SANS InfoSec Reading Room - Standards

Most of the computer security white papers in the Reading Room have been written by students seeking GIAC certification to fulfill part of their certification requirements and are provided by SANS as a resource to benefit the security community at large. SANS attempts to ensure the accuracy of information, but papers are published "as is". Errors or inconsistencies may exist or may be introduced over time as material becomes dated. If you suspect a serious error, please contact webmaster@sans.org.

Featuring 19 papers as of May 25, 2013

Systems Engineering: Required for Cost-Effective Development of Secure Products

By: Dan Lyon (posted on October 8, 2012)

Security of data and systems is critical to consider during development of a complex system, and by taking a systems approach, secure design can be achieved in a cost effective manner.

Security for Critical Infrastructure SCADA Systems

By: Andrew Hildick-Smith (posted on August 24, 2005)

Supervisory Control and Data Acquisition (SCADA) systems and other similar control systems are widely used by utilities and industries that are considered critical to the functioning of countries around the world.

Information Security Gets a Seat at the Table

By: Kent Nabors (posted on April 8, 2004)

A company is a statement of faith between suppliers, employees, investors and customers. If any one or more of those groups decides they don't want to play any more, then the game is over. If a bank loses critical customer information because of a security failure, a financial risk arbitrage maneuver won't help.

An Introduction to Certification and Accreditation

By: Joseph Zadjura (posted on November 19, 2003)

This paper examines the C&A process, offers guidance to helps define the Security Requirements, identify responsible parties and their roles, providing a basic understanding of C&A.

Organizational Information Security from Scratch - A Guarantee for Doing It Right

By: Patrick Jones (posted on October 31, 2003)

The purpose of this document is to provide an overview of an information security infrastructure and a strategy for implementing it.

HIPAA Security Standards v1.2d

By: Daniel Fagin (posted on October 31, 2003)

The focus of this paper is the creation of certain baseline information security standards to protect electronic medical records.

The OSI Model: An Overview

By: Rachelle L. Miller (posted on October 31, 2003)

This paper provides an overview of the Open Systems Interconnection (OSI) reference model which defines a hierarchical architecture that logically partitions the functions required to support system-to-system communication.

The NSA: A Brief Examination of the "No Such Agency"

By: Steven H. Bennett (posted on October 31, 2003)

This paper introduces the National Security Agency (NSA) to the reader and discusses some of the key technologies, methods, and issues that relate to its mission.

The Common Criteria ISO/IEC 15408 - The Insight, Some Thoughts, Questions and Issues

By: Ariffuddin Aizuddin (posted on October 31, 2003)

This paper provides an overview of an international effort called Common Criteria (CC), an IT Security evaluation methodology, developed to define and facilitate consistent evaluations of security products and systems, fostering international recognition and trust in the quality of security products and systems throughout the global economy.

Multilevel Security Networks: An Explanation of the Problem

By: LTGary McKerrow (posted on October 31, 2003)

This paper addresses the current efforts within the Department of Defense (DoD) to develop a Multi-Level Security (MLS) system, although, the same methodology and practice can be applied to other networks with similar requirements.

Collaborative Security Strategies in an Outsourced, Cross-Agency Web System

By: Roopangi Kadakia (posted on October 31, 2003)

This analysis will look at the Certification and Accreditation models, Risk assessment frameworks, and risk management strategies, which can be used in combating new challenges in existing processes and standards.

Internal SLA (Service Level Agreements) for Information Security

By: Eric Hansen (posted on October 31, 2003)

The purpose of this paper is to advocate for the establishment of internal SLAs between the Information Technology team and the Information Security team.

Securing Sensitive Data: Understanding Federal Information Processing Standards (FIPS)

By: Thomas E. Kenworthy (posted on October 31, 2003)

This paper will define FIPS (Federal Information Processing Standards), identify FIPS approved encryption algorithms, and examine some different vendor solutions and their use of these approved algorithms.

A Survey Of Trusted Computing Specifications And Related Technologies

By: Ricard Kelly (posted on October 31, 2003)

This paper seeks to survey the key points of these technologies and provide a framework for suggesting whether a TCPA/TCG or NGSCB architecture will improve security in an environment and where it may reduce security.

TEACH, the DMCA and Distance Education

By: Katie E. Flowers (posted on October 31, 2003)

By reviewing the technological requirements of TEACH, the titles of the DMCA and the history of both acts this paper will show that while TEACH, to date, has not been publicly recognized as an amendment to the DMCA it can truly be viewed as such in the United States with regards to the issue of distance education.

Common Criteria and Protection Profiles: How to Evaluate Information

By: Kathryn Wallace (posted on October 31, 2003)

The purpose of this paper is to discuss the standards of Common Criteria and the security framework provided by the Common Criteria.

The Trusted PC: Current Status of Trusted Computing

By: Christopher Hageman (posted on October 31, 2003)

This paper, focusing on the Trusted Computing Group's standards, will provide an overview of trusted computing as it stands today: its methods, applications, possible pitfalls and current implementations.

The HIPAA Final Security Standards and ISO/IEC 17799

By: Sheldon Borkin (posted on October 31, 2003)

This paper provides a detailed analysis comparing HIPAA Final Security Standards and ISO/IEC 17799, along with an approach to compliance with both standards.

Protection Profile, A Key Concept in The Common Criteria

By: Nor Ramli (posted on October 31, 2003)

This paper will give a description of the roadmap to the Common Criteria (CC) that basically explains the distinct but related parts and how three key CC user groups namely the consumers, developers and evaluators use them.