Chapter 8

Table of Contents

CHAPTER 8

Automated Information System Security

Section 1. Responsibilities

8-100. General.

a. Computer and networking systems (collectively referred to as

Automated Information Systems (AISs)) used to capture, create,

store, process or distribute classified information must be

operated so that the information is protected against unauthorized

disclosure or modification.

b. Protection requires a balanced approach that includes AIS

features as well as administrative, operational, physical, and

personnel controls. Protection is commensurate with the

classification level and category of the information, the threat,

and the operational requirements associated with the environment of

the AIS.

8-101. Scope.

This Chapter describes the minimum security requirements for an AIS

processing classified information.

8-102. Responsibilities.

a. The CSA shall establish a line of authority for oversight,

review, inspection, certification, and accreditation of AISs used

by its contractors.

b. The contractor shall publish and promulgate an AIS Security

Policy that addresses the classified processing environment. The

contractor shall appoint an Information Systems Security

Representative (ISSR) whose responsibilities are to:

(1) Maintain liaison with the CSA.

(2) Implement and administer the contractor's AIS Security

Policy.

(3) Ensure the preparation of an AIS Security Plan (AISSP).

(4) Ensure the establishment and maintenance of security

safeguards and access controls.

(5) Ensure that users have the security clearance, special

access authorizations, and need-to-know for the information

that they can access.

(6) Ensure that all AIS security related documentation is

current.

(7) Advise the CSA of any abnormal event that effects the

security of the AIS.

(8) Ensure that secure maintenance procedures are followed.

(9) Ensure that security audit records are maintained,

accessible, and reviewed and analyzed at least weekly.

(10) Designate Security Custodians in facilities with multiple

AIS or multiple shifts.

(11) Ensure the development and implementation of an ongoing

AIS security education program.

(12) Perform threat based, aperiodic inspections pursuant to

the AISSP. The frequency of inspections may be adjusted for

sufficient cause.

(13) Ensure that Memoranda of Agreement are in place for AIS

supporting multiple CSAs.

(14) Approve and document the movement of AIS equipment.

(15) Approve the release of sanitized equipment and components

in accordance with the sanitization matrix.

(16) Approve and document additional AIS operated in dedicated

security mode that is substantially the same as described in

the AISSP. The classification level of the additional AIS must

be the same as that of the approved AIS.

(17) Approve and document additional or replacement components

of a dedicated or system high AIS that are identical in

functionality and do not affect the security of the AIS.

(18) Document in the security plan and administer any

procedures necessary to prevent classified information from

migrating to unclassified AISs and leaving the security area.

Section 2. Accreditation and Security Modes

8-200. AIS Accreditation

a. The contractor shall obtain written accreditation from the CSA

prior to processing classified information on AISs. To obtain

accreditation, the contractor shall submit a formal request to the

CSA and an AISSP. Where similar AIS are located within the same

facility, a single security plan is permitted.

b. Accreditation is the CSAs approval for an AIS to process

classified information in an operational environment. The

accreditation is based on documentation, analysis, and evaluation

of AIS operations with respect to security risks and also on the

safeguards associated with operation of the AIS.

c. Interim accreditation may be granted in order for a contractor

to start processing classified information. This interim action

shall be for a specific period and shall specify the contractor

actions to be completed and the minimum security requirements to be

met during this period.

d. AIS accreditation may be withdrawn by the CSA should

procedures and controls established in the AISSP be assessed

ineffective by the CSA. Accreditation may also be withdrawn by the

CSA when there has been an unacceptable change in system or

security configuration.

e. The contractor can self-approve AISs that are similar to

previously accredited AIS security profile and components provided

the self-approval plan and procedures are included in the AISSP. In

the event of discrepancies, or determination by the CSA that the

self-approval plan is not administered effectively, the CSA may

withdraw the contractor's self-approval authority.

f. An AIS may be reaccredited or self-approval authority can be

reinstated by the CSA after review, analysis, and approval of an

updated AISSP. An accredited AIS may be reaccredited when

significant changes to the original accreditation or baseline

occur.

8-201. Equipment not Requiring Accreditation.

Some equipment/components, to include test equipment, fits the

definition of an AIS, whereas others may not. The ISSR will

determine and document the capability of such equipment in the

context of the equipment/components ability to collect and process

information. As a general rule, equipment composed of volatile

memory with no other storage media would not require accreditation.

AIS components that need not be included in the system

accreditation include but are not limited to:

a. Electronic typewriters, basic function calculators, and test

equipment.

b. Security requirements for AISs that are embedded as an

integral element of a larger system that is used to perform or

control a function, such as test stands, simulators, control

systems or weapons systems should be established concurrently with

the design and development of the system. If not provided, the

contractor shall request them from the appropriate GCA. In the

absence of such requirements, the security requirements and

procedures of this Manual will be applied to the extent appropriate

as determined by the CSA.

8-202. The AIS Security Plan.

a. User Operational Procedures. These procedures describe how

access to an AIS and classified information is authorized and

revoked; the protection mechanisms provided by the AIS, guidelines

on their use, and how they interact with one another, procedures

for screening and preventing the introduction of malicious code,

and the like.

b. System Configuration Management Procedures. These procedures

describe the documenting, controlling, changing, and maintaining of

the accountability of AIS hardware, firmware, software,

communications interfaces, operating procedures, and installation

structures.

c. Audit Features and Controls. These describe:

(1) A chronological record of AIS usage and system support

activities.

(2) Maintenance and repair of AIS hardware, including

installation or removal of equipment, devices or components.

(3) Transaction receipt s, equipment

sanitization, declassification and release records.

d. Concept of Operations (CONOP). The CONOP describes what the

AIS will be used for and how it will operate.

e. Continuity of Operations Procedures (COOP). The COOP describes

procedures to ensure continuous operations of AISs in the event of

a disaster resulting from fire, flood, malicious act, human error,

or any other occurrence. When the GCA determines a COOP to be

necessary, the requirements will be contractually imposed. Costs

directly related to the COOP requirements when in addition to

safeguards required by this Manual, will be charged to the specific

contract for which the requirements are imposed. At a minimum, the

COOP must include:

(1) Identification of mission-essential resources, including

AIS components, key response and recovery personnel, and

alternate site processing requirements.

(2) Identification of mission-essential applications.

(3) The type of response necessary to continue the mission,

based on the projected recovery time.

(4) Frequency of performing backups to ensure, at a minimum,

that current back-up copies of mission essential software and

data exist.

(5) An estimate of the cost of exercising the plan, software,

or alternate site.

f. System Administration and Maintenance Procedures. These

describe maintenance and repair procedures, including adding,

changing, and removing components, and the use of maintenance

devices and utilities.

g. Training Procedures. Security awareness training must be

provided prior to assigning the individual access to the AIS and

updated as needed. An individual receiving the training may be

required to sign an agreement to abide by the security requirements

specified in the AISSP.

h. Startup and Shut-down Procedures. These include system

upgrading and downgrading, handling of user data and output, access

controls to the AIS and remote AIS areas during, between, and after

classified processing; and the declassification, release and

destruction of storage media and AIS.

i. Certification Test Plan. This plan outlines the inspection and

test procedures to demonstrate compliance with the security

requirements associated with the mode of operation. It must include

a detailed description of how the implementation of the operating

system software, data management software, firmware, and related

security software packages will enable the AIS to meet the

compartmented or multilevel mode requirements. Products,

subsystems, and systems that have been endorsed through formal

evaluation programs (e.g., the Evaluated Products List supporting

the TCSEC) must be evaluated as part of the AIS in the

certification and accreditation process. In lieu of a certification

test plan for the dedicated and system high mode, the ISSR will:

(1) Verify that system access controls and/or procedures are

functional for the dedicated mode.

(2) Provide test results that verify that need to know

controls are implemented for the system high mode.

8-203. Security Modes-General.

a. AISs that process classified information must operate in the

dedicated, system-high, compartmented, or multilevel mode. Security

modes are authorized variations in security environments,

requirements, and methods of operating. In all modes, the

integration of automated and conventional security measures shall,

with reasonable dependability, prevent unauthorized access to

classified information during, or resulting from the processing of

such information, and prevent unauthorized manipulation of the AIS

that could result in the compromise of classified information.

b. In determining the mode of operation, three elements must be

addressed:

(1) The boundary of an AIS includes all users that are

directly or indirectly connected, and who can receive data from the

system without a reliable human review by a cleared authority. The

perimeter is the extent of the system that is to be accredited as

a single system.

(2) The nature of data is defined in terms of its

classification levels, compartments, subcompartments, and

sensitivities.

(3) The level and diversity of access privileges of its users

are defined as their clearance levels, need-to-know, and formal

access approvals.

8-204. Dedicated Security Mode.

a. An AIS is operating in the dedicated mode when each user with

direct or indirect access to the AIS, its peripherals, remote

terminals, or remote hosts has all of the following:

(1) A PCL and need-to-know for all information stored or

processed.

(2) If applicable, has all formal access approvals and has

executed all appropriate nondisclosure agreements for all the

information stored and/or processed (including all

compartments and sub-compartments).

b. The following security requirements are established for AISs

operating in the dedicated mode:

(1) Enforce system access procedures.

(2) All hardcopy output and media removed will be handled at

the level for which the system is accredited until reviewed by

a knowledgeable individual.

8-205. Security Features for Dedicated Security Mode.

Since the system is not required to provide technical security

features, it is up to the user to protect the information on the

system.

8-206. Security Assurances for Dedicated Security Mode.

Configuration management procedures must be employed to maintain

the ability of the AIS to protect the customer's classified

information. Configuration management procedures must be conducted

in coordination with the ISSR. The systems configuration management

procedures shall include an approach for specifying, documenting,

controlling, and maintaining the visibility and accountability of

all appropriate AIS hardware, firmware, software, communications

interfaces, operating procedures, installation structures and

changes thereto.

8-207. System High Security Mode.

An AIS is operating in the system-high mode when each user with

direct or indirect access to the AIS, its peripherals, remote

terminals, or remote hosts has all of the following:

a. A PCL for all information on the AIS.

b. Access approval and has signed nondisclosure agreements for

all the information stored and/or processed.

c. A need-to-know for some of the information contained within

the system.

8-208. Security Features for System High Mode.

AISs operating in the system high mode, in addition to meeting all

of the security standards established for the dedicated mode, will:

a. Define and control access between system users and named

objects (e.g., files and programs). The enforcement mechanism must

allow system users to specify and control the sharing of those

objects by named individuals and/or explicitly defined groups of

individuals. The access control mechanism must either, by explicit

user action or by default, provide that all objects are protected

from unauthorized access (discretionary access control). Access

permission to an object by users not already possessing access

permission must only be assigned by authorized users of the object.

b. When feasible, as determined by the CSA, provide a time

lockout in an interactive session after an interval of user

inactivity. The time interval and restart requirements shall be

specified in the AISSP.

c. Provide an audit trail capability that records time, date user

ID, terminal ID (if applicable), and file name for the following

events:

(1) System log on and log off.

(2) Unsuccessful access attempts.

d. Protect the audit, identification, and authentication

mechanisms from unauthorized access modification, access or

deletion.

e. Require that storage contain no residual data from the

previously contained object before being assigned, allocated, or

reallocated to another subject.

f. Ensure that each person having access to a multi-user AIS have

the proper security clearances and authorizations and be uniquely

identified and authenticated before access to the AIS is permitted.

The identification and authentication methods used shall be

specified and approved in the AISSP. User access controls in

multi-user AISs shall include authorization, user identification,

and authentication; administrative controls for assigning these

shall be covered in the AISSP.

(1) User Authorizations. The manager or supervisor of each

user of an AIS shall determine the required authorizations,

such as need-to-know for that user.

(2) User Identification. Each system user shall have a unique

user identifier and authenticator.

(a) User ID Reuse. Prior to reuse of a user ID, all

previous access authorizations (including file accesses for

that user ID) shall be removed from the AIS.

(b) User ID Removal. The ISSR shall ensure the

development and implementation of procedures for the prompt

removal of access from the AIS when the need for access no

longer exists.

user ID's are revalidated at least annually, and information

such as sponsor and means of off-line contact (e.g., phone

number, mailing address) are updated as necessary.

g. Authentication. Each user of a multi-user AIS shall be

authenticated before access is permitted. This authentication can

be based on any one of three types of information: something the

person knows (e.g., a password); something the person possesses

(e.g., a card or key); something about the person (e.g.,

fingerprints or voiceprints); or some combination of these three.

Authenticators that are passwords shall be changed at least every

6 months. Multi-user AISs shall ensure that each user of the AIS is

authenticated before access is permitted.

(1) Logon. Users shall be required to authenticate their

identities at "logon" time by supplying their authenticator (e.g.,

password, smart card, or fingerprints) in conjunction with their

user ID.

(2) Protection of Authenticator. An authenticator that is in

the form of knowledge or possession (password, smart card, keys,)

shall not be shared with anyone. Authenticators shall be protected

at a level commensurate with the accreditation level of the AIS.

(3) Additional Authentication Countermeasures. Where the

operating system provides the capability, the following features

shall be implemented:

(a) Logon Attempt Rate. Successive logon attempts shall

be controlled by denying access after multiple (maximum of

five) unsuccessful attempts on the same user ID, by limiting

the number of access attempts in a specified time period, by

the use of a time delay control system, or other such methods,

subject to approval by the CSA.

(b) Notification to the User. The user shall be notified

upon successful logon of the date and time of the user's last

logon; the ID of the terminal used at last logon, and the

number of unsuccessful logon attempts using this user ID since

the last successful logon. This notice shall require positive

action by the user to remove the notice from the screen.

8-209. Security Assurances for System High Mode.

a. Examination of Hardware and Software. AIS hardware and

software shall be examined when received from the vendor and before

being placed into use.

(1) AIS Hardware. An examination shall result in assurance

that the equipment appears to be in good working order and have no

elements that might be detrimental to the secure operation of the

resource. Subsequent changes and developments which affect security

may require additional examination.

(2) AIS Software. Commercially procured software shall be

examined to assure that the software contains no features that

might be detrimental to the security of the AIS. Security-related

software shall be examined to assure that the security features

function as specified.

(3) Custom Software or Hardware Systems. New or significantly

changed security relevant software and hardware developed

specifically for the system shall be subject to testing and review

at appropriate stages of development.

b. Security Testing. The system security features for

need-to-know controls will be tested and verified. Identified flaws

will be corrected.

8-210. Compartmented Security Mode.

An AIS is operating in the compartmented mode when users with

direct or indirect access to the AIS, its peripherals, or remote

terminals have all of the following:

a. A PCL for the most restricted information processed.

b. Formal access approval and has signed nondisclosure agreements

for that information to which he or she is to have access (some

users do not have formal access approval for all compartments or

subcompartments processed by the AIS).

c. A valid need-to-know for that information for which he/she is

to have access.

8-211. Security Features for Compartmented Mode.

In addition to all security features and security assurances

required for the system high mode of operation, AIS operating in

the compartmented mode of operation shall also include:

a. Security Labels. The AIS shall place security labels on all

entities (e.g., files) reflecting the sensitivity (classification

level, classification category, and handling caveats) of the

information for resources and the authorizations (security

clearances, need-to-know, formal access approvals) for users. These

labels shall be an integral part of the electronic data or media.

These security labels shall be compared and validated before a user

is granted access to a resource.

b. Export of Security Labels. Security labels exported from the

AIS shall be accurate representations of the corresponding security

labels on the information in the originating AIS.

c. Mandatory Access Controls. Mandatory access controls shall

provide a means of restricting access to files based on the

sensitivity (as represented by the label) of the information

contained in the files and the formal authorization (i.e. security

clearance ) of users to access information of such sensitivity.

d. No information shall be accessed whose compartment is

inconsistent with the session log on.

e. Support a trusted communications path between itself and each

user for initial logon and verification for AIS processing TOP

SECRET information.

f. Enforce, under system control, a system-generated, printed,

and human-readable security classification level banner at the top

and bottom of each physical page of system hard-copy output.

g. Audit these additional events: the routing of all system jobs

and output, and changes to security labels.

8-212. Security Assurances for Compartmented Mode.

a. Confidence in Software Source. In acquiring resources to be

used as part of an AIS, consideration shall be given to the level

of confidence placed in the vendor to provide a quality product, to

support the security features of the product, and to assist in the

correction of any flaws.

b. Flaw Discovery. The vendor shall have implemented a method for

ensuring the discovery of flaws in the system (hardware, firmware,

or software) that may have an effect on the security.

c. Description of Security Enforcement Mechanisms (often referred

to as the Trusted Computing Base). The protections and provisions

of the security enforcement mechanisms shall be documented in such

a manner to show the underlying planning for the security. The

security enforcement mechanisms shall be isolated and protected

from any user or unauthorized process interference or modification.

Hardware and software features shall be provided that can be used

to periodically validate the correct operation of the elements of

the security enforcement mechanisms.

d. Independent Validation and Verification. An independent

validation and verification team shall assist in the certification

testing of an AIS and shall perform validation and verification

testing of the system as required by the CSA.

e. Security Label Integrity. The methodology shall ensure, (1)

Integrity of the security labels; (2) The association of a security

label with the transmitted data; and (3) Enforcement of the control

features of the security labels.

f. Detailed Design of Security Enforcement Mechanisms. An

informal description of the security policy model enforced by the

system shall be available.

8-213. Multilevel Security Mode.

An AIS is operating in the multilevel mode when all of the

following statements are satisfied concerning the users with direct

or indirect access to the AIS, its peripherals, remote terminals,

or remote hosts:

a. All users of the multilevel system must have a PCL but some

users may not have a PCL for all levels of the classified

information residing on the system.

b. All users are cleared, have a need-to-know, and the

appropriate access approval (i.e., signed nondisclosure agreements)

for information to be accessed.

8-214. Security Features for Multilevel Mode.

In addition to all security features and security assurances

required for the compartmented mode of operation, AIS operating in

the multilevel mode shall also include:

a. A mechanism that is able to monitor the occurrence or

accumulation of security auditable events that may indicate an

imminent violation of security policy. This mechanism shall be able

to immediately notify the security administrator when thresholds

are exceeded and, if the occurrence or accumulation of these

security relevant events continues, the system shall take the least

disruptive action to terminate the event.

b. Access controls that are capable of specifying, for each named

object, a list of named individuals and a list of groups of named

individuals with their respective modes of access to that object.

It will be possible to specify for each named object a list of

named individuals and a list of groups of named individuals for

which no access to the object is to be given.

c. Support a trusted communication path between the AIS and users

for use when a positive AIS-to-user connection is required (i.e.,

logon, change subject security level). Communications via this

trusted path shall be activated exclusively by a user or the AIS

and shall be logically isolated and unmistakably distinguishable

from other paths.

d. Support separate operator and administrator functions. The

functions performed in the role of a security administrator shall

be identified. The AIS system administrative personnel shall only

be able to perform security administrator functions after taking a

distinct auditable action to assume the security administrative

role of the AIS system. Non-security functions that can be

performed in the security administrative role shall be limited

strictly to those essential to performing the security role

effectively.

e. Provide procedures and/or mechanisms to assure that, after an

AIS system failure or other discontinuity, recovery without a

protection compromise is obtained.

f. Immediately notify a terminal user of each change in the

security level associated with that user during an interactive

session. A user shall be able to query the system as desired for a

display of the user's complete sensitivity label.

g. Enforce an upgrade or downgrade principle where all users

processing have a system-maintained classification; no data is read

that is classified higher than the processing session authorized;

and no data is written unless its security classification level is

equal to the user's authorized processing security classification.

8-215. Security Assurances for Multilevel Mode.

a. Flaw Tracking and Remediation. The vendor shall provide

evidence that all discovered flaws have been tracked and remedied.

b. Life-Cycle Assurance. The development of the AIS hardware,

firmware, and software shall be under life-cycle control and

management (i.e., control of the AIS from the earliest design stage

through decommissioning).

c. Separation of Functions. The functions of the ISSR and the AIS

manager shall not be performed by the same person.

d. Device Labels. The methodology shall ensure that the

originating and destination device labels are a part of each

message header and enforce the control features of the data flow

between originator and destination.

e. Trusted Path. The system shall support a trusted communication

path between the user and system security mechanisms.

f. Security Isolation. The security enforcement mechanism shall

maintain a domain for its own execution that protects it from

external interference and tampering (e.g., by reading or

modification of its code and data structures). The protection of

the security enforcement mechanism shall provide isolation and non

circumvention of isolation functions.

g. Security Penetration Testing. In addition to testing the

performance of the AIS for certification, there shall be testing to

attempt to penetrate the security countermeasures of the system.

The test procedures shall be documented in the test plan for

certification and also in the test plan for ongoing testing.

Section 3. Controls and Maintenance

8-300. Physical Security.

a. Physical security safeguards shall be established that prevent

or detect unauthorized access to accredited system entry points and

unauthorized modification of the AIS hardware and software.

Hardware integrity of the AIS, including remote equipment, shall be

maintained at all times, even when the AIS is not processing or

storing classified information.

b. Attended classified processing shall take place in an area,

normally a Restricted Area, where authorized persons can exercise

constant surveillance and control of the AIS. All unescorted

personnel to the area must have a government granted PCL and

controls must be in place to restrict visual and aural access to

classified information.

c. When the AIS is processing classified information unattended,

or when classified information remains on an unattended AIS, a

Closed Area is required.

d. When the AIS is not in use, all classified information has

been removed and properly secured, and the AIS has been downgraded,

continuous physical protection, to prevent or detect unauthorized

modification of the AIS hardware and software, shall be implemented

through one or more of the following methods:

(1) Continuous supervision by authorized personnel.

(2) Use of approved cabinets, enclosures, seals, locks or

Closed Areas.

(3) Use of area controls that prevent or detect tampering or

theft of the hardware and software. These controls will vary

depending on the overall physical security controls in effect

in the immediate secure area.

8-301. Software Controls.

a. Contractor personnel that design, develop, test, install, or

make modifications to systems, or use security software, shall be

cleared to the level of the AIS. Non-system or applications

software that will be used during classified processing periods can

be developed or modified by personnel without a clearance. However,

before software developed by uncleared persons is used in a

classified processing period, it must be reviewed or tested by

authorized and knowledgeable contractor personnel to provide

reasonable assurance that security vulnerabilities do not exist.

b. The AISSP must provide procedures for approval of installation

of any software on the AIS.

c. Software provided on media that may be written to (e.g.,

magnetic media) must be safeguarded commensurate with the

accreditation level unless a physical write-protect mechanism is

used. (Mechanisms shall be tested and verified by attempting to

write to the media.) The write protection mechanism must be

verified once during each session when it is used to process

classified information.

d. Unclassified software provided on media that cannot be changed

(e.g., CD read-only media) may be loaded onto the classified system

without being labeled or classified provided it is immediately

removed from the security area upon completion of the loading

procedure. If the media is to be retained in the security area, it

may be controlled and stored as unclassified media.

e. The contractor shall validate the functionality of

security-related software (e.g., access control, auditing, purge,

etc.) before the AIS is accredited. The software shall be

revalidated when changed.

f. Use of software of unknown or suspect origin is strongly

discouraged.

g. The contractor must verify that all software is free of

malicious code prior to installation.

h. Unclassified vendor-supplied software used for maintenance or

diagnostics must be controlled as though classified.

i. Incidents involving malicious software will be investigated by

the ISSR. If the incident affects the integrity of classified

information, the CSA will be notified immediately and a written

report detailing the findings of this investigation will be

submitted to the CSA in accordance with the AISSP.

8-302. Media Controls.

a. In general, media that contains classified information will be

handled in a manner consistent with the handling of classified

documents.

b. All storage media used for classified data on dedicated and

system high AIS must be labeled and controlled to the highest level

of the information on the AIS. However, information not at the

highest level may be written to appropriately

classified/unclassified media using authorized procedures and/or

methods.

c. All data storage media for compartmented and multilevel AIS

must be labeled and controlled to the highest level of the

information contained on the media.

d. When two or more AISs are collocated in the same security area

and processing at different levels or compartments, procedures

described in the system security plan will be used to distinguish

among them.

e. Authorized sanitization procedures for the most commonly used

memory and storage media are defined in the sanitization matrix.

f. Media must be sanitized and all markings and labels removed

before media can be declassified. Sanitization actions must be

verified and a record must be annotated to show the date, the

particular sanitization action taken, and the person taking the

action.

g. Media must be sanitized and declassified prior to release from

continuous protection.

h. All printed output from an AIS processing in the dedicated or

system high mode must be treated as though classified until

verified to be unclassified.

8-303. Security Audits

a. In addition to the audits required under security modes, the

following logs are required regardless of mode of operation. The

logs must include the date, the event, and the person responsible.

(1) Maintenance, repair, installation, or removal of hardware

components. Log must include the component involved, and action

taken.

(2) Installation, testing, and modification of operating

system and security-related software. Log must include the software

involved and action taken.

(3) Upgrading and downgrading actions.

(4) Sanitization and declassifying media and devices.

(5) Application and reapplication of seals.

b. At intervals specified in the AISSP, the ISSR (or designee)

shall review, analyze, and annotate audit records created during

classified processing periods to ensure that all pertinent activity

is properly recorded and appropriate action has been taken to

correct anomalies.

c. Audit trail records shall be retained until reviewed and

released by the contractor or CSA but not more than 12 months.

8-304. AIS Operations

a. Security Level Upgrading. To increase the level of processing

on an AIS the following procedures must be implemented:

(1) Adjust the area controls to the level of information to

be processed.

(2) Configure the AIS as described in the AISSP. The use of

logical disconnects is prohibited for AIS processing TOP SECRET

information.

(3) Remove and store removable data storage media not to be

used during the processing period.

(4) Clear all memory including buffer storage.

(5) Initialize the system for processing at the approved

level of operation with a dedicated copy of the operating system.

This copy of the operating system must be protected commensurate

with the security classification and access levels of the

information to be processed during the period.

b. Security Level Downgrading. To lower the level of processing,

the following procedures must be implemented:

(1) Remove and store removable data storage media not to be

used during the lower processing period.

(2) Clear the memory and buffer storage of the equipment to

be downgraded, for collateral SECRET and below; sanitize for TOP

SECRET.

(3) Sanitize printers.

(4) For classified processing, configure the AIS as described

in the AISSP.

(5) Adjust the area controls to the level of information to

be processed.

(6) Initialize the system for processing at the lower level

with a dedicated copy of the operating system. This copy of the

operating system must be protected commensurate with the security

classification and access levels of the information to be processed

during the period.

8-305. Identification and Authentication Techniques.

When the AIS is processing classified information, access to any

unattended hardware must conform to those required in this document

for the highest level of classified material processed on the AIS.

Specific user identification and authentication techniques and

procedures will be included in the AISSP. Examples of

identification and authentication techniques include, but are not

limited to: user IDs and passwords, tokens, biometrics and

smartcards.

a. User IDs identify users in the system and are used in

conjunction with authentication techniques to gain access to the

system. User IDs will be disabled whenever a user no longer has a

need-to-know or proper clearance. The user ID will be deleted from

the system only after review of programs and data associated with

the ID. Disabled accounts will be removed from the system as soon

as practical. Access attempts will be limited to five tries. Users

who fail to access the system within the established limits will be

denied access until the user's ID is reactivated.

b. When used, system logon passwords will be randomly selected

and will be at least six characters in length.

(1) Appropriate guidance must be provided by the ISSR or

contractor to users prior to their choosing their own logon

passwords. When an automated system logon-password generation

routine is used, it must be described in the AISSP.

(2) Passwords must be validated by the system each time the

user accesses the system.

(3) System logon passwords must not be displayed at any

terminal or printed on any printer.

(4) Passwords will not be shared by any user.

(5) Passwords will be classified and controlled at the

highest level of the information accessed.

(6) Passwords must be changed at least every 6 months.

(7) Immediately following a suspected or known compromise of

a password, the ISSR will be notified and a new password issued.

c. Master data files containing the user population system logon

passwords will be encrypted when practical. Access to the files

will be limited to the ISSR and a designee identified in the AISSP.

d. When classified and unclassified AIS are collocated the

following requirements apply:

(1) The ISSR must document procedures to ensure the

protection of classified information.

(2) The unclassified AIS cannot be connected to the

classified AIS.

(3) Users shall be provided a special awareness briefing.

e. When two or more AISs are collocated in the same security area

and processing at different levels or compartments, procedures

described in the AISSPwill be used to distinguish among them.

8-306. Maintenance

a. Cleared personnel who perform maintenance or diagnostics do

not normally require an escort. Need-to-know for access to

classified information must be enforced. Uncleared maintenance

personnel must always be escorted by a cleared and technically

knowledgeable individual. The ISSR must ensure that escorts of

uncleared maintenance personnel are trained and sufficiently

knowledgeable concerning the AISSP, established security policies

and practices, and escorting procedures.

b. If maintenance is being conducted by appropriately cleared

personnel, system sanitizing or component isolation are a local

option. If maintenance is being performed by uncleared personnel,

steps must be taken to effectively deny access to classified

information by the uncleared person and any maintenance equipment

or software used; these procedures should be documented in the

AISSP. A technically knowledgeable escort is preferred. If access

to classified data cannot be precluded by the escort, either the

component under maintenance must be physically disconnected from

the classified AIS (and sanitized before and after maintenance) or

the entire AIS must be sanitized before and after maintenance.

c. The dedicated copy of the system software with a direct

security function shall not be used for maintenance purposes by

uncleared personnel.

d. When a system failure prevents sanitization of the system

prior to maintenance by uncleared vendor personnel, AISSP

procedures must be enforced to deny the uncleared person visual and

electronic access to any classified data that may be contained on

the system.

e. When practical, all maintenance and diagnostics will be

performed in the contractor's facility. Any AIS components or

equipment released from secure control is no longer part of an

accredited system.

f. Vendor-supplied software/firmware used for maintenance or

diagnostics must be protected at the level of the accredited AIS.

The CSA may allow, on a case-by-case basis, the release of certain

types of costly magnetic media for maintenance, such as disk

head-alignment.

g. All maintenance tools, diagnostic equipment, and other devices

used to service an accredited AIS must be approved by the

contractor.

h. Any component board placed into an accredited AIS must remain

in the security area until proper release procedures are completed.

i. Remote diagnostic or maintenance services are strongly

discouraged. If remote diagnostic or maintenance services become

necessary, the AIS shall be sanitized and disconnected from any

communication links to network, prior to the connection of any

nonsecured communication line.

Clearing and Sanitization Matrix

Media Clear Sanitize

Magnetic Tape

Type I a or b a, b, or m

Type II a or b b or m

Type III a or b m

Magnetic Disk

Bernoullis a, b, or c m

Floppies a, b, or c m

Non-Removable Rigid Disk c a, b, d, or m

Removable Rigid Disk a, b, or c a, b, d, or m

Optical Disk

Read Many, Write Many c m

Read Only m, n

Write Once, Read Many (Worm) m, n

Memory

Dynamic Random Access Memory (DRAM) c or g c,g, or m

Electronically Alterable PROM (EAPROM) i j or m

Electronically Erasable PROM (EEPROM) i h or m

Erasable Programmable (ROM (EPROM) k l then c, or m

Flash EPROM (FEPROM) i c then i, or m

Programmable ROM (PROM) c m

Magnetic Bubble Memory c a, b, c, or m

Magnetic Core Memory c a, b, e, or m

Magnetic Plated Wire c c and f, or m

Magnetic Resistive Memory c m

Nonvolatile RAM (NOVRAM) c or g c, g, or m

Read Only Memory ROM m

Static Random Access Memory (SRAM) c or g c and f, g, or m

Equipment

Cathode Ray Tube (CRT) g q

Printers

Impact g p then g

Laser g o then g

Clearing and Sanitization Matrix

a. Degauss with a Type I degausser

b. Degauss with a Type II degausser.

c. Overwrite all addressable locations with a single character.

d. Overwrite all addressable locations with a character, its

complement, then a random character and verify. THIS METHOD IS NOT

APPROVED FOR SANITIZING MEDIA THAT CONTAINS TOP SECRET INFORMATION.

e. Overwrite all addressable locations with a character, its

complement, then a random character.

f. Each overwrite must reside in memory for a period longer than

the classified data resided.

g. Remove all power to include battery power.

h. Overwrite all locations with a random pattern, all locations

with binary zeros, all locations with binary ones.

i. Perform a full chip erase as per manufacturer's data sheets.

j. Perform i above, then c above, a total of three times.

k. Perform an ultraviolet erase according to manufacturer's

recommendation.

l. Perform k above, but increase time by a factor of three.

m. Destroy - Disintegrate, incinerate, pulverize, shred, or melt.

n. Destruction required only if classified information is

contained.

o. Run five pages of unclassified text (font test acceptable).

p. Ribbons must be destroyed. Platens must be cleaned.

q. Inspect and/or test screen surface for evidence of burned-in

information. If present, the cathode ray tube must be destroyed.

Section 4. Networks

8-400. Networks.

This Section identifies basic security requirements for protecting

classified information processed on accredited networks. Network

operations shall maintain the integrity of the security features

and assurances of its mode of operation. A "Reference Guide for

Security in Networks" can be obtained from the CSA.

8-401. Types of Networks.

a. A Unified Network is a collection of AIS's or network systems

that are accredited as a single entity by a single CSA. A unified

network may be as simple as a small standalone LAN operating in

dedicated mode, following a single security policy, accredited as

a single entity, and administered by a single ISSR. The perimeter

of such a network encompasses all its hardware, software, and

attached devices. Its boundary extends to all its users. A unified

network has a single mode of operation based on the clearance

levels, access, and need-to-know. This mode of operation will be

mapped to the level of trust required and will address the risk of

the least trusted user obtaining the most sensitive information

processed or stored on the network.

b. An interconnected network is comprised of separately

accredited AISs and/or unified networks. Each self-contained AIS

maintains its own intra-AIS services and controls, protects its own

resources, and retains its individual accreditation. Each

participating AIS or unified network has its own ISSR. The

interconnected network must have a security support structure

capable of adjudicating the different security policy

(implementations) of the participating AISs or unified networks. An

interconnected network requires accreditation, which may be as

simple as an addendum to a Memorandum of Agreement (MOA) between

the accrediting authorities.

8-402. Methods of Interconnection.

a. Security support structure (SSS) is the hardware, software,

and firmware required to adjudicate security policy and

implementation differences between and among connecting unified

networks and/or AISs. The SSS must be accredited. The following

requirements must be satisfied as part of the SSS accreditation:

(1) Document the security policy enforced by the SSS.

(2) Identify a single mode of operation.

(3) Document the network security architecture and design.

(4) Document minimum contents of MOA's required for

connection to the SSS.

b. Separately accredited network (SAN) is a medium of

interconnection of convenience. Networks and/or AISs that are

interconnected through a SAN must meet the connection rules of the

SAN.

c. The interconnection of previously accredited systems into an

accredited network may require a re-examination of the security

features and assurances of the contributing systems to ensure their

accreditations remain valid.

(1) Once an interconnected network is defined and accredited,

additional networks or separate AISs (separately accredited) may

only be connected through the accredited SSS.

(2) The addition of components to contributing unified

networks that are members of an accredited interconnected network

are allowed provided these additions do not change the

accreditation of the contributing system.

8-403. Network Requirements.

a. Network Security Management. The contractor shall designate an

ISSR for each accredited network to oversee security. The ISSR is

responsible for ensuring compliance with the network security

requirements as described in the AISSP.

b. Network Security Coordination.

(1) Every network must have a security plan.

(2) When different CSAs are involved, a single network

security manager (NSM) may be named that will be responsible for

network security (including the network AISSP). The NSM will ensure

a comprehensive approach to enforce the overall security policy

required by the network security plan.

c. Specific network requirements must be determined on a

case-by-case basis by the CSAs involved; however, as a minimum, the

AISSP for the network must address the following additional

requirements:

(1) Description of security services and mechanisms

protecting against network specific threats. Consistent with its

mode of operation, the network must provide the following security

services:

(a) Access control.

(b) Data flow control.

(d) Auditing.

(e) Communications integrity.

(2) Consistent implementation of security features across the

network components.

(3) Configuration control of network interconnections.

(4) Protection and control of data transfers.

(5) Security features incorporated in communications

protocols.

(6) Adequacy of any filtering bridge, secure gateway, or

other similar security device in controlling access and data flow.

(7) Compatibility of the entire combination of operating

modes when connecting a new system.

(8) Adequacy of the external system's features to support the

local security policy.

8-404. Transmission Security.

Protected Distribution Systems or National Security Agency approved

encryption methodologies and devices shall be used to protect

classified information when it is being transmitted between network

components.

Table of Contents