home *** CD-ROM | disk | FTP | other *** search
/ 2,000 Greater & Lesser Mysteries / 2,000 Greater and Lesser Mysteries.iso / security / mys01891.txt < prev    next >
Encoding:
Text File  |  1994-06-10  |  93.4 KB  |  1,655 lines
  1.  
  2.                    BIBLIOGRAPHY OF GUIDELINES
  3.  
  4.                        (1974 through 1988
  5.  
  6. Note:  A bibliography is now being developed to encompass 1989.  
  7.  
  8.  
  9.                         AUTHORS SPECIFIED
  10.  
  11.                        ABUSE/MISUSE/CRIME
  12.  
  13.                                                              
  14.           AUTHOR:  Ruder, Brian and Madden, J.D.              
  15.                                                              
  16.           TITLE:  An Analysis of Computer Security Safeguards 
  17.                  for Detecting and Preventing Intentional    
  18.                  Computer Misuse                             
  19.           ORGANIZATION: Institute for Computer Sciences       
  20.                        and Technology                        
  21.           PUBLISHER/ORIGINATOR: National Institute of         
  22.                                Standards and Technology      
  23.           REPORT NO:  NBS SPEC PUB 500-25                     
  24.           PUBLICATION DATE: January 1978                      
  25.           CATEGORY:  Abuse/Misuse/Crime                       
  26.          COST:  $11.95                                       
  27.          DESCRIPTION:  Analyzes 88 computer safeguard        
  28.          techniques that could be applied to recorded, actual
  29.          computer misuse cases.                              
  30.  
  31.  
  32.                          ACCESS CONTROL
  33.  
  34.                                                             
  35.           AUTHOR:  Brand, Sheila L. and Makey, Jeffrey D.     
  36.                                                              
  37.           TITLE:  Department of Defense Password Management   
  38.                  Guidelines                                  
  39.                                                              
  40.           ORGANIZATION: Department of Defense Computer        
  41.                        Security Center                       
  42.           PUBLISHER/ORIGINATOR: Department of Defense Computer
  43.                                Security Center               
  44.           REPORT NO: CSC-STD-002-85                           
  45.           PUBLICATION DATE:  April 12, 1985                   
  46.           CATEGORY:  Access Control                           
  47.          COST:  $1.75                                        
  48.          DESCRIPTION: This guideline is also known as the    
  49.          Green Book. This document provides a set of good    
  50.          practices related to the use of password-based user 
  51.          authentication mechanisms in automatic data         
  52.          processing systems.                                 
  53.                     
  54.                                                              
  55.           AUTHOR:  Branstad, Dennis                           
  56.                                                              
  57.           TITLE:  Computer Security and the Data Encryption   
  58.                  Standard                                    
  59.                                                              
  60.           ORGANIZATION:  Institute for Computer Sciences      
  61.                         and Technology                       
  62.           PUBLISHER/ORIGINATOR: National Institute of         
  63.                                Standards and Technology      
  64.           REPORT NO:  NBS SPEC PUB 500-27                     
  65.           PUBLICATION DATE:  February 1978                    
  66.           CATEGORY:  Access Control                           
  67.          COST:  $16.95                                       
  68.          DESCRIPTION:  Includes papers and summaries of      
  69.          presentations made at a 1978 conference on computer 
  70.          security.                                           
  71.  
  72.  
  73.                                                              
  74.           AUTHOR:  Branstad, Dennis                           
  75.                                                              
  76.           TITLE:   Standard on Password Usage                 
  77.                                                              
  78.                                                              
  79.           ORGANIZATION:  Institute for Computer Sciences      
  80.                         and Technology                       
  81.           PUBLISHER/ORIGINATOR: National Institute of         
  82.                                Standards and Technology      
  83.           REPORT NO:  FIPS PUB 112                            
  84.           PUBLICATION DATE:   March 1985                      
  85.           CATEGORY:  Access Control                           
  86.          COST:  $13.95                                       
  87.          DESCRIPTION: Discusses ten minimum security criteria
  88.          to consider when designing a password-based access  
  89.          control system for a computer.                      
  90.                        
  91.  
  92.                                                              
  93.           AUTHOR: Cole, Gerald and Heinrich, Frank            
  94.                                                              
  95.           TITLE:  Design Alternatives for Computer Network    
  96.          Security (Vol.I) The Network Security Center: A     
  97.          System Level Approach to Computer Network Security  
  98.           ORGANIZATION: Institute for Computer Sciences       
  99.                        and Technology                        
  100.           PUBLISHER/ORIGINATOR: National Institute of         
  101.                                Standards and Technology      
  102.           REPORT NO:  NBS SPEC PUB 500-21                     
  103.           PUBLICATION DATE:  January 1978                     
  104.           CATEGORY:  Access Control                           
  105.          COST:  $10.00                                       
  106.          DESCRIPTION: This study focuses on the data         
  107.          encryption standard and looks at the network        
  108.          security requirements and implementation of a       
  109.          computer dedicated to network security.             
  110.                                                         
  111.           AUTHOR:  Gait, Jason                                
  112.                                                              
  113.           TITLE:  Maintenance Testing for the Data            
  114.                  Encryption Standard                         
  115.                                                              
  116.           ORGANIZATION:  Institute for Computer Sciences      
  117.                         and Technology                       
  118.           PUBLISHER/ORIGINATOR:  National Institute of        
  119.                                 Standards and Technology     
  120.           REPORT NO:  NBS SPEC PUB 500-61                     
  121.           PUBLICATION DATE:  August 1980                      
  122.           CATEGORY: Access Control                            
  123.          COST: $9.95                                         
  124.          DESCRIPTION:  Describes the SRI hierarchical        
  125.          development methodology for designing large software
  126.          systems such as operating systems and data          
  127.          management systems that meet high security          
  128.          requirements.                                       
  129.  
  130.                                                              
  131.           AUTHOR:  Gait, Jason                                
  132.                                                              
  133.           TITLE: Validating the Correctness of Hardware       
  134.                 Implementations of the NBS Data Encryption   
  135.                 Standard                                     
  136.           ORGANIZATION:  Institute for Computer Sciences      
  137.                         and Technology                       
  138.           PUBLISHER/ORIGINATOR: National Institute of          
  139.                                Standards and Technology      
  140.           REPORT NO:  NBS SPEC PUB 500-20                     
  141.           PUBLICATION DATE:  November 1977                    
  142.           CATEGORY:  Access Control                           
  143.          COST: $9.95                                         
  144.          DESCRIPTION:  Describes the design and operation of 
  145.          the ICST testbed that is used for the validation of 
  146.          hardware implementations of (DES).                  
  147.  
  148.                                                          
  149.           AUTHOR:  Orceyre, M.J. and Courtney, R.H. Jr.       
  150.                                                              
  151.           TITLE:  Considerations in the Selection of          
  152.                  Security Measures of Automatic Data         
  153.                  Processing Systems                          
  154.           ORGANIZATION:  Institute for Computer Sciences      
  155.                         and Technology                       
  156.           PUBLISHER/ORIGINATOR: National Institute of         
  157.                                Standards and Technology      
  158.           REPORT NO:  NBS SPEC PUB 500-33                     
  159.           PUBLICATION DATE:  No Date Given                    
  160.           CATEGORY:  Access Control                           
  161.          COST: $8.50                                         
  162.          DESCRIPTION:  This publication list techniques that 
  163.          can be used for protecting computer data transmitted
  164.          across telecommunications lines.                    
  165.                        
  166.                                                         
  167.           AUTHOR:  Smid, Miles E.                             
  168.                                                              
  169.           TITLE:  A Key Notarization System for Computer      
  170.                  Networks                                    
  171.                                                              
  172.           ORGANIZATION:  Institute for Computer Sciences      
  173.                         and Technology                       
  174.           PUBLISHER/ORIGINATOR: National Institute of         
  175.                                Standards and Technology      
  176.           REPORT NO:  NBS SPEC PUB 500-54                     
  177.           PUBLICATION DATE: October 1979                      
  178.           CATEGORY:  Access Control                           
  179.          COST:  $4.50                                        
  180.          DESCRIPTION:   Looks at a system for key            
  181.          notarization that can be used with an encryption    
  182.          device which will improve data security in a        
  183.          computer network.                                   
  184.                        
  185.                                         
  186.           AUTHOR:  Troy, Eugene F.                            
  187.                                                              
  188.           TITLE:  Security for Dial-Up Lines                  
  189.                                                              
  190.           ORGANIZATION: Institute for Computer Sciences       
  191.                        and Technology                        
  192.           PUBLISHER/ORIGINATOR: National Institute of         
  193.                                Standards and Technology      
  194.           REPORT NO: NBS SPEC PUB 500-137                     
  195.           PUBLICATION DATE:  May 1986                         
  196.           CATEGORY:  Access Control                           
  197.          COST: $3.75                                         
  198.          DESCRIPTION: Methods for protecting computer systems
  199.          against intruders using dial-up telephone lines are 
  200.          discussed.                                          
  201.                   
  202.                                                         
  203.           AUTHOR:  Wood, Helen                                
  204.                                                              
  205.           TITLE:   The Use of Passwords for Controlled        
  206.                   Access to Computer Resources               
  207.                                                              
  208.           ORGANIZATION:  Institute for Computer Sciences      
  209.                         and Technology                       
  210.           PUBLISHER/ORIGINATOR: National Institute of         
  211.                                Standards and Technology      
  212.           REPORT NO:   NBS SPEC PUB 500-9                     
  213.           PUBLICATION DATE:  May 1977                         
  214.           CATEGORY:  Access Control                           
  215.          COST: $11.95                                        
  216.          DESCRIPTION: Describes the need for and uses of     
  217.          passwords. Password schemes are categorized         
  218.          according to selection technique, lifetime,         
  219.          physical characteristics, and information content.  
  220.  
  221.  
  222.                       AUDIT AND EVALUATION
  223.  
  224.  
  225.                                                              
  226.           AUTHOR:  Brand, Sheila L.                           
  227.                                                              
  228.           TITLE:  Department of Defense Trusted Computer      
  229.                  System Evaluation Criteria                  
  230.                                                              
  231.           ORGANIZATION:  Department of Defense                
  232.                                                              
  233.           PUBLISHER/ORIGINATOR: Department of Defense Computer
  234.          Security Center                                     
  235.           REPORT NO: CSC-STD-001-83                           
  236.           PUBLICATION DATE:  August 15, 1983                  
  237.           CATEGORY:  Audit and Evaluation                     
  238.          COST:  Free                                         
  239.          DESCRIPTION: This document forms the basic          
  240.          requirements and evaluation classes needed for      
  241.          assessing the effectiveness of security and controls
  242.          used by automatic data processing (ADP) systems.    
  243.                  
  244.                                                          
  245.           AUTHOR:  Dallas, Dennis A. & Vallabhaneni, Rao S.   
  246.                                                              
  247.           TITLE:  Auditing Program Libraries for Change       
  248.                  Controls                                    
  249.                                                              
  250.           ORGANIZATION:  Institute of Internal Auditors       
  251.                                                              
  252.           PUBLISHER/ORIGINATOR: Institute of Internal Auditors
  253.                                                              
  254.           REPORT NO:  693                                     
  255.           PUBLICATION DATE:   1986                            
  256.           CATEGORY:   Audit and Evaluation                    
  257.          COST: $12.00                                        
  258.          DESCRIPTION:  This monograph is a concise how-to    
  259.          guide for reviewing program libraries and associated
  260.          computer program change controls that are risky and 
  261.          prone to human error.                               
  262.                        
  263.                                                         
  264.           AUTHOR:  Ruthberg, Zella and McKenzie,              
  265.                   Robert, ed.                                
  266.           TITLE:  Audit and Evaluation of Computer Security   
  267.                                                              
  268.           ORGANIZATION:  Institute for Computer Sciences      
  269.                         and Technology                       
  270.           PUBLISHER/ORIGINATOR: National Institute of         
  271.                                Standards and Technology      
  272.           REPORT NO:  NBS SPEC PUB 500-19                     
  273.           PUBLICATION DATE:  October 1978                     
  274.           CATEGORY:   Audit and Evaluation                    
  275.          COST: $7.50                                         
  276.          DESCRIPTION:  An examination of the recommendations 
  277.          by computer auditing experts on how to improve      
  278.          computer security audit practices.                  
  279.                      
  280.                                                         
  281.           AUTHOR: Ruthberg, Zella, ed.                        
  282.                                                              
  283.           TITLE:  Audit and Evaluation of Computer Security   
  284.                  II:  System Vulnerabilities and Control     
  285.                                                              
  286.           ORGANIZATION:  Institute for Computer Sciences      
  287.                         and Technology                       
  288.           PUBLISHER/ORIGINATOR: National Institute of         
  289.                                Standards and Technology      
  290.           REPORT NO:  NBS SPEC PUB 500-57                     
  291.           PUBLICATION DATE: April 1980                        
  292.           CATEGORY:  Audit and Evaluation                     
  293.          COST: $7.00                                         
  294.          DESCRIPTION:  Proceedings of the second NIST/GAO    
  295.          workshop to develop improved computer security audit
  296.          procedures.                                         
  297.                                                         
  298.           AUTHOR:  Ruthberg, Zella, Fisher, Bonnie,           
  299.                   Perry, William, Lainhart, John, Cox, James,
  300.                   Gillen, Mark, Hunt, Douglas                
  301.           TITLE: Guide to Auditing for Controls and Security: 
  302.                 A System Development Life Cycle Approach     
  303.                                                              
  304.           ORGANIZATION:  Institute for Computer Sciences      
  305.                         and Technology                       
  306.           PUBLISHER/ORIGINATOR: National Institute of         
  307.                                Standards and Technology      
  308.           REPORT NO:  NBS SPEC 500-153                        
  309.           PUBLICATION DATE:  April 1988                       
  310.           CATEGORY:  Auditing & Evaluation                    
  311.          COST:  $25.95                                       
  312.          DESCRIPTION:  This guide addresses auditing the     
  313.          system development life cycle process for an        
  314.          automated information system, to ensure that        
  315.          controls and security are designed and built into   
  316.          the system.                                         
  317.  
  318.                                                              
  319.           AUTHOR:  Ruthberg, Zella & Fisher, Bonnie           
  320.                                                              
  321.           TITLE:  Work Priority Scheme for EDP Audit and      
  322.                  Computer Security Review                    
  323.                                                              
  324.           ORGANIZATION:  Institute for Computer Sciences      
  325.                         and Technology                       
  326.           PUBLISHER/ORIGINATOR: National Institute of         
  327.                                Standards and Technology      
  328.           REPORT NO:  NBSIR 86-3386                           
  329.           PUBLICATION DATE: August 1986                       
  330.           CATEGORY:  Audit and Evaluation                     
  331.          COST:  $11.95                                       
  332.          DESCRIPTION: Describes a methodology for            
  333.          prioritizing the work performed by EDP auditors and 
  334.          computer security reviewers.                        
  335.  
  336.                       
  337.                          CERTIFICATION
  338.  
  339.                                                              
  340.           AUTHOR:  Giragosian, P.A., Mastbrook, D.W. &        
  341.                   Tompkins, F.G.                             
  342.           TITLE:  Guidelines for Certification of Existing    
  343.                  Sensitive Systems                           
  344.                                                              
  345.           ORGANIZATION:  Mitre Corporation                    
  346.                                                              
  347.           PUBLISHER/ORIGINATOR: National Aeronautics and      
  348.                                Space Administration          
  349.           REPORT NO:  PB84-223122                             
  350.           PUBLICATION DATE:  July 1982                        
  351.           CATEGORY:  Certification                            
  352.          COST:  $11.95                                       
  353.          DESCRIPTION:  This document describes a way to      
  354.          perform evaluations of the security of a computer   
  355.          system that has sensitive software applications.    
  356.                       
  357.                                                              
  358.           AUTHOR:  Ruthberg, Zella G. & Neugent, William      
  359.                                                              
  360.           TITLE:  Overview of Computer Security Certification 
  361.                  and Accreditation                           
  362.                                                              
  363.           ORGANIZATION:  Institute for Computer Sciences      
  364.                         and Technology                       
  365.           PUBLISHER/ORIGINATOR: National Institute of         
  366.                                Standards and Technology      
  367.           REPORT NO:  NBS SPEC PUB 500-109                    
  368.           PUBLICATION DATE:  April 1984                       
  369.           CATEGORY: Certification                             
  370.          COST:  $1.50                                        
  371.          DESCRIPTION:  These guidelines describe the major    
  372.          features of the certification and accreditation     
  373.          process. It is intended to help ADP managers and    
  374.          their staff understand this process.                
  375.  
  376.  
  377.                       CONTINGENCY PLANNING
  378.  
  379.                                                            
  380.           AUTHOR:  Isaac, Irene                               
  381.                                                              
  382.           TITLE:  Guide on Selecting ADP Backup Process       
  383.                  Alternatives                                
  384.                                                              
  385.           ORGANIZATION: Institute for Computer Sciences       
  386.                        and Technology                        
  387.           PUBLISHER/ORIGINATOR: National Institute of         
  388.                                of Standards and Technology   
  389.           REPORT NO:  NBS SPEC PUB 500-134                    
  390.           PUBLICATION DATE:  November 1985                    
  391.           CATEGORY:  Contingency Planning                     
  392.          COST: $1.75                                         
  393.          DESCRIPTION: Discusses the selection of ADP backup  
  394.          processing support in advance of events that cause  
  395.          the loss of data processing capability.             
  396.  
  397.                                                      
  398.           AUTHOR:   Schabeck, Tim A.                          
  399.                                                              
  400.           TITLE:   Emergency Planning Guide for Data          
  401.                   Processing Centers                         
  402.                                                              
  403.           ORGANIZATION:   None Specified                      
  404.                                                              
  405.           PUBLISHER/ORIGINATOR:  Assets Protection            
  406.                                                              
  407.           REPORT NO: ISBN No. 0-933708-00-9                   
  408.           PUBLICATION DATE:   1979                            
  409.           CATEGORY:  Contingency Planning                     
  410.          COST: $10.00                                        
  411.          DESCRIPTION:  This checklist provides an audit tool 
  412.          to evaluate a data processing center's  current     
  413.          disaster defense mechanisms and recovery capability.
  414.  
  415.                                                            
  416.           AUTHOR:  Shaw, James K. and Katzke, Stuart          
  417.                                                              
  418.           TITLE:  Executive Guide to ADP Contingency          
  419.                  Planning                                    
  420.                                                              
  421.           ORGANIZATION:  Institute for Computer Sciences      
  422.                         and Technology                       
  423.           PUBLISHER/ORIGINATOR: National Institute of         
  424.                                Standards and Technology      
  425.           REPORT NO: NBS SPEC PUB 500-85                      
  426.           PUBLICATION DATE:  July 1981                        
  427.           CATEGORY:  Contingency Planning                     
  428.          COST:  $7.00                                        
  429.          DESCRIPTION:  This document discusses the background
  430.          needed to understand the developmental process for  
  431.          Automatic Data Processing contingency plans.        
  432.       
  433.                     
  434.                     DATA BASE SECURITY
  435.  
  436.                                                             
  437.           AUTHOR:  Patrick, Robert L.                         
  438.                                                              
  439.           TITLE:  Performance Assurance and Data Integrity    
  440.                  Practices                                   
  441.                                                              
  442.           ORGANIZATION:   Institute for Computer Sciences     
  443.                          and Technology                      
  444.           PUBLISHER/ORIGINATOR: National Institute of         
  445.                                Standards and Technology      
  446.           REPORT NO:  NBS SPEC PUB 500-24                     
  447.           PUBLICATION DATE:  January 1978                     
  448.           CATEGORY:    Data Base Security                     
  449.          COST: $10.00                                        
  450.          DESCRIPTION: Describes methods that have been       
  451.          successful in preventing computer failure caused by 
  452.          programming and data errors.                        
  453.                        
  454.  
  455.                         GENERAL SECURITY
  456.                                                              
  457.           AUTHOR:  Fletcher, J.G.                             
  458.                                                              
  459.           TITLE:  Security Policy for Distributed Systems     
  460.                                                              
  461.                                                              
  462.           ORGANIZATION:  Lawrence Livermore National          
  463.                         Laboratory                           
  464.           PUBLISHER/ORIGINATOR:  National Technical           
  465.                                 Information Service          
  466.           REPORT NO:  DE82-022517                             
  467.           PUBLICATION DATE:  April 6, 1982                    
  468.           CATEGORY:  General Security                         
  469.          COST:  $9.95                                        
  470.          DESCRIPTION:  This document provides a security     
  471.          policy for distributed systems.  It has been modeled
  472.          according to security procedures for non-computer   
  473.          items.                                              
  474.        
  475.                                                       
  476.           AUTHOR:   Moore, Gwendolyn B., Kuhns, John L.,      
  477.                    Treffs, Jeffrey, & Montgomery, Christine  
  478.           TITLE:  Accessing Individual Records from Personal  
  479.                  Data Files Using Non-unique Identifiers     
  480.                                                              
  481.           ORGANIZATION:  Institute for Computer Sciences      
  482.                         and Technology                       
  483.           PUBLISHER/ORIGINATOR: National Institute of         
  484.                                Standards and Technology      
  485.           REPORT NO:  NBS SPEC PUB 500-2                      
  486.           PUBLICATION DATE:  February 1977                    
  487.           CATEGORY:  General Security                         
  488.          COST: $11.95                                        
  489.          DESCRIPTION:  Analyzes methodologies for retrieving 
  490.          personal information using non-unique identifiers   
  491.          such as name, address, etc.  This study presents    
  492.          statistical data for judging the accuracy and       
  493.          efficiency of various methods.                      
  494.  
  495.                                                        
  496.           AUTHOR: Smid, Miles                                 
  497.                                                              
  498.           TITLE:  Standard on Computer Data Authentication    
  499.                                                              
  500.                                                              
  501.           ORGANIZATION: Institute for Computer Sciences       
  502.                        and Technology                        
  503.           PUBLISHER/ORIGINATOR: National Institute of         
  504.                                Standards and Technology      
  505.           REPORT NO:  FIPS PUB 113                            
  506.           PUBLICATION DATE:  March 1985                       
  507.           CATEGORY:  General Security                         
  508.          COST: $9.95                                         
  509.          DESCRIPTION:  This publication describes a data     
  510.          authentication algorithm that can detect            
  511.          unauthorized modification to computer data          
  512.          either intentionally or accidentally.               
  513.                        
  514.  
  515.                                                            
  516.           AUTHOR:  Tompkins, F.G.                             
  517.                                                              
  518.           TITLE:  NASA Guidelines for Assuring the Adequacy   
  519.                  and Appropriateness of Security Safeguards  
  520.                  in Sensitive Applications                   
  521.           ORGANIZATION:  Mitre Corporation                    
  522.                                                              
  523.           PUBLISHER/ORIGINATOR: National Aeronautics and      
  524.                                Space Administration          
  525.           REPORT NO:  PB85-149003/XAB                         
  526.           PUBLICATION DATE: September 1984                    
  527.           CATEGORY:  General Security                         
  528.          COST: $18.95                                        
  529.          DESCRIPTION:  This document discusses security      
  530.          measures that should be taken in order to help      
  531.          conform with Office of Management and Budget        
  532.          Circular A-71.                                      
  533.  
  534.                                                            
  535.           AUTHOR:  Westin, Allen F.                           
  536.                                                              
  537.           TITLE:  Computers, Personnel Administration, and    
  538.                  Citizen Rights                              
  539.                                                              
  540.           ORGANIZATION:  Institute for Computer Sciences      
  541.                         and Technology                       
  542.           PUBLISHER/ORIGINATOR: National Institute of         
  543.                                Standards and Technology      
  544.           REPORT NO: NBS SPEC PUB 500-50                      
  545.           PUBLICATION DATE: July 1979                         
  546.           CATEGORY:  General Security                         
  547.          COST:  $34.95                                       
  548.          DESCRIPTION: Reports on impact of computers on      
  549.          citizen rights in the field of personnel record     
  550.          keeping.                                            
  551.  
  552.  
  553.                      MICROCOMPUTER SECURITY
  554.                                                              
  555.           AUTHOR:  Steinauer, Dennis D.                       
  556.                                                              
  557.           TITLE:  Security of Personal Computer Systems: A    
  558.                  Management Guide                            
  559.                                                              
  560.           ORGANIZATION: Institute for Computer Sciences       
  561.                        and Technology                        
  562.           PUBLISHER/ORIGINATOR: National Institute of         
  563.                                Standards and Technology      
  564.           REPORT NO:  NBS SPEC PUB 500-120                    
  565.           PUBLICATION DATE:  No Date Given                    
  566.           CATEGORY:  Microcomputer Security                   
  567.          COST:  $3.00                                        
  568.          DESCRIPTION:  This publication provides practical   
  569.          advice on the issues of physical and environmental  
  570.          protection system and data access control, integrity
  571.          of software and data, backup and contingency        
  572.          planning, auditability, and communications          
  573.          protection.                                         
  574.  
  575.  
  576.                           PRIVACY
  577.                                                              
  578.           AUTHOR:  Fong, Elizabeth                            
  579.                                                              
  580.           TITLE:  A Data Base Management Approach to Privacy  
  581.                  Act Compliance                              
  582.                                                              
  583.           ORGANIZATION:  Institute for Computer Sciences      
  584.                         and Technology                       
  585.           PUBLISHER/ORIGINATOR: National Institute of         
  586.                                Standards and Technology      
  587.           REPORT NO:  NBS SPEC PUB 500-10                     
  588.           PUBLICATION DATE:  June 1977                        
  589.           CATEGORY:  Privacy                                  
  590.          COST: $4.50                                         
  591.          DESCRIPTION: Looks at commercially available data   
  592.          base management systems that can be used in meeting 
  593.          Privacy Act requirements for the handling of        
  594.          personal data.                                      
  595.                
  596.                                                              
  597.           AUTHOR:   Goldstein, Robert, Seward, Henry, &       
  598.                    Nolan, Richard                            
  599.           TITLE:  A Methodology for Evaluating Alternative    
  600.                  Technical and Information Management        
  601.                  Approaches to Privacy Requirements          
  602.           ORGANIZATION:  Institute for Computer Sciences      
  603.                         and Technology                       
  604.           PUBLISHER/ORIGINATOR: National Institute of         
  605.                                Standards and Technology      
  606.           REPORT NO:   PB 254048                              
  607.           PUBLICATION DATE:  June 1976                        
  608.           CATEGORY:  Privacy                                  
  609.          COST:  $11.50                                       
  610.          DESCRIPTION:  Describes the methods to be used by   
  611.          recordkeepers to comply with the Privacy Act. A     
  612.          computer model is included to help determine the    
  613.          most cost-effective safeguards.                     
  614.                 
  615.  
  616.  
  617.                          RISK MANAGEMENT
  618.                                                              
  619.           AUTHOR:  Courtney, Robert H. Jr.                    
  620.                                                              
  621.           TITLE:  Guideline for Automatic Data Processing     
  622.                  Risk Analysis                               
  623.                                                              
  624.           ORGANIZATION:  Institute for Computer Sciences      
  625.                         and Technology                       
  626.           PUBLISHER/ORIGINATOR: National Institute of         
  627.                                Standards and Technology      
  628.           REPORT NO:  FIPS PUB 65                             
  629.           PUBLICATION DATE:  August 1979                      
  630.           CATEGORY:  Risk Management                          
  631.          COST: $8.50                                         
  632.          DESCRIPTION: Shows how to use a technique that      
  633.          provides a way of conducting risk analysis of an ADP
  634.          facility. It gives an example of the risk analysis  
  635.          process.                                            
  636.                
  637.                                                         
  638.           AUTHOR:  Jacobson, Robert V., Brown, William F.,    
  639.                   & Browne, Peter S.                         
  640.           TITLE:  Guidelines for ADP Physical Security and    
  641.                  Risk Management                             
  642.                                                              
  643.           ORGANIZATION:  Institute for Computer Sciences      
  644.                         and Technology                       
  645.           PUBLISHER/ORIGINATOR: National Institute of         
  646.                                Standards and Technology      
  647.           REPORT NO: FIPS PUB 31                              
  648.           PUBLICATION DATE:  June 1974                        
  649.           CATEGORY: Risk Management                           
  650.          COST: $11.95                                        
  651.          DESCRIPTION:  Provides guidance to federal          
  652.          organizations in developing physical security and   
  653.          risk management programs for their ADP facilities.  
  654.  
  655.                                                          
  656.           AUTHOR: Neugent, William, Gilligan, John,           
  657.                  Hoffman, Lance & Ruthberg, Zella G.         
  658.           TITLE:  Technology Assessment:  Methods for         
  659.                  Measuring the Level of Computer Security    
  660.                                                              
  661.           ORGANIZATION: Institute for Computer Sciences       
  662.                        and Technology                        
  663.           PUBLISHER/ORIGINATOR: National Institute of         
  664.                                Standards and Technology      
  665.           REPORT NO: NBS SPEC PUB 500-133                     
  666.           PUBLICATION DATE:  October 1985                     
  667.           CATEGORY:  Risk Management                          
  668.          COST:  $8.00                                        
  669.          DESCRIPTION:  This document covers methods for      
  670.          measuring the level of computer security and        
  671.          addresses individual techniques and approaches, as  
  672.          well as broader methodologies.                      
  673.  
  674.                                                              
  675.           AUTHOR:  Tompkins, F.G.                             
  676.                                                              
  677.           TITLE:  Guidelines for Contingency Planning NASA    
  678.                  ADP Security Risk Reduction Decision        
  679.                  Studies                                     
  680.           ORGANIZATION:  Mitre Corporation                    
  681.                                                              
  682.           PUBLISHER/ORIGINATOR: National Aeronautic  and      
  683.                                Space Administration          
  684.           REPORT NO: PB84-189836                              
  685.           PUBLICATION DATE:  January 1984                     
  686.           CATEGORY:  Risk Management                          
  687.          COST: $13.95                                        
  688.          DESCRIPTION:  How to determine an acceptable level  
  689.          of ADP security risks is described as well as the   
  690.          role of risk management in problem solving and      
  691.          information systems analysis and design.            
  692.            
  693.                                                              
  694.           AUTHOR:  Tompkins, F.G                              
  695.                                                              
  696.           TITLE:  Guidelines for Developing NASA ADP Security 
  697.                  Risk Management Plans                       
  698.                                                              
  699.           ORGANIZATION:  Mitre Corporation                    
  700.                                                              
  701.           PUBLISHER/ORIGINATOR: National Aeronautics and      
  702.                                Space Administration          
  703.           REPORT NO: PB84-171321                              
  704.           PUBLICATION DATE:  August 1983                      
  705.           CATEGORY:   Risk Management                         
  706.          COST: $13.95                                        
  707.          DESCRIPTION:  This report looks at how NASA develops
  708.          ADP security risk management plan. Risk management  
  709.          processes have six components and each are          
  710.          identified and discussed.                           
  711.       
  712.  
  713.                        SECURITY MANAGEMENT
  714.                                                              
  715.           AUTHOR: Rosenthal, Lynne S.                         
  716.                                                              
  717.           TITLE:  Guidance on Planning and Implementing       
  718.                  Computer Systems Reliability                
  719.                                                              
  720.           ORGANIZATION:  Institute for Computer Sciences      
  721.                         and Technology                       
  722.           PUBLISHER/ORIGINATOR: National Institute of         
  723.                                Standards and Technology      
  724.           REPORT NO:  NBS SPEC PUB 500-121                    
  725.           PUBLICATION DATE: January 1985                      
  726.           CATEGORY:  Security Management                      
  727.          COST:  $2.25                                        
  728.          DESCRIPTION: The basic concepts of computer system  
  729.          security are given to provide managers and planners 
  730.          with background for improving computer system       
  731.          reliability.                                        
  732.                
  733.  
  734.  
  735.  
  736.               SOFTWARE & OPERATING SYSTEM SECURITY
  737.  
  738.  
  739.                                                              
  740.           AUTHOR:  Levitt, Karl, Neumann, Peter, and          
  741.                   Robinson, Lawrence                         
  742.           TITLE:  The SRI Hierarchical Development            
  743.                  Methodology (HDM) and its Application to    
  744.                  the Development of Secure Software          
  745.           ORGANIZATION:  Institute for Computer Sciences      
  746.                         and Technology                       
  747.           PUBLISHER/ORIGINATOR: National Institute of         
  748.                                Standards and Technology      
  749.           REPORT NO:  NBS SPEC PUB 500-67                     
  750.           PUBLICATION DATE:  October 1980                     
  751.           CATEGORY:  Software and Operating System Security   
  752.          COST:  $4.25                                        
  753.          DESCRIPTION: Shows how to design large software     
  754.          systems, such as an operating system, that will     
  755.          meet the hardest security requirements.             
  756.               
  757.  
  758.                       TRAINING & AWARENESS
  759.  
  760.                                                             
  761.           AUTHOR:  Davis, Bevette                             
  762.                                                              
  763.           TITLE:  Computer Security Bibliography              
  764.                                                              
  765.                                                              
  766.           ORGANIZATION:  Mitre Corporation                    
  767.                                                              
  768.           PUBLISHER/ORIGINATOR: Mitre Corporation             
  769.                                                              
  770.           REPORT NO:  MTR 9654                                
  771.           PUBLICATION DATE:  April 1985                       
  772.           CATEGORY:  Training & Awareness                     
  773.          COST:                                               
  774.          DESCRIPTION: Identifies organizations and           
  775.          individuals that have published documents, magazine 
  776.          and journal articles, conference proceedings, and   
  777.          reports concerning computer security.               
  778.  
  779.                                                              
  780.           AUTHOR:   Tompkins, Frederick G.                    
  781.                                                              
  782.           TITLE:  Guidelines for Development of NASA Computer 
  783.                  Security Training Programs                  
  784.                                                              
  785.           ORGANIZATION:  Mitre Corporation                    
  786.                                                              
  787.           PUBLISHER/ORIGINATOR:  National Aeronautics and     
  788.                                Space Administration          
  789.           REPORT NO:  PB84-171339/LP                          
  790.           PUBLICATION DATE:  May 1983                         
  791.           CATEGORY:  Training & Awareness                     
  792.          COST:  $11.95 plus $3.00 shipping & handling        
  793.          DESCRIPTION:  This report identifies computer       
  794.          security training courses and is intended to be used
  795.          by NASA in developing training requirements and     
  796.          implementing computer security training programs.   
  797.                       
  798.  
  799.                       AUTHORS NOT SPECIFIED
  800.                                                              
  801.           AUTHOR:  N/A                                        
  802.                                                              
  803.           TITLE:  Computer Fraud and Abuse Act of 1986        
  804.                                                              
  805.           ORGANIZATION:                                       
  806.                                                              
  807.           PUBLISHER/ORIGINATOR:                               
  808.                                                              
  809.           REPORT NO:  Public Law 99-474                       
  810.           PUBLICATION DATE:  October 16, 1986                 
  811.           CATEGORY:  Abuse/Misuse/Crime                       
  812.          COST:  Free                                         
  813.          DESCRIPTION: Provides additional penalties for      
  814.          fraud and related activities in connection with     
  815.          access devices and computers.                       
  816.  
  817.                                                          
  818.           AUTHOR:   N/A                                       
  819.                                                              
  820.           TITLE:   Federal Manager's Financial Integrity      
  821.                   Act of 1982                                
  822.                                                              
  823.           ORGANIZATION:                                       
  824.                                                              
  825.           PUBLISHER/ORIGINATOR:                               
  826.                                                              
  827.           REPORT NO: Public Law 97-255                        
  828.           PUBLICATION DATE:   September 8, 1982               
  829.           CATEGORY:  Abuse/Misuse/Crime                       
  830.          COST: Free                                          
  831.          DESCRIPTION: This law amends the accounting and     
  832.          auditing act of 1950 to require ongoing evaluations 
  833.          and reports on the adequacy of the systems of       
  834.          internal accounting and administrative control of   
  835.          each executive agency, and for other purposes.      
  836.  
  837.  
  838.  
  839.  
  840.                          ACCESS CONTROL
  841.  
  842.                                                              
  843.           AUTHOR:   Not Specified                             
  844.                                                              
  845.           TITLE:  Data Encryption Standard                    
  846.                                                              
  847.           ORGANIZATION:  Institute for Computer Sciences      
  848.                         and Technology                       
  849.           PUBLISHER/ORIGINATOR: National Institute of         
  850.                                Standards and Technology      
  851.           REPORT NO:  FIPS PUB 46                             
  852.           PUBLICATION DATE:  January 1977                     
  853.           CATEGORY:  Access Control                           
  854.          COST: $7.00                                         
  855.          DESCRIPTION:  Discusses an algorithm to be used for 
  856.          the cryptographic protection of sensitive, but      
  857.          unclassified, computer data. Tells how to transform 
  858.          data into a cryptographic cipher and back again.      
  859.                      
  860.                                                              
  861.           AUTHOR:   Not Specified                             
  862.                                                              
  863.           TITLE:  DES Modes of Operation                      
  864.                                                              
  865.           ORGANIZATION:  Institute for Computer Sciences      
  866.                         and Technology                       
  867.           PUBLISHER/ORIGINATOR: National Institute of         
  868.                                Standards and Technology      
  869.           REPORT NO:  FIPS PUB 81                             
  870.           PUBLICATION DATE:  December 1980                    
  871.           CATEGORY:  Access Control                           
  872.          COST: $8.50                                         
  873.          DESCRIPTION: This publication discusses the four    
  874.          modes of operation used by the Data Encryption      
  875.          Standard.                                           
  876.                     
  877.  
  878.                                                              
  879.           AUTHOR:   N/A                                       
  880.                                                              
  881.           TITLE:  Electronic Communications Privacy Act of    
  882.                  1986                                        
  883.                                                              
  884.           ORGANIZATION:                                       
  885.                                                              
  886.           PUBLISHER/ORIGINATOR:                               
  887.                                                              
  888.           REPORT NO:  Public Law 99-508                       
  889.           PUBLICATION DATE:   October 21, 1986                
  890.           CATEGORY:   Access Control                          
  891.          COST: Free                                          
  892.          DESCRIPTION:  Amends title 18, United States Code,  
  893.          with respect to the interception of certain         
  894.          communications, and other forms of surveillance, and
  895.          for other purposes.                                 
  896.  
  897.                                                          
  898.           AUTHOR:  Not Specified                              
  899.                                                              
  900.           TITLE:  Guidelines on Evaluation of Techniques for  
  901.                  Automated Personnel Identification          
  902.                                                              
  903.           ORGANIZATION:  Institute for Computer Sciences      
  904.                         and Technology                       
  905.           PUBLISHER/ORIGINATOR: National Institute of         
  906.                                Standards and Technology      
  907.           REPORT NO: FIPS PUB 48                              
  908.           PUBLICATION DATE:  April 1977                       
  909.           CATEGORY:  Access Control                           
  910.          COST: $7.00                                         
  911.          DESCRIPTION:  The performance and evaluation of     
  912.          personal identification devices is explained.       
  913.          Considerations for their use in a computer system   
  914.          is given.                                           
  915.                    
  916.  
  917.                                                              
  918.           AUTHOR:   Not Specified                             
  919.                                                              
  920.           TITLE:  Guidelines for Implementing and Using the   
  921.                  NBS Data Encryption Standard                
  922.                                                              
  923.           ORGANIZATION: Institute for Computer Sciences       
  924.                        and Technology                        
  925.           PUBLISHER/ORIGINATOR: National Institute of         
  926.                                Standards and Technology      
  927.           REPORT NO:  FIPS PUB 74                             
  928.           PUBLICATION DATE:  April 1981                       
  929.           CATEGORY:  Access Control                           
  930.          COST: $8.50                                         
  931.          DESCRIPTION:  Discusses the guidelines that federal 
  932.          organizations should use when cryptographic         
  933.          protection is required for sensitive or valuable    
  934.          computer data.                                      
  935.           
  936.                                                              
  937.           AUTHOR:    Not Specified                            
  938.                                                              
  939.           TITLE:  Guideline on User Authentication Techniques 
  940.                  for Computer Network Access Control         
  941.                                                              
  942.           ORGANIZATION:  Institute for Computer Sciences      
  943.                         and Technology                       
  944.           PUBLISHER/ORIGINATOR: National Institute of         
  945.                                Standards and Technology      
  946.           REPORT NO:  FIPS PUB 83                             
  947.           PUBLICATION DATE:  September 1980                   
  948.           CATEGORY:  Access Control                           
  949.          COST: $8.50                                         
  950.          DESCRIPTION: Details the use of passwords,          
  951.          identification tokens, and other means to protect   
  952.          against unauthorized access to computers and        
  953.          computer networks.                                  
  954.                   
  955.                                                        
  956.           AUTHOR:   Not Specified                             
  957.                                                              
  958.           TITLE:  Information Security: Products and Services 
  959.                  Catalogue                                   
  960.                                                              
  961.           ORGANIZATION:   National Computer Security Center   
  962.                                                              
  963.           PUBLISHER/ORIGINATOR:   National Computer Security  
  964.                                  Center                      
  965.           REPORT NO:  None Specified                          
  966.           PUBLICATION DATE:   Published Quarterly             
  967.           CATEGORY:   Access Control                          
  968.          COST:  Free                                         
  969.          DESCRIPTION: This catalogue contains the endorsed   
  970.          cryptographic products list, NSA endorsed data      
  971.          encryption standard products list, protected        
  972.          services list, evaluated products list, and         
  973.          preferred products list.                            
  974.  
  975.                                                        
  976.           AUTHOR:   Not Specified                             
  977.                                                              
  978.           TITLE: National Policy on Controlled Access         
  979.                 Protection                                   
  980.                                                              
  981.           ORGANIZATION:  National Telecommunications and      
  982.                         Information Systems Security         
  983.           PUBLISHER/ORIGINATOR:  NTISSC                       
  984.                                 Ft. George G. Meade, MD      
  985.           REPORT NO:  NTISSP No. 200                          
  986.           PUBLICATION DATE:  July 15, 1987                    
  987.           CATEGORY:   Access Control                          
  988.          COST: Free                                          
  989.          DESCRIPTION:  Defines a minimum level of protection 
  990.          for automated information systems operated by       
  991.          executive branch agencies and departments of the    
  992.          federal government and their contractors.           
  993.  
  994.  
  995.                                                          
  996.           AUTHOR:   Not Specified                             
  997.                                                              
  998.           TITLE:  Standard on Computer Data Authentication    
  999.                                                              
  1000.           ORGANIZATION:  Institute for Computer Sciences      
  1001.                         and Technology                       
  1002.           PUBLISHER/ORIGINATOR: National Institute of         
  1003.                                Standards and Technology      
  1004.           REPORT NO:  FIPS PUB 113                            
  1005.           PUBLICATION DATE:  May 1985                         
  1006.           CATEGORY:  Access Control                           
  1007.          COST: $9.95                                         
  1008.          DESCRIPTION:  Specifies a data authentication       
  1009.          algorithm which, when applied to computer data,     
  1010.          automatically and accurately detects unauthorized   
  1011.          modifications, both intentional and accidental.     
  1012.  
  1013.                                                           
  1014.           AUTHOR:   Not Specified                             
  1015.                                                              
  1016.           TITLE:  Standard on Password Usage                  
  1017.                                                              
  1018.           ORGANIZATION:  Institute for Computer Sciences      
  1019.                         and Technology                       
  1020.           PUBLISHER/ORIGINATOR: National Institute of         
  1021.                                Standards and Technology      
  1022.           REPORT NO:  FIPS PUB 112                            
  1023.           PUBLICATION DATE:  May 1985                         
  1024.           CATEGORY:  Access Control                           
  1025.          COST:  $13.95                                       
  1026.          DESCRIPTION:  Discusses ten minimum security        
  1027.          criteria to consider when designing a password-based
  1028.          access control system for a computer.               
  1029.                   
  1030.                                                              
  1031.           AUTHOR:   Not Specified                             
  1032.                                                              
  1033.           TITLE:    Trusted Network Interpretation of the     
  1034.                    Trusted Computer System Evaluation        
  1035.                    Criteria                                  
  1036.           ORGANIZATION:  National Computer Security Center    
  1037.                                                              
  1038.           PUBLISHER/ORIGINATOR:  National Computer Security   
  1039.                                 Center                       
  1040.           REPORT NO:  NCSC-TG-005                             
  1041.           PUBLICATION DATE:  July 31, 1987                    
  1042.           CATEGORY:   Access Control                          
  1043.          COST:                                               
  1044.          DESCRIPTION:  This is also known as the Red Book.   
  1045.          This guidelines examines interpretations to extend  
  1046.          the evaluation classes of the Trusted Systems       
  1047.          Evaluation Criteria to trusted network systems and  
  1048.          components.                                         
  1049.  
  1050.                       AUDIT AND EVALUATION
  1051.  
  1052.                                                             
  1053.           AUTHOR:  Not Specified                              
  1054.                                                              
  1055.           TITLE:  Assessing Reliability of Computer Output -  
  1056.                  Audit Guide                                 
  1057.                                                              
  1058.           ORGANIZATION:  U.S. General Accounting Office       
  1059.                                                              
  1060.           PUBLISHER/ORIGINATOR: U.S. General Accounting Office
  1061.                                                              
  1062.           REPORT NO:  AFMD-81-91                              
  1063.           PUBLICATION DATE:  June 1981                        
  1064.           CATEGORY:  Audit and Evaluation                     
  1065.          COST:  Free (if less than 5 ordered)                
  1066.          DESCRIPTION:  This audit guide shows how to comply  
  1067.          with GAO policy requirements by giving detailed     
  1068.          procedures to help determine the degree of risk     
  1069.          using information that could be incorrect.          
  1070.      
  1071.                                                              
  1072.           AUTHOR:  Not Specified                              
  1073.                                                              
  1074.           TITLE:  Computer Security Requirements: Guidance for
  1075.                  Applying the Dod Trusted Computer System    
  1076.                  Evaluation Criteria in Specific Environments
  1077.           ORGANIZATION:  Department of Defense Computer       
  1078.                         Security Center                      
  1079.           PUBLISHER/ORIGINATOR:  Department of Defense        
  1080.                                 Computer Security Center     
  1081.           REPORT NO:  CSC-STD-003-85                          
  1082.           PUBLICATION DATE:  June 25, 1985                    
  1083.           CATEGORY:  Audit and Evaluation                     
  1084.          COST:  $1.00                                        
  1085.          DESCRIPTION: These reports show how to use DOD      
  1086.          5200.28-STD in specific environments.               
  1087.                      
  1088.                                                           
  1089.           AUTHOR:   Not Specified                             
  1090.                                                              
  1091.           TITLE:   Evaluating Internal Controls in Computer-  
  1092.                   Based Systems - Audit Guide                
  1093.                                                              
  1094.           ORGANIZATION:  U.S. General Accounting Office       
  1095.                                                              
  1096.           PUBLISHER/ORIGINATOR: U.S. General Accounting Office
  1097.                                                              
  1098.           REPORT NO:  AFMD-81-76                              
  1099.           PUBLICATION DATE: June 1981                         
  1100.           CATEGORY:  Audit and Evaluation                     
  1101.          COST: Free (if less than 5 are ordered).            
  1102.          DESCRIPTION: Describes an approach for evaluating a 
  1103.          computer-based system that will enable an auditor to
  1104.          evaluate the entire system from original to output. 
  1105.                    
  1106.                                                            
  1107.           AUTHOR:   Not Specified                             
  1108.                                                              
  1109.           TITLE:  Technical Rationale Behind CSC-STD-003-85   
  1110.          Computer Security Requirements: Guidance for        
  1111.          Applying the DoD Trusted Computer System Evaluation 
  1112.          Criteria in Specific Environments                   
  1113.           ORGANIZATION:  Department of Defense Computer       
  1114.                         Security Center                      
  1115.           PUBLISHER/ORIGINATOR:  Department of Defense        
  1116.                                 Computer Security Center     
  1117.           REPORT NO:  CSC-STD-004-85                          
  1118.           PUBLICATION DATE:   June 25, 1985                   
  1119.           CATEGORY:   Audit and Evaluation                    
  1120.          COST: $2.00                                         
  1121.          DESCRIPTION: Give guidance to applying the DOD      
  1122.          CSC-STD-003-85.                                     
  1123.  
  1124.  
  1125.  
  1126.                          CERTIFICATION
  1127.  
  1128.                                                             
  1129.           AUTHOR:  Not Specified                              
  1130.                                                              
  1131.           TITLE:  Guideline for Computer Security             
  1132.                  Certification and Accreditation             
  1133.                                                              
  1134.           ORGANIZATION:  Institute for Computer Sciences      
  1135.                         and Technology                       
  1136.           PUBLISHER/ORIGINATOR: National Institute of         
  1137.                                Standards and Technology      
  1138.           REPORT NO:  FIPS PUB 102                            
  1139.           PUBLICATION DATE:  September 1983                   
  1140.           CATEGORY:  Certification                            
  1141.          COST:  $11.50                                       
  1142.          DESCRIPTION:  Describes ways of establishing and    
  1143.          carrying out a computer security certification and  
  1144.          accreditation program.                              
  1145.                    
  1146.  
  1147.                       CONTINGENCY PLANNING
  1148.  
  1149.  
  1150.                                                              
  1151.           AUTHOR:    Not Specified                            
  1152.                                                              
  1153.           TITLE:  Guidelines for ADP Contingency Planning     
  1154.                                                              
  1155.                                                              
  1156.           ORGANIZATION:  Institute for Computer Sciences      
  1157.                         and Technology                       
  1158.           PUBLISHER/ORIGINATOR: National Institute of         
  1159.                                Standards and Technology      
  1160.           REPORT NO:  FIPS PUB 87                             
  1161.           PUBLICATION DATE:  March 1981                       
  1162.           CATEGORY:  Contingency Planning                     
  1163.          COST: $8.50                                         
  1164.          DESCRIPTION:  Describes data processing             
  1165.          management considerations for developing a          
  1166.          contingency plan for an ADP facility.               
  1167.                 
  1168.  
  1169.                        DATA BASE SECURITY
  1170.                                                              
  1171.           AUTHOR:   Not Specified                             
  1172.                                                              
  1173.           TITLE:  Guideline on Integrity Assurance and        
  1174.                  and Control in Database Applications        
  1175.                                                              
  1176.           ORGANIZATION:  Institute for Computer Sciences      
  1177.                         and Technology                       
  1178.           PUBLISHER/ORIGINATOR: National Institute of         
  1179.                                Standards and Technology      
  1180.           REPORT NO:  FIPS PUB 88                             
  1181.           PUBLICATION DATE:  August 1981                      
  1182.           CATEGORY:  Data Base Security                       
  1183.          COST:  $11.50                                       
  1184.          DESCRIPTION: Gives detailed advice on how to achieve
  1185.          data base integrity and security control. A step-by-
  1186.          step procedure for examining and verifying the      
  1187.          the accuracy and completeness of a data base is     
  1188.          included.                                           
  1189.                  
  1190.  
  1191.                       ENVIRONMENTAL SECURITY
  1192.  
  1193.                                                             
  1194.           AUTHOR:   Not Specified                             
  1195.                                                              
  1196.           TITLE:  Guideline on Electrical Power for ADP       
  1197.                  Installations                               
  1198.                                                              
  1199.           ORGANIZATION: Institute for Computer Sciences       
  1200.                        and Technology                        
  1201.           PUBLISHER/ORIGINATOR: National Institute of         
  1202.                                Standards and Technology      
  1203.           REPORT NO:  FIPS PUB 94                             
  1204.           PUBLICATION DATE:  September 1982                   
  1205.           CATEGORY:  Environmental Security                   
  1206.          COST:  $13.00                                       
  1207.          DESCRIPTION:  This publication discusses electrical 
  1208.          power factors that can affect the operation of an   
  1209.          ADP system.                                         
  1210.  
  1211.  
  1212.  
  1213.                         GENERAL SECURITY
  1214.  
  1215.                                                             
  1216.           AUTHOR:   N/A                                       
  1217.                                                              
  1218.           TITLE:   Computer Security Act of 1987              
  1219.                                                              
  1220.                                                              
  1221.           ORGANIZATION:                                       
  1222.                                                              
  1223.           PUBLISHER/ORIGINATOR:                               
  1224.                                                              
  1225.           REPORT NO:  Public Law 100-235                      
  1226.           PUBLICATION DATE:  January 8, 1988                  
  1227.           CATEGORY:  General Security                         
  1228.          COST: Free                                          
  1229.          DESCRIPTION: To provide for a computer standards    
  1230.          program within the National Institute of Standards  
  1231.          and Technology, to provide Government-wide computer 
  1232.          security, and to provide for the training in secur- 
  1233.          ity matters of persons who are involved in the      
  1234.          management, operation, and use of Federal computer  
  1235.          systems.                                            
  1236.  
  1237.                                                              
  1238.           AUTHOR:   Not Specified                             
  1239.                                                              
  1240.           TITLE:  Glossary for Computer Systems Security      
  1241.                                                              
  1242.                                                              
  1243.           ORGANIZATION:  Institute for Computer Sciences      
  1244.                         and Technology                       
  1245.           PUBLISHER/ORIGINATOR: National Institute of         
  1246.                                Standards and Technology      
  1247.           REPORT NO:  FIPS PUB 39                             
  1248.           PUBLICATION DATE:  February 1974                    
  1249.           CATEGORY:  General Security                         
  1250.          COST: $9.95                                         
  1251.          DESCRIPTION: A reference document containing        
  1252.          approximately 170 terms and definitions pertaining  
  1253.          to privacy and computer security.                   
  1254.  
  1255.                                                             
  1256.           AUTHOR:  Not Specified                              
  1257.                                                              
  1258.           TITLE:  Guidelines for Security of Computer         
  1259.                  Applications                                
  1260.                                                              
  1261.           ORGANIZATION:  Institute for Computer Sciences      
  1262.                         and Technology                       
  1263.           PUBLISHER/ORIGINATOR: National Institute of         
  1264.                                Standards and Technology      
  1265.           REPORT NO:  FIPS PUB 73                             
  1266.           PUBLICATION DATE:  June 1980                        
  1267.           CATEGORY:  General Security                         
  1268.          COST:  $10.00                                       
  1269.          DESCRIPTION:  These guidelines are to be used in the
  1270.          development and operation of computer systems that  
  1271.          require protection. Data validation, user           
  1272.          authentication, and encryption are discussed.       
  1273.                  
  1274.  
  1275.                                                             
  1276.           AUTHOR:   Not Specified                             
  1277.                                                              
  1278.           TITLE:  NBS Publication List 91:  Computer Security 
  1279.                  Publications                                
  1280.                                                              
  1281.           ORGANIZATION:  Institute for Computer Sciences and  
  1282.                         Technology                           
  1283.           PUBLISHER/ORIGINATOR: National Institute of         
  1284.                                Standards and Technology      
  1285.           REPORT NO:  003-003-00135-0                         
  1286.           PUBLICATION DATE: August 1984                       
  1287.           CATEGORY:  General Security                         
  1288.          COST:  $18.00                                       
  1289.          DESCRIPTION:  Provides information on computer      
  1290.          security publications that are available.           
  1291.         
  1292.                                                          
  1293.           AUTHOR:  Not Specified                              
  1294.                                                              
  1295.           TITLE:  Sensitive Unclassified Computer Security    
  1296.                  Program Compliance Review Guidelines        
  1297.                                                              
  1298.           ORGANIZATION:  U.S. Department of Energy            
  1299.                                                              
  1300.           PUBLISHER/ORIGINATOR: U.S. Department of Energy     
  1301.                                                              
  1302.           REPORT NO:  DOE/MA-0188/1                           
  1303.           PUBLICATION DATE: September 1985                    
  1304.           CATEGORY:  General Security                         
  1305.          COST:                                               
  1306.          DESCRIPTION:  This guideline contains questionaires 
  1307.          for determining the level of security needed at a   
  1308.          computer installation. Techniques for obtaining the 
  1309.          required level of security are discussed.           
  1310.                       
  1311.  
  1312.  
  1313.                      MICROCOMPUTER SECURITY
  1314.  
  1315.                                                             
  1316.           AUTHOR:  Not Specified                              
  1317.                                                              
  1318.           TITLE:  Computer Security- User Handbook for        
  1319.                  Microcomputers and Word Processors          
  1320.                                                              
  1321.           ORGANIZATION: U.S. Department of Energy             
  1322.                                                              
  1323.           PUBLISHER/ORIGINATOR: U.S. Department of Energy     
  1324.                                                              
  1325.           REPORT NO:  None Specified                          
  1326.           PUBLICATION DATE:  September 1986                   
  1327.           CATEGORY:  Microcomputer Security                   
  1328.          COST:                                               
  1329.          DESCRIPTION:  This guideline gives a synopsis on    
  1330.          computer security requirements for users of         
  1331.          microcomputers and/or word processors.              
  1332.               
  1333.                                                              
  1334.           AUTHOR:   Not Specified                             
  1335.                                                              
  1336.           TITLE:   Personal Computer Security Considerations  
  1337.                                                              
  1338.                                                              
  1339.           ORGANIZATION:  National Computer Security Center    
  1340.                                                              
  1341.           PUBLISHER/ORIGINATOR: National Computer Security    
  1342.                                Center                        
  1343.           REPORT NO:  NCSC-WA-002-85                          
  1344.           PUBLICATION DATE:   December 1985                   
  1345.           CATEGORY:  Microcomputer Security                   
  1346.          COST: Free                                          
  1347.          DESCRIPTION: This publication provides a general    
  1348.          discussion of a number of issues that are pertinent 
  1349.          to microcomputer security in the home and business  
  1350.          environment.                                        
  1351.  
  1352.                                                          
  1353.           AUTHOR:   Not Specified                             
  1354.                                                              
  1355.           TITLE:   Security Guide for Users of Personal       
  1356.                   Computers and Word Processors              
  1357.                                                              
  1358.           ORGANIZATION:  Pacific Northwest Laboratory         
  1359.                                                              
  1360.           PUBLISHER/ORIGINATOR: Pacific Northwest Laboratory  
  1361.                                                              
  1362.           REPORT NO: None Specified                           
  1363.           PUBLICATION DATE:  June 1986                        
  1364.           CATEGORY:   Microcomputer Security                  
  1365.          COST:  Free (for single copies).                    
  1366.          DESCRIPTION: Contains instructions on a variety of  
  1367.          computer security techniques including protective   
  1368.          storage and handling, passwords, emergency          
  1369.          procedures, and other related security subjects.    
  1370.                 
  1371.                                                              
  1372.           AUTHOR:  Not Specified                              
  1373.                                                              
  1374.           TITLE:  Security Guidelines for Microcomputers      
  1375.                  and Word Processors                         
  1376.                                                              
  1377.           ORGANIZATION:   U.S. Department of Energy           
  1378.                                                              
  1379.           PUBLISHER/ORIGINATOR: U.S. Department of Energy     
  1380.                                ATTN: Information Services    
  1381.                                P.O. Box 62                   
  1382.                                Oakridge, TN 37831            
  1383.           REPORT NO:  DOE/MA-0181                             
  1384.           PUBLICATION DATE:  March 1985                       
  1385.           CATEGORY:  Microcomputer Security                   
  1386.          COST: $9.45                                         
  1387.          DESCRIPTION: These guidelines are concerned with the
  1388.          training of in the protection of computers          
  1389.          (hardcopy, storage media, etc.). Communications     
  1390.          security, emergency procedures, and the prevention  
  1391.          of system misuse are also discussed.                
  1392.                      
  1393.  
  1394.  
  1395.                              PRIVACY
  1396.  
  1397.                                                              
  1398.           AUTHOR:   Not Specified                             
  1399.                                                              
  1400.           TITLE:  Computer Security Guidelines for            
  1401.                  implementing the Privacy Act of 1974        
  1402.                                                              
  1403.           ORGANIZATION:  Institute for Computer Sciences      
  1404.                         and Technology                       
  1405.           PUBLISHER/ORIGINATOR: National Institute of         
  1406.                                Standards and Technology      
  1407.           REPORT NO:  FIPS PUB 41                             
  1408.           PUBLICATION DATE:  May 1975                         
  1409.           CATEGORY: Privacy                                   
  1410.          COST:  $7.00                                        
  1411.          DESCRIPTION: This document shows how to protect     
  1412.          personal data in automated information systems.     
  1413.          Discusses how to improve system security using      
  1414.          safeguards and controls.                            
  1415.                      
  1416.  
  1417.                          RISK MANAGEMENT
  1418.  
  1419.                                                              
  1420.           AUTHOR:   N/A                                       
  1421.                                                              
  1422.           TITLE:  Internal Control Systems                    
  1423.                                                              
  1424.                                                              
  1425.           ORGANIZATION:  Office Of Management and Budget      
  1426.                                                              
  1427.           PUBLISHER/ORIGINATOR: Office of Management & Budget 
  1428.                                                              
  1429.           REPORT NO:  OMB Circular A-123                      
  1430.           PUBLICATION DATE:  August 4, 1986                   
  1431.           CATEGORY:  Risk Management                          
  1432.          COST:  Free                                         
  1433.          DESCRIPTION: This circular prescribes policies and  
  1434.          procedures to be followed by executive departments  
  1435.          and agencies in establishing, maintaining,          
  1436.          evaluating, improving, and reporting on internal    
  1437.          controls in their program and administrative        
  1438.          activitiies.                                        
  1439.  
  1440.                                                              
  1441.           AUTHOR:   Not Specified                             
  1442.                                                              
  1443.           TITLE:   NASA ADP Risk Analysis Guideline           
  1444.                                                              
  1445.           ORGANIZATION:  National Aeronautics and Space       
  1446.                         Administration                       
  1447.           PUBLISHER/ORIGINATOR:  National Aeronautics and     
  1448.                                 Space Administration         
  1449.           REPORT NO: None Specified                           
  1450.           PUBLICATION DATE:  July 1984                        
  1451.           CATEGORY:   Risk Management                         
  1452.          COST: Free                                          
  1453.          DESCRIPTION: This document describes guidelines for 
  1454.          the ADP risk analysis methodology to be used at     
  1455.          NASA ADP facilities and provides guidance for       
  1456.          performing an ADP risk analysis without specialized 
  1457.          contractor assistance.                              
  1458.  
  1459.  
  1460.  
  1461.                        SECURITY MANAGEMENT
  1462.                                                              
  1463.           AUTHOR:   Not Specified                             
  1464.                                                              
  1465.           TITLE:  Computers:  Crimes, Clues, and Controls.  A 
  1466.                  Management Guide                            
  1467.                                                              
  1468.           ORGANIZATION:  President's Council on Integrity and 
  1469.                         Efficiency                           
  1470.           PUBLISHER/ORIGINATOR:  National Technical           
  1471.                                 Information Service          
  1472.           REPORT NO: PB86-221850/XAB                          
  1473.           PUBLICATION DATE:  March 1986                       
  1474.           CATEGORY:  Security Management                      
  1475.          COST: $13.95                                        
  1476.          DESCRIPTION: This publication, which is meant for   
  1477.          managers, deals with information security, physical 
  1478.          security, personnel security, and a plan of action. 
  1479.          Listed are ways to detect and prevent abuse of      
  1480.          computers.                                          
  1481.                  
  1482.                                                    
  1483.           AUTHOR:   N/A                                       
  1484.                                                              
  1485.           TITLE:  Guidance for Preparation and Submission of  
  1486.                  Security Plans for Federal Computer Systems 
  1487.                  Containing Sensitive Information            
  1488.           ORGANIZATION:  Office of Management & Budget        
  1489.                                                              
  1490.           PUBLISHER/ORIGINATOR: Office of Management & Budget 
  1491.                                                              
  1492.           REPORT NO: OMB Bulletin 88-16                       
  1493.           PUBLICATION DATE:  July 6, 1988                     
  1494.           CATEGORY:   Security Management                     
  1495.          COST:  Free                                         
  1496.          DESCRIPTION: Guidance for preparation and submission
  1497.          of security plans for federal computer systems      
  1498.          containing sensitive information.                   
  1499.  
  1500.  
  1501.                                                              
  1502.           AUTHOR:  N/A                                        
  1503.                                                              
  1504.           TITLE:  Management of Federal Information Resources 
  1505.                                                              
  1506.                                                              
  1507.           ORGANIZATION:  Office of Management and Budget      
  1508.                                                              
  1509.           PUBLISHER/ORIGINATOR: Office of Management and      
  1510.                                Budget                        
  1511.           REPORT NO:  OMB Circular No. A-130                  
  1512.           PUBLICATION DATE:  December 12, 1985                
  1513.           CATEGORY:  Security Management                      
  1514.          COST: Free                                          
  1515.          DESCRIPTION: A general policy framework for the     
  1516.          management of federal information resources is given
  1517.          in this circular.                                   
  1518.  
  1519.                                                       
  1520.           AUTHOR:  N/A                                        
  1521.                                                              
  1522.           TITLE:  National Policy on Telecommunications and   
  1523.                  Automated Information Systems Security      
  1524.                                                              
  1525.           ORGANIZATION:  National Security Council            
  1526.                                                              
  1527.           PUBLISHER/ORIGINATOR:                               
  1528.                                                              
  1529.           REPORT NO: National Security Decision Directive 145 
  1530.           PUBLICATION DATE:  September 17, 1984               
  1531.           CATEGORY:  Security Management                      
  1532.          COST: Free                                          
  1533.          DESCRIPTION: This directive establishes a senior    
  1534.          steering group, an interagency group at the         
  1535.          operating level, an executive agent and a national  
  1536.          manager to implement national policy on             
  1537.          telecommunications and automated information systems
  1538.          security.                                           
  1539.  
  1540.  
  1541.                       TRAINING & AWARENESS
  1542.                                                              
  1543.           AUTHOR:  Not Specified                              
  1544.                                                              
  1545.           TITLE:  Computer Security Awareness and Training    
  1546.                  (Bibliography)                              
  1547.                                                              
  1548.           ORGANIZATION:  Martin Marietta Energy Systems, Inc. 
  1549.                                                              
  1550.           PUBLISHER/ORIGINATOR: U.S. Department of Energy     
  1551.                                                              
  1552.           REPORT NO: DOE/MA-320 Volume 1                      
  1553.           PUBLICATION DATE:  February 1988                    
  1554.           CATEGORY:  Training and Awareness                   
  1555.          COST: $11.65                                        
  1556.          DESCRIPTION: This bibliography contains materials   
  1557.          and information that are available concerning       
  1558.          unclassified computer security.                     
  1559.  
  1560.                                                      
  1561.           AUTHOR:   N/A                                       
  1562.                                                              
  1563.           TITLE:  Computer Security Training Guidelines       
  1564.                  (Draft)                                     
  1565.                                                              
  1566.           ORGANIZATION:  National Institute of                
  1567.                         Standards and Technology             
  1568.           PUBLISHER/ORIGINATOR:  National Institute of        
  1569.                                 Standards and Technology     
  1570.           REPORT NO:                                          
  1571.           PUBLICATION DATE:  July 8, 1988                     
  1572.           CATEGORY:  Training & Awareness                     
  1573.          COST:                                               
  1574.          DESCRIPTION:  These guidelines are intended to      
  1575.          assist agencies to meet the training requirements   
  1576.          of the computer security act of 1987.               
  1577.  
  1578.                                                      
  1579.           AUTHOR:   Not Specified                             
  1580.                                                              
  1581.           TITLE:   Computer Security Awareness and Training   
  1582.                   (Guideline)                                
  1583.                                                              
  1584.           ORGANIZATION:  Martin Marietta Energy Systems, Inc. 
  1585.                                                              
  1586.           PUBLISHER/ORIGINATOR: U.S. Department of Energy     
  1587.                                                              
  1588.           REPORT NO:  DOE/MA-0320 Volume 2                    
  1589.           PUBLICATION DATE: February 1988                     
  1590.           CATEGORY:  Training & Awareness                     
  1591.          COST: $11.00                                        
  1592.          DESCRIPTION:  This guide presents fundamental       
  1593.          concepts, topics, and materials on many aspects of  
  1594.          unclassified computer security that should be       
  1595.          included in site level unclassified computer        
  1596.          security awareness and training programs within DOE.
  1597.  
  1598.                                                           
  1599.           AUTHOR:  Not Specified                              
  1600.                                                              
  1601.           TITLE:  Safeguards and Security Manual. Section 12: 
  1602.                  Computer and Technical Security             
  1603.                                                              
  1604.           ORGANIZATION:  EG&G Idaho, Inc.                     
  1605.                                                              
  1606.           PUBLISHER/ORIGINATOR: None Specified                
  1607.                                                              
  1608.           REPORT NO:  None Specified                          
  1609.           PUBLICATION DATE:  April 8, 1987                    
  1610.           CATEGORY:  Training & Awareness                     
  1611.          COST: Free                                          
  1612.          DESCRIPTION: This section of the safeguards and     
  1613.          security manual describes various computer security 
  1614.          procedures for users and security managers. Includes
  1615.          security awareness training, computer protection    
  1616.          plan, audit, risk analysis, and related topics.     
  1617.          
  1618.  
  1619.                                                              
  1620.           AUTHOR:   N/A                                       
  1621.                                                              
  1622.           TITLE:  Small Business Computer Security and        
  1623.                  Education Act of 1984                       
  1624.                                                              
  1625.           ORGANIZATION:                                       
  1626.                                                              
  1627.           PUBLISHER/ORIGINATOR:                               
  1628.                                                              
  1629.           REPORT NO:  Public Law 98-362                       
  1630.           PUBLICATION DATE:  July 16, 1984                    
  1631.           CATEGORY:  Training & Awareness                     
  1632.          COST: Free                                          
  1633.          DESCRIPTION:  Amended the Small Business Act to     
  1634.          establish a small business computer security and    
  1635.          education program.                                  
  1636.  
  1637.  
  1638.                                                             
  1639.           AUTHOR:   N/A                                       
  1640.                                                              
  1641.           TITLE:   Training Requirement for the Computer      
  1642.                   Security Act                               
  1643.                                                              
  1644.           ORGANIZATION:  Office Personnel Management          
  1645.                                                              
  1646.           PUBLISHER/ORIGINATOR: Office of Personnel Management
  1647.          Federal Register  Part II                           
  1648.           REPORT NO:  Interim Regulation 5 CFR Part 930       
  1649.           PUBLICATION DATE:  July 13, 1988                    
  1650.           CATEGORY:   Training & Awareness                    
  1651.          COST:  Free                                         
  1652.          DESCRIPTION: This regulation implements P.L. 100-   
  1653.          235, the Computer Security Act of 1987.             
  1654.  
  1655.