Secure Computing Chapter 12

The IEEE is an international nonprofit organization that focuses on ___________

developing and distributing standards that relate to electricity and electronics.

Internet Engineering Task Force (IETF)

develops and promotes Internet standards and is an open organization.

To ensure international acceptance and maximum usage of its standards, the IEC _____________

encourages participation from as many countries as possible.

Internet Architecture Board (IAB)

is a subcommittee of the IETF. Is composed of independent researchers and professionals who have a technical interest in the well-being of the Internet

ISO 17799

is an international security standard. This standard documents a comprehensive set of controls that represent best practices in information systems.

National Institute of Standards and Technology (NIST)

maintains the atomic clock that keeps the United States' official tim

ANSI's goal is to _______________

strengthen the U.S. marketplace within the global economy

the Institute of Electrical and Electronics Engineers (IEEE)

"the world's largest professional association for the advancement of technology"

National Institute of Standards and Technology (NIST)

A federal agency within the U.S. Department of Commerce.

Baldrige National Quality Program

A national program that empowers and encourages excellence among U.S. organizations, including manufacturers, service organizations, educational institutions, health care providers, and nonprofit organizations. It also strives to increase quality and recognize organizations that achieve quality goals

Which standards organization publishes American Standard FORTRAN?

ANSI

One of the leading standards agencies on the United States is the _________________

American National Standards Institute (ANSI)

Internet Architecture Board (IAB)

Architecture for Internet protocols and procedures, Processes used to create standards, Editorial and publication procedures for RFCs, Confirmation of IETF chair and technical area directors

A-I-C Triad

Availability, Integrity, and Confidentiality.

The earliest digital computers were the result of experimental standards.

False

Which standards organization formed in 1906 and handles standards for batteries?

IEC

The _______________ is the world's largest professional association for the advancement of technology.

IEEE

The best-known standard that relates to information security is the ____________

IEEE 802 LAN/MAN standard family

RFCs may originate with other organizations

IETF creates only some RFCs. Others may come from independent sources, the IAB. or the Internet Research Task Force (IRTF).

Which standards organization's name derives from the Greek word for "equal"?

ISO

NIST Laboratories

Laboratories that conduct research to advance the United States' technology infrastructure. The nation's industry uses this infrastructure to improve the quality of products and services.

Which of the following is the most well-known ISO standard?

OSI reference model

Only some RFCs are standards

Only RFCs that open with phrases like "This document specifies ..." or "This memo documents ..." should be considered standards or normative documents.

What is the best-known ISO standard?

Open Systems Interconnection (OSI)

RFCs that define formal standards have four stages:

Proposed Standard (PS), Draft Standard (DS), Standard (STD), Best Current Practice (BCP).

National Institute of Standards and Technology (NIST)

Provides standards for measurement and technology on which nearly all computing devices rely

ANSI C

Published by ANSI, this is a standard version of the programming language C in 1989.

switching and signaling recommendations are in the _________ series

Q

IS0 17799 consists of two separate parts:

The ISO 17799 code of practice and the BS 17799-2 specification for an information security management system.

Best Current Practice (BCP)

The alternative method used to document operational specifications that are not formal standards

Standard (STD)

The final stage of a standard, after it has been shown to be widely adopted and deployed

American Standard FORTRAN

The first standard programming language.

Proposed Standard (PS)

The initial official stage of a standard

World Wide Web Consortium (W3C)

The main international standards organization for the World Wide Web.

Draft Standard (DS)

The second stage of a standard, after participants have demonstrated that the standard has been deployed in working environments

ISO/IEC 27002

The standard directs its recommendations to management and security personnel responsible for information security management systems.

ITU-T Recommendation X.509

X.509 is a recommendation for a public key infrastructure (PKI) that addresses single sign-on (SSO) capability and Privilege management infrastructure (PMI). The recommendation defines standard formats for public key certificates, certificate-management capabilities, attribute certificates, and a certification path validation algorithm.

ITU-T divides its recommendations into _________ separate series.

26

International Telecommunication Union (ITU)

A United Nations agency. It is responsible for managing and promoting information and technology issues.

Technology Innovation Program

Another national program that offers awards to organizations and universities to support potentially revolutionary technologies that apply to critical needs of national interest.

RFCs never change

Any changes to an RFC get a new number and become a new RFC. Always look for the latest RFC, because previous documents may be out of date.

Standards the W3C has developed or endorsed include the following:

Cascading Style Sheets (CSS), Common Gateway Interface (CGI), Simple Object Access Protocol (SOAP), Web Services Description Language (WSDL), and Extensible Markup Language (XML)

International Organization for Standardization (ISO)

It is a nongovernmental international organization. Its goal is to develop and publish international standards. ISO, based in Geneva. Switzerland, is a network of 163 national standards institutes. ISO serves as a bridge between the public and private sectors. Its goals are to develop standards that do not cater to either group exclusively, but reach consensus.

National Institute of Standards and Technology (NIST)

Maintains a list of standards and publications of general interest to the computer- security community.

NIST executes its primary mission through four cooperative programs

NIST Laboratories, Baldrigde National Quality Program, Hollings Manufacturing Extension Partnership, and Technology Innovation Program.

The IETF produces documents called ________.

Request for Comments (RFCs)

ISO/IEC 27007 expands on ISO 17799 by adding two new sections, dividing the new standard into 12 major sections.

Risk Assessment, Security Policy, Organization of Information Security, Asset Management, Human Resources Security, Physical and Environmental Security, Communications and Operations Management, Access Control, Information Systems Acquisition Development and Maintenance, Information Security Incident Management, Business Continuity Management, and Compliance.

The ISO divides the 17799 standard into 10 major sections:

Security policy, Security Organization, Asset Classification and Control, Personnel Security, Physical and Environmental Security, Communications and Operations Management, Access Control, System Development and Maintenance, Business Continuity Management, and Compliance

The IETF primarily focuses on standards of the________Internet protocol suite.

TCP/IP

The IETF works closely with the W3C and ISO/IEC, focusing primarily on standards of the ____________

TCP/IP or Internet protocol suite

Hollings Manufacturing Extension Partnership

This partnership is a network of centers around the nation that offer technical and business assistance to small and medium-sized manufacturers.

Which standards organization publishes standards such as CGI. HTML, and XML

W3C

Data networks, open systems communications, and security recommendations are in the ________ series

X

ITU-T Recommendation X.25

X.25 describes a protocol suite for a packet-switched wide area network communication. X.25 is a Layer 3 (Network layer) protocol that provides a resilient w id e area network. Although X.25 is still in use today, most wide area networks use the IP protocol

Three recommendations of particular interest in information security are:

X.25, X.75, and X.509

ITU-T Recommendation X.75

X.75 describes the protocol for connecting two X.25 networks. It defines the requirements for the interface between data communication equipment (DCE) units in a network.

Requests for Com m ents (RFCs)

a series of documents that range from simple memos to standards documents.

ANSI standards cover such business sectors as

acoustical devices, construction equipment, dairy and livestock production, and energy distribution.

ANSI code

code is a standard that defines a set of values used to represent characters in computers. A standard is necessary to enable multiple computers to share data and communicate with each other.

The NIST Special Publications 800 series

contains many standards that provide guidance for information systems security activities.

Today, ANSI is composed of

government agencies, organizations, educational institutions, and individuals.

Internet Architecture Board (IAB) provides much of the ____________

high-level management and validation of the processes of conducting IETF business.

The main purpose of ISO 17799 is to:

is an international security standard. This standard documents a comprehensive set of controls that represent best practices in information systems.

PCI DSS

is an international standard for handling transactions involving payment cards

The stated purpose of the W3C is to ____________

is to develop protocols and guidelines that unify the World Wide Web and ensure its long-term growth.

The oldest and most recognizable activity of the ITU is ____________

its work developing standards.

IEEE is also one of the _________ standards-producing organizations.

largest

ITU Telecommunication Sector (ITU-T) performs

performs all ITU standards work.

Transport layer (Layer 4)

provides error-free communications across a network. It also provides the connections needed by software functions in the Session layer (Layer 3). In addition, it calls functions in the Network layer (Layer 3), the next layer down, to send and receive packets that make up the contents of the network communication.

ITU-T calls the international standards it produces

recommendations

IEC is active in developing standards that support _____________

safety, performance, environmental responsibility, energy efficiency, and renewable energy sources and use.

Because the ITU-T is a United Nations agency, its standards carry

significant international weight

ANSI primarily addresses standards that support:

software development and computer system operation

Even though ITU-T calls its standards recommendations, they tend to carry

substantial authority

ITIJ-T also defines ____________

tariff and accounting principles for international telecommunication services.

ANSI oversees ______________

the creation, publication, and management of many standards and guidelines that directly affect businesses in nearly every sector.

The ITU-T is responsible for ensuring ____________

the efficient and effective production of standards covering all fields of telecommunications for all nations.

IETF focuses on _________

the engineering aspects of Internet communication and attempts to avoid policy and business questions.

International Electrotechnical Commission (IEC)

the preeminent organization for developing and publishing international standards for technologies related to electrical and electronic devices and processes.