Chapter 1 – Introduction and Description
Multi-Tech RouteFinder RF650VPN User Guide
10
RISKS (Risks to the Public in the Use of Computers and Related Systems) is a moderated forum for
the discussion of risks to society from computers and computerization. Their web site is at
http://catless.ncl.ac.uk/Risks
.
The NIAP (National Information Assurance Partnership) was created in 1997 to join the efforts of the
National Institute of Standards and Technology (NIST) and the National Security Agency (NSA) to meet
the security testing, evaluation, and assessment needs of both IT producers and consumers. Its long-term
goal is to boost consumer confidence in their information systems and networks. Agencies such as the
Federal Aviation Administration are starting to work with NIAP to better define their security requirements,
and NIAP is looking for other target communities where the organization can serve as a catalyst to spur
security requirements and standardization of rules.
See
http://niap.nist.gov/niap/objectives.html
GASSP (Generally Accepted System Security Principles) began in mid-1992 in response to a 1990
recommendation from the National Research Council. The effort is sponsored by the International
Information Systems Security Certification Consortium (ISC2), an international common-criteria effort to
develop IT product-related information security principles.
Its objectives include promoting good practices and providing an authoritative point of reference for IT
professionals and a legal reference for the rest of the world for information security principles, practices,
and opinions. The GASSP Pervasive Principles have been developed, and work has begun on defining
and mapping the GASSP Broad Functional Principles.
Go to
http://web.mit.edu/security/www/gassp1.html
The Center for Internet Security - The Center, founded in October 2000, is focused on helping
organizations worldwide manage information security risk efficiently. The group, which is vendor- neutral,
provides tools to measure, monitor, improve, and compare the security status of Internet-connected
systems and appliances. Some 200 members help identify the top security threats and participate in
creating practical methods to reduce those threats. The Center's web site is at
http://www.cisecurity.org/
.
The British Standard (BS) 7799 is an enterprise security policy standard popular in several European
countries. The BS 7799 standard has two main elements: a code of practice for information security
management and a specification for information security management systems. It prescribes a specific
process to determine what policies should be in place, how to document them, and how to develop those
that are not specifically identified in the model.
CASPR (Commonly Accepted Security Practices & Recommendations)
launched in August 2001,
CASPR focuses on distilling expert information via free papers available via the Internet. With the Open
Source movement as a guide, CASPR has approximately 100 certified security professionals involved
and is actively recruiting subject matter experts in all areas of information security.
http://www.caspr.org/aboutcaspr.php
IETF (Internet Engineering Task Force) the international standards body that has standardized the IP
protocol and most of the other successful protocols used on the Internet. The IETF web page is at
http://www.ietf.org/
. To help get started with a security policy, try RFC2504 - Users' Security Handbook,
and RFC 2196 - Site Security Handbook.