COMMENTS ON 7 JANUARY DRAFT CSSC GUIDELINES FOR THE SECURITY ... SYSTEMS

• Document Type: CREST
• Collection: General CIA Records
• Document Number (FOIA) /ESDN (CREST): CIA-RDP89B01354R000200320008-7
• Release Decision: RIFPUB
• Original Classification: K
• Document Page Count: 2
• Document Creation Date: December 27, 2016
• Document Release Date: March 21, 2013
• Sequence Number: 8
• Publication Date: January 15, 1971
• Content Type: MISC

N
,e1.1 Declassified and Approved For Release 2013/03/21 : CIA-RDP89B01354R000200320008-7
f" 1
15 January 1971
Comments on 7 January Draft CSSC Guidelines for the Security...Systems
I. Purpose: Third line, suggest sone better identlfcation than,
"Community".
Line 6, insert system before operation.
Last Line suggest "other systems" be made more specific.
II. General: Page 2, para. 20 line 2 It is suspected that you mean
something other than "discrete". You may mean that it should be
conducted with "discretion" (being careful about what one does
and says). It may be that "prudent" is what you desire.
Line 3, "continuous" is without ceasing. I suggest that
"continual" is the idea that you desire.
It seems that it would be helpful to have the guidance contain the
appropriate references.
Third paragraph, 2nd sentence, why is it "essential"?
Include the reason.
III. Test Plan: Fourth line change "model" to "plan".
IV. System Security Analysis: Page 5, last sentence may be two
sentences would make clear the two things that the analysis should
be oriented to determine.
V. Security Testing: Last sentence, how does the "sensitivity" of
the data determine extent and duration of the test?
VI. Security Evaluation: I suspect that analysis alone cannot provide
concrete information as to "possession". I suggest that you put
"evidence" before "proof" to agree with notion of "analysis"
Declassified and Approved For Release 2013/03/21 : CIA-RDP89B01354R000200320008-7
Declassified and Approved ForRelease2013/03/21 : CIA-RDP89B01354R000200320008-7
r
followed by "test".
Nest to last line insert "by the system" aster "provided".
VII. reaturestobe.Analyzed and . ested: You may desire to refer to
this section in Section IV ?&V.
Page 3, para. A. 2. Suggest rewrite to make clear. ,
A. 3. "State" vs variables included in the execution
state of a processer. The sentence appears to have two separate
verbs: "shall determine" and "should be identified".
Page 14 para. 7, line 7 "along" or "alone .
Declassified and Approved For Release 2013/03/21 : CIA-RDP89B01354R000200320008-7