Orange Book

   Lay term for the National Security Agency document called "Trusted Computer System Evaluation Criteria," or TCSEC, which specifies security levels that vendors must comply with to achieve Department of Defense security standards; so called because of the color of its cover. This publication details standards for security levels used to control access to computer systems from Class A1, the highest verifiable security level, to Class D, the lowest, which has no security.

   Class C2 is the security level most appropriate to the business world; higher levels of security tend to intrude too much into normal commercial working patterns. C2 security requires that the operating system provide individual logins with separate accounts and a verifiable audit trail, that resources have owners, and that files and other system resources be protected from other processes that might corrupt them.

   According to the standard, a C2 compliant workstation cannot be connected to a network. Secure networking is defined in "Trusted Network Interpretation," which is known as the Red Book.

   See also security.