Security protection based on mission criticality

Developments connected with security protection based on mission criticality at the US Department of Defense (DoD) are discussed. It is shown that assurance of service can be achieved as part of the design, thereby making availability in the presence of malicious threat an integrity problem. There are two approaches to simultaneously deal with both sensitivity and criticality policies: a restrictive combined data flow policy or a strategy that uses isolation techniques (e.g., encryption). Criticality attacks almost always allow a detection and recovery strategy, which can utilize encoding and is less expensive than a resistance strategy (like sensitivity protection). It is suggested that a DoD security objective and accompanying policy should be based on assuring accomplishment of nationally critical missions dealing with loss of integrity and denial of service threats.<
>