NCJ Number
57759
Date Published
1977
Length
5 pages
Annotation
SINCE ALL EFFORTS TO DEVELOP INTERNAL SOFTWARE CONTROLS PREVENTING UNAUTHORIZED ACCESS TO COMPUTERS HAVE FAILED, ATTENTION IS FOCUSED ON HOW HARDWARE CAN BE USED TO IMPROVE SECURITY.
Abstract
COMPUTER USERS MUST EITHER ACCEPT THE RISK OF ESPIONAGE AND EMBEZZLEMENT OR ACQUIRE PROTECTION AGAINST THESE CRIMES. USERS MUST CONSIDER THE COST OF SUCH PROTECTION IN TERMS OF THE ACTUAL ADDITIONAL PROTECTION PROVIDED BY VARIOUS PROTECTIVE TECHNIQUES. PROTECTION AGAINST UNAUTHORIZED COMPUTER USE CAN BE PROVIDED THROUGH SUCH METHODS AS EXTERNAL ACCESS CONTROL MECHANISMS OR FILE ENCRYPTION. EXTERNAL ACCESS CONTROL INVOLVES DEVISING A MECHANISM WHICH WILL ISOLATE THE USER TO SPECIFICALLY AUTHORIZED COMPUTER DATA BANKS AND PROVIDE A FOOLPROOF MEANS OF PREVENTING ACCESS TO RECORDS IN OTHER BANKS. THE USE OF ENCHIPERED CODES CAN PROVIDE THIS PROTECTION WHEN USED WITH SUCH TECHNIQUES AS EXIT GUARDS WHICH ARE PLACED AT EACH TERMINAL TO CONTROL USER ACCESS TO RECORDS BY CHECKING THE COMPARTMENT IDENTIFICATION TAG (AN ENCHIPERED CODE) INDICATING THE USER'S ACCESS RIGHTS. A TERMINAL GUARD CAN ALSO CHECK A USER'S ACCESS RIGHTS, AND AN ACCESS CONTROL CENTER CAN PROVIDE ADDITIONAL PROTECTION AGAINST UNAUTHORIZED USE OF COMPUTER FILES. THE COST OF AN EXTERNAL ACCESS CONTROL SUBSYSTEM RANGES FROM $150,000 TO $450,000. ALTHOUGH THIS COST IS TOO HIGH FOR MOST COMPUTER INSTALLATIONS, CHEAPER ALTERNATIVES ARE AVAILABLE, SUCH AS EMPLOYING BETTER AUDITING PRACTICES TO CATCH EMBEZZLERS. FUTURE COSTS OF EXTERNAL ACCESS CONTROL SUBSYSTEMS SHOULD BE SUBSTANTIALLY LOWER THUS ENABLING MORE COMPUTER FACILITIES TO USE SUCH SYSTEMS. CHARTS, DIAGRAMS, AND REFERENCES ARE PROVIDED. TABULAR DATA, DIAGRAMS, AND A BIBLIOGRAPHY ARE PROVIDED. (KCP)