D. In indirect addressing, the location provided to the CPU contains a memory address. The

Understanding System Security Evaluation Those who purchase information systems for certain kinds of applications—think, for example, about national security agencies where sensitive information may be extremely valuable or dan- gerous in the wrong hands or central banks or securities traders where certain data may be worth billions of dollars—often want to understand their security strengths and weaknesses. Such buyers are often willing to consider only systems that have been subjected to formal evaluation processes in advance and received some kind of security rating so that they know what they’re buying and, usually, also what steps they must take to keep such systems as secure as possible. When formal evaluations are undertaken, systems are usually subjected to a two-step pro- cess. In the first step, a system is tested and a technical evaluation is performed to make sure that the system’s security capabilities meet criteria laid out for its intended use. In the second step, the system is subjected to a formal comparison of its design and security criteria and its actual capa- bilities and performance, and individuals responsible for the security and veracity of such sys- tems must decide whether to adopt them, reject them, or make some changes to their criteria and try again. Very often, in fact, trusted third parties such as TruSecure Corporation, well known for its security testing laboratories are hired to perform such evaluations; the most important result from such testing is their “seal of approval” that the system meets all essential criteria. Whether or not the evaluations are conducted inside an organization or out of house, the adopting organization must decide to accept or reject the proposed systems. An organiza- tion’s management must take formal responsibility if and when systems are adopted and be will- ing to accept any risks associated with its deployment and use. Rainbow Series Since the 1980s, governments, agencies, institutions, and business organizations of all kinds have had to face the risks involved in adopting and using information systems. This led to a his- torical series of information security standards that attempted to specify minimum acceptable security criteria for various categories of use. Such categories were important as purchasers attempted to obtain and deploy systems that would protect and preserve their contents or that would meet various mandated security requirements such as those that contractors must rou- tinely meet to conduct business with the government. The first such set of standards resulted in the creation of the Trusted Computer System Evaluation Criteria in the 1980s, as the U.S. Department of Defense DoD worked to develop and impose security standards for the systems it purchased and used. In turn, this led to a whole series of such publications through the mid- 1990s. Since these publications were routinely identified by the color of their covers, they are known collectively as the “rainbow series.” Following in the DoD’s footsteps, other governments or standards bodies created computer security standards that built and improved on the rainbow series elements. Significant standards in this group include a European model called the Information Technology Security Evaluation Criteria ITSEC which was developed in 1999 and used through 1998. They also include the so- called Common Criteria, adopted by the U.S., Canada, France, Germany, and the U.K. in 1998, but more formally known as the “Arrangement on the Recognition of Common Criteria Certifi- cates in the Field of IT Security.” Both of these standards will be discussed in later sections as well.