SSCP · Question #197
As per the Orange Book, what are two types of system assurance?
The correct answer is D. Operational Assurance and Life-Cycle Assurance. The Orange Book (TCSEC - Trusted Computer System Evaluation Criteria, DoD 5200.28-STD) defines two categories of system assurance. Operational Assurance addresses how well the system architecture, system integrity, covert channel analysis, and trusted facility management ensure…
Question
Options
- AOperational Assurance and Architectural Assurance.
- BDesign Assurance and Implementation Assurance.
- CArchitectural Assurance and Implementation Assurance.
- DOperational Assurance and Life-Cycle Assurance.
How the community answered
(22 responses)- B5% (1)
- C5% (1)
- D91% (20)
Explanation
The Orange Book (TCSEC - Trusted Computer System Evaluation Criteria, DoD 5200.28-STD) defines two categories of system assurance. Operational Assurance addresses how well the system architecture, system integrity, covert channel analysis, and trusted facility management ensure security during operation. Life-Cycle Assurance addresses how well security was built in throughout the system's development, including security testing, design specification, configuration management, and trusted distribution. The other options (A, B, C) either mix these categories incorrectly or use terms not defined in the Orange Book's assurance framework.
Topics
Community Discussion
No community discussion yet for this question.