Passive intelligence gathering can pay off surprisingly well with lower risks of detection. One weakness of computer systems lies in the electromagnetic signals they emit. Electrical pulse trains between computer components generate electromagnetic radiation which is transmitted through the air and out along the wires and plumbing pipes penetrating facility walls. Electronic shields and filters are generally adequate to plug such data leaks. Taps on communication lines connecting computers with remote terminals and other computers necessitate a different approach. Data encryption (also called enciphering, scrambling, and privacy transformation) is typically an algebraic transformation of a set onto itself. In a computer system, data encryption is generally a transformation of the binary representations of the data onto themselves using an encryption algorithm which has a unique inverse. Performing this inverse algorithm is called decryption. Encryption algorithms are based on a variable or a set of variables called the encryption key. (Fig. 7) This key must be distributed to all points where encryption and decryption are to occur using a specialized, protected distribution system. Thus, the data protection is based on both an algorithm and a protected key. Usually, the algorithm is generally known but the key is highly protected and often changed. Encryption protects data during transmission between a computer and its terminals and other computers. Data in storage is often encrypted, as are passwords. An interesting feature of protecting passwords is that they can be encrypted with an algorithm which has no inverse. A user-supplied password can simply be encrypted and used in that form, making it impossible for an operator, maintenance man, or programmer to obtain all information in the system. Layers of defensive hardware and software consume more machine time and make computer systems less convenient to use. The more secure the system, the more it costs to use. In this context, it should be noted that, despite the headlines about million-dollar thefts, the amount of computer-aided theft is still rather small. By far the biggest source of loss in business data processing operations originates in the errors and omissions committed by honest employees. The software audits and tests for consistency being designed to catch criminals will also help eliminate innocent errors and omissions. In fact, the savings accrued here may well pay for all the paraphenalia needed to control access and insure data security. The NBS Role in Controlled Accessibility Many organizations within government and in the private sector are working on computer security. The Department of Defense, for example, has issued directives in the areas of emanations and data processing security requirements.1 The Government Management Information Systems (G-MIS) Organization has written a first-draft manual on administrative guidelines for government data centers.2 Many private companies are funded by the government to carry out research and development in voice recognition, operating system redesign, and the like. In addition, individual companies recognizing the importance of the problem are concentrating their own resources in this area. To illustrate, IBM has initiated the following four programs: 1. TRW Systems: Certification and measurement techniques. 2. State of Illinois: Evaluation of the impact of security procedures on operations. 3. MIT: Authorization technology. 4. IBM-Gaithersburg: Project control and system implementation. The implementing mechanisms listed below are primarily applicable to Federal agencies but will also be useful to state and local governments. In addition, through cooperative efforts now underway by government with professional societies and trade associations, they should also have significant utility in the private sector. 1. Legal requirements and directives 2. Standards and guidelines 3. Specifications 4. Measurement techniques 5. Certification or evaluation procedures 6. Regulations Within the wide scope of activities supporting these policy mechanisms, the NBS is concentrating its resources on a small but important subset. The National Bureau of Standards has only a very minor role, of course, in the development of regulations, legal requirements and directives, but it has an important part to play in the development and implementation of the other four mechanisms listed (2 through 5). In particular, the NBS effort concentrates on the standards and guidelines that will allow for the control of accessibility to computer systems and for specification of levels of assurance of security. These are probably among the most important means available for meeting the demands being established by Congress, the Executive Branch, consumer groups, and legal organizations. Controlled accessibility measures provide an essential means for countering the threats identified on Table 1. 1 DOD Directive 5200.19. Control of Compromising Emanation. February 10, 1968. DOD Directive 5200.28. Security Requirements for Automatic Data Processing (ADP Systems.) December 18, 1972. 2 (72.01 draft) An Administrative Guideline for Security and Confidentiality in State and Local Government Data Centers. November 17, 1972. |