eye drops dangerous for dogs robertjszmidt.pl em2nt.net antidepressant citalopram 10mg reviews feswmp.com provera 2.5 mg side effects mhc-s.com womazing.com generic singulair 5mg chewable what is d work of ciprotab valsartan price walmart metformin dose in treatment of pcos balitoursclub.com tetracycline to doxycycline cross reactivity atorvastatin lipitor coupon cymbalta sleep talk diflucan 400 mg ev cymbalta and alcohol interaction accommodationmadeasy.com aml.ca brtop.net cialis helps last longer generic tamoxifen cost gabapentin high how much chloramphenicol capsules 250mg felodipine mr 2.5 mexico viagra online DORREAJATETXEA.COM late period following clomid gelernt.net generic singulair india delite.cn can gabapentin get you high prednisone canker sores side effects prednisone 3 week taper nh coumadin level machine can clonidine make you feel like opiates how many azithromycin do i take for gonorrhea can i buy chloromycetin eye drops over the counter exoticguys.com metformin 500 mg online is it ok to take fluconazole 150 dosage twice weekly gabapentin gle 600mg paladardigital.com lasix tablet nedir metoprolol without insurance amlodipine besylate 10 mg recreational use can doxycycline affect your period formid metformin mims missed 10 mg dose of lexapro xn--b1afpdqbb8d.xn--p1ai buy lasix online usa womazing.com elavil fct 10mg side effects generic wellbutrin sr does albuterol cause restless leg syndrom otc ketoconazole for hair regrowth prozac 5 mg capsules dickhopper.com darbentin gabapentina para q son dostinex sale cipro strength for ear infection generic lexapro insurance sildenafil en capsulas MASTERRAFTING.COM cost of wellbutrin generic cvs generic flomax cr prednisone taper migraine treatment california-employment-lawyers.com does takin nyquil and antibiotics cause u not to cum adalat 60 mg side effects zithromax capsules dosage for chlamydia lisinopril coughchemistry hydroxyzine pamoate how long does dose last diflucan after expiration date shapirogalvinlaw.com rudolf-ll.cz dinkim.com can taking antibiotic 500 help cure chicken pox lexapro without tapering covenantofpoppies.com cytotec con 13 semanas como tomar arimidex 1 mg 28 tablet is mifepristone and misoprostol available in iloilo atarax online taking gabapentin lexapro reviews 90 mg albuterol for a 12 yr old strattera vs adderall fluoxetine price walgreens foodloversheaven.com cgstudionyc.com positive reviews from 5 mg tp 10 mg of lexapro bukitpinus.com zofran and fluconazole is viagra 3000mg too much to take bupropion hcl xl mean plasma benicar 50 efectos secundario buy clomid malaysia inderal 40 mg compresse prezzo diflucan one with monistat zovirax tablet price philippines 555fs.com segtucson.com lamisil powder australia benefits of metronidazole eye drop obat apa etamox amoxillin torsemide furosemide structure MASTERRAFTING.COM citalopram and terbinafine smell cheap prednisone online order antibiotics online pypal harga acyclovir generik gabapentin neurontin capsule 300 mg what is piroxicam 20 mg capsule used for may i take two pills of cialis 5 mg 555fs.com price levitra vs viagra anti depressants side effects alcohol long term cialis tadalafil penggugur kandungan is it safe to drink diazepam and fluconazole springracinginsights.com cabinetsbydesignsarasota.com doxazosin pediatric dosage ascbelfast.com inj danazol nursing responsibility i take nexium and lexapro is 1500mg of metformin safe to take on pcos when did plavix come on the market sildenafil citrate 100mg from mexico audiomaximus.com places in s.a where i can buy clomid antibiotics no prescription xn--b1afpdqbb8d.xn--p1ai voltaren tabletten 10mg iphone5sreview.nl adhd bupropion premarin 0.3 mg tab ivermectin 1.87 paste for humans flomax for women urinary retention rizatriptan reviews batterymedix.com cheapest generic celebrex is clomiphene citrate dangerous for fertile women can i buy ivermectin over the counter for guinea pigs terbinafine tablets 250mg faster can clomid be taking early morning on a empty stomach diflucan 2 doses paladardigital.com does nifedipine cross the placenta does cialis help with incontinence acyclovir 800 mg tablet dodoku.com vitaroom.net harga salep acyclovir krim very trong viagra online bangalore can i use metronidazole while on my period heart problems caused by taking cipro lawsuits hanhvyshop.vn wellbutrin and tremors can you take hydroxzine at the same time as buspirone disabledinafghanistan.com plavix buying online where can i buy metronidazole for dogs in brooklyn ny cdfeorellana.com iphone-accessory.cn benicar bystolic bruises rash can yohimbe affect cialis viagra sales statistics atomoxetine hci feel like lupine lisinopril 802 walgreens cialis prices order generic diflucan rwmeierlaw.com DORREAJATETXEA.COM cuidado de enfermeria al administrar xenical can ketoconazole tablets work for gonorrhea elusionist.com lisinopril hctz increased urination is 20mg of buspirone safe fungsi obat clozaril chinaskinny.com echinacea coumadin interaction can taking synthroid shrink nodules viagra cheapest buy apparel-chic.com secretlives.me biolab.com.sg montelukast 10mg tablets sertraline trade name lisinopril pineapple what is the difference between cialis 5mg 10 20 an40 strattera high dosage with cause tiredness effect of azithromycin and amoxicillin with avonex iphone-accessory.cn golfnewmexico.com em2nt.net valsartan 320 vs 180 mg buy mobicosa australia side effects of lorazepam mirtazapine fullserviceteens.com priligy price nz dinkim.com pastilla cytotec en la semana 39 lasix 100 mg iv iphone-accessory.cn coreg 12.5 prnc.tv buy stromectol europe antidepressants that make you crave swets accommodationmadeasy.com 555fs.com will 100 amitriptyline 25mg tablet kill punkfiction.com short term use mirtazapine 7.5 mg ncsdsample2.docbro.com dapoxetine price in kolkata lexapro dosage 40 manfaat saleb voltaren emugel bociansafaris.com MASTERRAFTING.COM eastriverpartners.info prozac long term effects sertraline hcl time help feel better sildenafil gel review maximum dose tadalafil 40 mg daily blackisbusiness.info serophene 3o ciclo what happens if i take trazodone without food elusionist.com olanzapine 7.5mg tablets digoxin dosage uk bisenconsulting.com iv steroiods flagyl po thrush why take glucophage 500 pills azithromycin over the counter purchase how to take pharmacia cytotec for a3weeks pregnancy cabinetsbydesignsarasota.com flagyl lek serophene dia 3 del ciclo can i take nyquil while taking wellbutrin mens clinics in s.a price list for cialis where to buy cialis cheap online will taking 150mg of viagra hurt me does prednisone 20 mg stops your cycle strattera side effects australia feline albuterol no prescription precio de los comprimidos famvir 500 21 comprimidos will zinc help tinnitus caused by wellbutrin DORREAJATETXEA.COM THUMBUY.COM thuoc coumadin 2mg terbinafine cat mg metronidazole 375 mg esteponasurgery.com lifesaverpoolfencesofnevada.com iv doxycycline cost cordarone r tabs metformin side effects bladder cancer strattera 5 hour energy can celebrex be taken with cozaar comp can u get high on celebrex 100mg para sirve piroxicam dosis femara gynecomastia brand name digoxin infusion how long after being on azithromycin not contagious buy dapoxetine usa cialis 80 mg dosage how much does cytotec cost in sa lopressor price imipramine uk gabapentin 100mg neurontin informacion en espanol lexapro buy online uk iphone-accessory.cn long term effects of paxil withdrawal how to use praziquantel metronidazole and amoxicillin mirtazapine price in pakistan prometrium 600 mg daily balitoursclub.com cflailesi.org sampiyonhaliyikama.com what di you take if valacyclovir doesnt work chewing clonidine focva.org naproxen sodium 325 mil perimenopause is it ok to take prometrium 200mg daily nizoral shampoo 7 oz bollywoodinformer.com discount viagra in the uk obat apa zithromax azithromycin 500mg skale.it ansbach-direkt.de bisenconsulting.com viagra cialis prescription online rwmeierlaw.com tengo fiebre tifoidea y me recetaron levofloxacino valacyclovir 1000 can mirtazapine make me sleep walk gabapentin 300 mg side face numbing harga obat salep antibiotik chloramphenicol fortune healthcare viagra montelukast 10mg 20mg robertjszmidt.pl disabledinafghanistan.com cipro lp 1 gr can metronidazole 400 mg prevent pregnancy upperbe.it arr.czestochowa.pl super kamagra kaufen mit paypal capoten generic name 555fs.com paxil paroxetine hcl 10 mg generic levitra safety singulair 10 mg no prescription khasiat amoxilin best deals on viagra kmmvin.eu yalovadaarsa.com does atorvastatin come in 15mg olanzapine actavis 10 mg wikipedia disabledinafghanistan.com sertraline 80 mg australian periactin cyproheptadine price fluconazole 150 to work for thrush arman-crusher.com cuantas misoprostol cytotec debo tomar para abortar dosage flagyl forte meloxicam para bursitis en perros allergic reaction to keflax amd bactrim arman-crusher.com can you get prednisone over the counter fluconazole sertraline clonazepaminteractions cipro and benadryl cerisdieventi.com propecia u hrvatskoj how do i take 50 mg diflucan for oral thrush side effects of lexapro 10mg syphilis antibiotics azithromycin amibas metronidazole dosage does tamoxifen lower hormones lifesaverpoolfencesofnevada.com africanamericanimages.us lisinopril 40mg tab xn--b1afpdqbb8d.xn--p1ai muscle twitching after cipro anastrozole australia ansbach-direkt.de whats street value for cymbalta 8nxw.com seroquel xl and smoking weed dataminingweb.com prednisone 40mg shot what happens if yoy take 300 mg of buspar dataminingweb.com golfnewmexico.com uses of augmentin 625mg in 3rd trimester lexapro price singapore opiate withdrawal lisinopril can i take alcohol while in proflax antibiotics feswmp.com stlsoccer.net gabapentin sciatic nerve dog theitrecruiters.com finasteride 1 mg for hair loss in men over 65 flomax over the counter substitute acid reflux from lexapro losartan potassium hydrochlorothiazide cost propecia no prescription cheap difference between amitriptyline and amitriptyline apo taking synthroid with valtrex generic cordarone amlodipine besylate 10mg costco.com antibiotic azithromycin for dogs trazodone mylan 100 mg slaapmiddel side effects with tapering buspar voltaren forte gel precio buy cialis for daily use online egyptereizen.org diltiazem 90 mg sr acyclovir 400 mg dosage for shingles deserteichler.com cytotec precio cochabamba bolivia low thyroxine t4 symptoms farmacias donde puedo comprar cytotec en lima seadoo-maldives.com NEOHAIRINDO.COM can u get high off bupropion 150mg provera uk buy rudolf-ll.cz schedule classification of chloromycetin ointment how long can you take doxycycline for chest infection can i buy misoprostol over the counter at walmart en puerto rico se consigue la pastilla cytotec 10misoprostol for 17weeks pregnancy mazowsze.waw.pl can i take meloxicam and gabapentin oxycodone valtrex side effects puking can you take nitrofurantoin with amoxicillin antibiotico per stomic harga doxycycline di apotek is it possible to gain weight taking xenical kamagra jelly fake hinde a to z mobics cuanto tiempo puedo tomar complejo b con meloxicam convert iv to po lasix pazarlamacadisi.com hotel de 4 meses con cytotec price of levitra why does albuterol sulfate make your heart race dexamethasone 0.5mg fungsi sebagai obat apa michalchrzanowski.com gabapentin 300 mg side effects prozac 80 mg daily purchase levaquin no prescription cara kerja obat flagyl forte metronidazol bumex vs lasix will cipro sperm cause birth defects para que sirve la pastilla premarin will tamsulosin hcl show up on a drug test metronidazole at walmart amoxicillin disage for dogs for uti unprescribe clomid csipropertyservices.com bmmpm.com prednisone and alcohol uk gabapentin for cmt springracinginsights.com karvea interaction with voltaren problems doxycycline 100mg cost uk sertraline hcl 50 mg usa para que mifepristona y misoprostol argentina mendoza atorvastatin dosage drhildaong.com too much cialis opposite batterymedix.com csipropertyservices.com lenteclin doxycycline ip 100mg is the side effects of prednisone urinary incontinence lek voltaren dolo 555fs.com skale.it lbc4help.org amoxicillin interaction with benzonatate topamax 10mg cost of montelukast and levocetirizine hanhvyshop.vn diovan hct heartburn why take celebrex over tylenol california-employment-lawyers.com clomid for ten months misoprostol price uae pet amoxil 500 sale non prescription levofloxacin 500 mg cost nateglinide cost septra for pregnant women how do i know it metronidazole gel worked baclofen creme kopen covenantofpoppies.com patient reviews of diltiazem cd egyptereizen.org bactrim causing stuffy nose

previous  next  Title  Contents  Index   Last Update: 21 Jul 2000


5 Requirements on systems

5.1 System Model
5.2 Availability requirements
5.3 Sensitivity requirements

5.3.1 Class Requirements: Public / non classified data
5.3.2 Class Requirements: Internal data
5.3.3 Class Requirements: Confidential data
5.3.4 Class Requirements: Top Secret data
5.3.5 Requirements: Summary of relationship to Orange Book Classes

5.4 Component security checklist


The security required of a system depends on what information it processes, for what purposes. The information and information processing functions should have sensitivity and availability labels (i.e. be classified, as in the preceding chapter), so that the security needs to the system can be specified.

The security needs of the system may concentrate on availability, confidentiality or integrity, for example:

In the following sections, a set of requirements are proposed, based on the sensitivity and availability classes proposed in the previous chapter.

5.1 System Model

Systems need to be broken down into components and the security of each component analysed. When a user access data, he passes through a variety of possible security controls, or components. Some of these controls are physical, some organisational and some are computer based. The following is one way of representing the components /controls involved.

For data to be secured each of the different layers (security components) from Physical to Operating system need to be correctly configured and monitored. It is not enough to simply secure the physical access for example, because access via the network may also be possible.

In using a model of this kind, it is possible to break down the measures needed to protect a system (or data) into subsystems which correspond to real-life software/hardware/human entities.

In this chapter requirements are defined, in part II & III of the document, guidelines are proposed for securing each of the layers in the above model.

5.2 Availability requirements

The following specifies requirements on systems and organisation for each availability class.

Title Detail
Backup concept A backup and restore policy must exist. X X X X

Test restore policy regularly!

1/Year 1/Year 1/Year 1/Year

Minimum frequency of regular backups.

weekly daily daily daily

Minimum frequency of off-site backups.

  monthly weekly weekly
Environment

Air Conditioning

    X X

Electromagnetic protection (EMP hardening)

      X

UPS (220V protection)

    X X
Organisation

Clearly defined support organisation.

  X X X

Documentation of availability measures, recovery procedures, disaster plans (virus outbreak, security breach, fire, power failures etc.)

  X X X

Change management (Updates/patches/new SW)

  X X X

Effective (if possible automated) log monitoring and alerts.

  X X X

Prevention of resource abuse

  X X X

Service slots must be defined. Regular maintenance planned.

  X X X

24 Hour personnel

      X

Help Desk (reaction times, escalation procedures).

    X X
Redundancy (hw/sw)

Hardware spares or Vendor maintenance contract.

  X X X
 

Database servers: RAID, Replication, transaction monitors.

    X X

Naming servers (NT, NIS+, DNS, NIS...): backup/replica servers.

    X X

File Servers: Mirroring, RAID 5, file replication.

    X X

Complexity / ease of maintenance is also important for availability. Complex, difficult to maintain systems will have a high probability of misconfiguration (unless expert system administrators are available) and hence increase the security risk.

5.3 Sensitivity requirements

The requirements proposed here for each of the sensitivity classes to are based on the American DoD (Department of Defense) Orange Book [tcsec] (see Appendix E) classes C1,C2 & B1 and the European Orange Book (or ITSEC) [itsec] class F-DX for secure communications requirements. Basing requirements on international standards such as these is preferred, since inter-company security policy may be more easily defined and these standards have been already tried & tested by other companies.

5.3.1 Class Requirements: Public / non classified data

Class requirements are not based on any standard, but "common sense". These requirements stipulate a minimum to be achieved by all systems in a company.

Even systems non-sensitive data should have a minimum security level (especially if they are networked), otherwise they could be used as a point of entry for attacks on more confidential systems.

5.3.2 Class Requirements: Internal data

Summary: Orange book C1 (Discretionary Security Protection).
C1 is used for co-operating users working with data of the same sensitivity level.

5.3.3 Class Requirements: Confidential data

Summary: Orange book C2 + secure data transmission.

5.3.4 Class Requirements: Top Secret data

Summary: Orange book B1 + secure data transmission.

5.3.5 Requirements: Summary of relationship to Orange Book Classes

The following shows roughly how the data sensitivity classes to devised in this document relate to orange book classes D-B1.

Title Detail Orange Book Reference D C1 C2 B1
  Data Sensitivity Class
Documentation Test documentation
Design documentation,
Security features user manual,
Trusted facility manual
  + + +
Assurance System architecture verification
Hardware/firmware integrity checking
Security testing (test for loopholes)
  + + +
Accountability User identification /authorisation   + + +
  Audit Trail (Beweissicherung)     + +
Access control Discretionary access control     + +
  Object reuse :Reinitialisation of objects.     + =
Labels Labels, integrity, human readable output.       +
Verification Specification and design verification       +
Exporting of labelled information to multilevel & single level devices.       +
Requirements in addition to the Orange book:          
Secure data exchange Peer entity authentication   + + =
  Data integrity     + =
  Data confidentiality     + =
  Data origin authentication / Non repudiation of origin     + +
  Non repudiation of receipt     + +
  Access control       +

Legend:
+ means as previous class with additional requirements.
= means same requirements as previous class.

5.4 Component security checklist

It is suggested that individual components of a system and systems as a whole be analysed according to the following checklist.
I. Documentation: Are the system security features well documented? Security Features User's Guide, System Administrators Guide to Security, Test documentation, Design documentation.
II. Assurance : How can one be sure that the systems does what it should do? :- System Architecture, System Integrity, Security Testing. Has the system been certified to meet known standards?
III. Accountability : Users shall be accountable for their actions.

IV. Access Control :

V. Secure data exchange / network communications

VI. Availability


[2] On UNIX systems, this means that shadow password files are required.


previous  next  Title  Contents  Index  IT Security Cookbook, 21 July, 2000