security

   Operating system controls used by the network administrator to limit users' access to approved areas.

   The National Security Agency document called "Trusted Computer System Evaluation Criteria" (TCSEC) specifies security levels that vendors must follow to comply with Department of Defense security standards.

   This publication details standards for security levels used to control access to computer systems from Class A1, the highest verifiable security level, to Class D, the lowest, which has no security.

   Class C2 is the security level most appropriate to the business world; higher levels of security tend to intrude too much into normal commercial working patterns. C2 security requires that the operating system provide individual logins with separate accounts and a verifiable audit trail, that resources have owners, and that files and other system resources be protected from other processes that might corrupt them. An operating system that lets anyone have unfettered access, such as MS-DOS or the MacOS, falls into the D category. C1 and C2 levels can be implemented in a commercial environment. After the B1 level, the computing environment changes radically, and many of the mandatory access-control mechanisms become impractical for normal commercial operations.

   See also intruder.