A security methodology for computer networks

The world's businesses, industries, and governments are beginning to rely on computer networks for timely transmission of sensitive data between geographically distributed sites. To ensure the security integrity of the entire complex, the networks that bind these distributed facilities must be integral to all security considerations. The methodology described here provides a framework for developing the planning documentation and procedures for network security. It also bounds five security documentation and analysis problems that were previously unbounded. This methodology separates a computer network's “security life” into two phases. The first phase — design, review, and accreditation — deals with system-security planning, implementation, certification, and accreditation for operation. The second — or operational — phase involves processing unusual events that may be of security interest during the operation of a computer network. The various elements, relationships, and decisions for each phase are examined.