Bibliography
This bibliography of computer security documents was prepared by the
National Computer Security Association. Corrections and additions will
be appreciated. Please write us at Suite 309, 4401-A Connecticut
Avenue, NW, Washington DC 20008. Or call voice at (202) 364-1304.
Our BBS number: (202) 364-8252.
Access Control/Fence Industry Monthly Newsletter From
Communication Channel Inc. 6255 Barfield Road Atlanta, GA 30328
(404) 256-9800 $26.95 This newsletter provides a listing of products
and suppliers for the access control industry.
Adler, Stacy "7 Myths of Computer Security." Security vol 24 no. 1
January 1987 pp. 50-52 This article covers consultants that clear
misconceptions about data protection software.
Armstrong, James R. "Protecting the Corporate Data." Data Processing
& Communications Security vol 9 no. 4 March/April, 1985 pp. 16-17
This article discusses how most alternative off-site lack the
environmental control, security and accessibility needed. Includes a
discussion on things to consider in selecting an off-site storage facility.
American Society for Industrial Security, Washington, D.C. Chapter
Newsletter Monthly Newsletter From American Society for Industrial
Security 1655 N. Ft. Myer Drive Suite 1200 Arlington, VA 22209 (703)
522-5800 Free to members only. This newsletter provides current
information on industrial security.
Anon. "Computer "Hacking" is No Longer Just a Lark." Office vol 102
no. 3 September 1985 pp. 90-95 Computer hackers will use computers
to obtain information and resell it, use it for blackmail, extortion, and
espionage. This article discusses techniques for preventing hackers
from getting on a system, and monitoring them if they are discovered.
Anon. "Computer Security: The Menace is Human Error." Office vol 99
no. 3 March 1984 pp. 119-120 This article stresses that managers
should understand that data security is a people problem and not a
computer problem. People are the ones that either accidentally or
intentionally misuse a computer system.
Anon. "Internal Security." PC Week vol 2 no. 18 May 1985 pp. 89-91,
106-107 Experts feel that local computer access is more prone to
intrusion than long-distance access. This article discusses how insiders
in a company are the ones most likely to abuse a computer system.
Anon. "Reporting Computer Crime." Data Processing &
Communications Security vol 8 no. 6 July/August 1984 pp. 20-21 This
article presents a suggested format for a final report to use in
documenting actions surrounding a computer crime.
Anon. "Communications and Systems Security." Data Processing &
Communications Security vol 9 no. 3 1985 Buyer's Directory pp. 11-13
This article discusses a wide variety of communications and system
security protection methods. Includes encryption, fiber optics, key
management, optical links, electrical emanations, and dial-up access
protection devices.
Anon. "Computer Communications Security Lexicon." Data Processing
& Communications Security vol 11 no. 2 Spring 1987 pp. 22-23 This
article is an update containing some new added security definitions of
terms and phrases.
Anon. "Controlling Access To Your Data." Personal Computing vol 9 no.
9 September 1985 pp. 60-72 Explains measures that can be taken to
protect what's in a computer. Focuses not only on vandals, but also on
people who accidentally harm the computer.
Anon. "Dial-Up Access Security Products." Data Processing &
Communications Security vol 9 no. 2 November/December 1984 pp.
21-24 This article presents some new dial-up access security products
and their major features.
Anon. "Enhancements Out For Barrier Security Devices."
Computerworld vol 18 no. 35 August 1984 pp. 51 This article discusses
the password protection device designed by International Anasazi, Inc.
that will limit access on dial-up lines.
Anon. "Firesign Unwraps Security Feature." MIS Week vol 5 no. 23
June 1984 pp. 24 This article discusses Firesign Computer Company's
product that provides for network security by its password system.
Anon. "Security Computer Outsmarts Colorado Bandits." Data
Management vol 19 no. 7 July 1981 pp. 17-18 This article looks at the
effectiveness of a security system that controls access to several
high-rise buildings in Colorado.
Anon. "Security Lock Ready for PCs." MIS Week vol 6 no. 26 July 1985
pp. 30 The hard disk security product "Knight Data Security Manager"
is discussed. This product allows password protection in a PC.
Anon. "Automated Contingency Planning." Data Processing &
Communications Security vol 8 no. 4 March/April 1984 pp. 22 This
article presents a special purpose software package CHI/COR that
deals with the job of documenting the resources needed to implement a
disaster recovery plan.
Anon. "Contingency Planning and the Law." Data Processing &
Communications Security vol 8 no. 4 March/April 1984 pp. 17-18 This
article reviews the Foreign Corrupt Practices Act and its requirement
for record keeping and internal controls. Other potential legal
liabilities are also reviewed.
Anon. "Computer Power and Environmental Controls." Data Processing
& Communications Security vol 9 no. 3 1985 Buyer's Directory pp. 13
This article discusses common power anomalies and equipment
available to overcome them.
Anon. "Computer Back-up Facilities." Data Processing &
Communications Security vol 8 no. 4 March/April 1984 pp. 19-22 This
article discusses the options of back-up sites including cold sites, hot
sites, or empty shell, or fully equipped recovery sites. Also refers to the
extent of equipment, space, and services provided by these back-up
facilities.
Anon. "Computer Security: Issues and Answers." Datamation vol no.
September 15, 1984 pp. 16 Pages This 16-page section sponsored by
the Computer Security Institute contains several articles that cover a
variety of computer security issues.
Anon. "Computer Security: Issues and Answers." Datamation vol no.
September 15 1985 pp. 24 Pages This advertisement section contains
eight articles that discuss a variety of computer security issues. The
authors include FBI Director William Webster and Department of
Defense Computer Security Center Director Robert Brotzman.
Anon. "Making The Case For Computer Security Pure and Simple."
Datamation vol no. September 1983 pp. This section of Datamation is
sponsored by the Computer Security Institute and covers a broad range
of computer security issues in several different articles.
Anon. "Personal Computers vs. Data Security: the Two Need Not Be
Incompatible." Data Processing & Communications Security vol 12 no.
1 Winter 1988 pp. 24-26 This article discusses the threat of data loss
either intentional or unintentional. It examines the significant risks
and the data security policies to lower these risks.
Anon. "Protecting Information and Interest." Computer Management
vol no. October 1981 pp. 33-34, 36 Suppliers, consultants, and services
related to computer security are listed in this directory.
Anon. "Simple Security Precautions Ensure Information Safety."
Computerworld vol 19 no. 17 April 1985 pp. SR-38 This article applies
many of the security precautions for mainframes to the microcomputer.
MICROCOMPUTER SECURITY
Anon. "Memo: Disaster Plan For Microcomputer Users." Data
Processing & Communications Security vol 8 no. 4 March/April 1984
pp. 27-29 This article is in the form a memo containing a
microcomputer disaster recovery checklist. It address issues that
should be taken in contingency plans.
Anon. "Media Safes: Countering the Threats of Fire." Data Processing
& Communications Security vol 9 no. 6 July/August 1985 pp. 18-20
This article is a review of critical basic information on how to select
fire resistant media safes.
Anon. "Protecting The World's Largest Computer User." Data
Processing & Communications Security vol 8 no. 4 March/April 1984
pp. 25-26 This article discusses a new high security off-site storage
facility opening in Beltsville, Maryland. It also address concern with
the lack of proper security storage today.
Anon. "Computer Security Awareness: Organizations and Senior."
Management Concerns Data Processing & Communications Security vol
8 no. 5 May/June 1984 pp. 12-13 This article gives the result of a
survey of general security and computer security personnel, EDP
auditors, and internal auditors to determine the computer security
awareness of their company and senior management.
Anon. "Records Storage and Management." Data Processing &
Communications Security vol 8 no. 4 March/April 1984 pp. 23-25 This
article addresses the questions which records should be stored off-site,
and how can an off-site facility be evaluated? It also provides an
overview of areas to consider.
Anon. "Computer Security Software." Data Processing &
Communications Security vol 9 no. 1 September/October 1984 pp. 19-24
This article provides information for using access control software to
protect the terminals, the data and the system itself from unauthorized
use.
Anon. "Computer Security Software." Data Processing &
Communications Security vol 9 no. 3 1985 Buyer's Directory pp. 17-18
This article addresses a wide variety of computer security software
programs and their different uses.
Anon. "Protecting Software With Escrow Services." Data Processing &
Communications Security vol 8 no. 5 May/June 1984 pp. 22-24 This
article addresses some of the problems and answers for protecting
software that concerns major management today.
Ashley, Cliff and Story, Frank Automatic Data Processing Security
Program From Kaiser Engineers Hanford, ATTN: Cliff Ashley, SAS
Manager February 11, 1987 Training & Awareness Free This manual
describes the computer security program used at Kaiser Engineers
Hanford.
Associated Press "Jury Selection In 1st "Virus" Trial Begins."
Washington Post vol no. 277 September 7, 1988 pp. C1 This article is
about a programmer accused of using a computer "virus" to sabotage
thousands of records at his former work place.
Atkinson, L.V. "Fraud: Input Data Most Vulnerable." Computerworld
UK vol 2 no. 21 September 2, 1981 pp. 10 Article discusses a survey
which found that the major danger to computers was the alteration of
input data.
Auerbach Data Security Management Bimonthly Journal From
Auerbach Publishers Inc. 6560 N. Park Drive Pennsauken, NJ 08109
(609) 662-5599 $265.00 Annually This journal deals with issues related
to data security management.
Auerbach Information Management Series Monthly Journal From
Auerbach Publishers, Inc. 6560 N. Park Drive Pennsauken, NJ 08109
(609) 662-2070 $750.00 Annually This journal on information security
provides insights, approaches, and products related to security.
Avarne, Simon "How to Find Out a Password." Data Processing &
Communications Security vol 12 no. 2 Spring 1988 pp. 16-17 This
article gives examples of how to discover someones password and
discusses weaknesses of traditional passwords.
Baker, R.H. "Lining Up Computer Crooks." Micro Communications vol
2 no. 5 May 1985 pp. 18-22 This article looks at crime patterns of
microcomputer users breaking into mainframes. Ways in which these
patterns can be learned and then stopped is discussed.
Bailey, Cynthia "Information Security: A Pressing Need" Computer
Digest, September, 1989, p. 30, 32.
Bass, Brad "Security Teams Fight Network Invaders" Government
Computer News, September 4, 1989, p. 87.
Beitman, L. "A Practical Guide To Small Business Computer Security."
Office vol 96 no. 2 August 1982 pp. 86, 90 This article gives advice on
how to obtain computer security in a small business environment. A
checklist is included that will help to prevent accidental and
intentional harm to a system.
ben-Aaron, Diana. "Mailsafe Signs, Seals, and Delivers Files"
InformationWeek, September 15, 1986.
Bequai, A. "What to do About Crime in the Electronic Office." Office
vol 101 no. 1 January 1985 pp. 101-104 This article discusses the
important role that auditing computer systems plays in preventing
crimes and abuse.
Bequai, August "Federal Computer Crime Legislation is Needed." Data
Management vol no. May 1981 pp. 22-24 The ways criminals use
loopholes in our present criminal justice system is discussed along with
a history of computer crime legislation.
Berman, A. "Evaluating On-Line Computer Security." Data
Communications vol 12 no. 7 July 1983 pp. 145-152 The security
problems that have arisen because of on-line processing are discussed
in this article. Covered are the two ways to obtain a secure on-line
system.
Betts, M. "Government's Computers "Highly Vulnerable" to Abuse."
Computerworld vol 18 no. 40 October 1984 pp. 4 Discusses how highly
vulnerable the federal government's computers are to abuse, and a
congressman who is seeking to change that vulnerability.
Betts, M. "NBS Releases Standards For Managing Password Security."
Computerworld vol 19 no. 28 July 1985 pp. 19 This article talks about
how the National Bureau of Standards has completed a two- part
publication dealing with password systems.
Betts, M. "U.S. Agency Faces Probes, Boosts Security After Audit."
Computerworld vol 19 no. 24 June 1985 pp. 8 This article discusses an
audit report issued by the inspector general of the U.S. Department of
the Interior in March 1985 which revealed inadequate controls over
passwords, faulty operating procedures, and lack of audit trails by the
Denver Service Center.
Betts, M. "Reagan Systems Security Directive Under Attack."
Computerworld vol 19 no. 27 July 1985 pp. 1 This article discusses
why members of congress are concerned over how the National
Security Decision Directive 145 on computer security could be abused
by military and intelligence officials.
Betts, Kellyn S. "Foiling Data Thieves" Modern Office Technology April
1985, pp 112 ff.
Bezdek, J. "Across-the-Board Training Protects Data." Computerworld
vol 18 no. 44 October 1984 pp. SR-10 This special report covers the
four areas that a training program in computer security needs to
include. These are plant physical security, logical security,
administrative security, and the legal and social aspects of security
training.
Bigelow, R.P. "Computer Security And Law." Infosystems vol 29 no. 12
December 1982 pp. 84 This article looks at how a memo from the legal
department should be structured concerning the protection of assets.
Blakeney, S. "Computer Crime: A Worldwide Concern." Computerworld
vol 17, 18 no. 52, 1 December 26, 1983, January 1984 pp. 57-60 This
article looks at computer crime as a worldwide problem. The most
common types of computer crimes are given along with the estimated
losses in various countries throughout the world.
Blakeney, S. "Micro Market Going Full Steam Ahead; IDC Predicts
Installed Base of $41.9 Billion by '86" Computerworld March 28, 1983.
Boebert, W. E., Kain, R.Y. A Practical Alternative to Hierarchical
Integrity Policies Proceeding of the 8th National Computer Security
Conference, Gaithersburg MD, Oct 1985
Boebert, W. E., Ferguson, C.T. A Partial Solution to the Discretionary
Trojan Horse Problem Proceeding of the 8th National Computer
Security Conference, Gaithersburg MD, Oct 1985
Bologna, Jack "Computer Related Crime: The Who, What, Where,
When, Why and How." Data Processing & Communications Security vol
10 no. 1 Winter 1986 pp. 19-23 This article looks at computer related
crime from the perspectives of the individual criminal, environmental
factors, organization cultures, incidence rate, and security
countermeasures.
Bologna, Jack Computer Crime: Wave of the Future Intended to
demonstrate that the current state of computer technology exceeds by
an order of magnitude our ability to secure our equipment. 102 pp $15.
Computer Protection Systems.
Bologna, Jack The Security Manager's Handbook 167 pp. $35 Computer
Protection Systems.
Bologna, Jack Strategic Planning for Corporate Directors of Security
and Risk Management. 28 pp $10 Computer Protection Systems.
Bologna, Jack "Forensic Accounting." Data Processing &
Communications Security vol 8 no. 6 July/August 1984 pp. 16-20 This
article identifies the skills and competency of a forensic accountant.
Bologna, Jack "Disaster/Recovery Planning: A Qualitative Approach."
Data Processing & Communications Security vol 8 no. 4 March/April
1984 pp. 11-15 Developing a disaster/recovery plan usually involves a
detailed quantitative risk analysis; the author offers a more qualitative
approach that is less time consuming and will obtain a higher level of
commitment from management, D/P staff, and users.
Bologna, Jack "Industrial Security In a Nutshell: A Risk by any
Other." Name Data Processing & Communications Security vol 9 no. 5
May/June 1985 pp. 12-13 This article discusses properly understanding
risk and how the opposite side of risk is opportunity for growth and
development.
Bologna, Jack "Risk Assessment Guidelines for Fidelity Insurance."
Data Processing & Communications Security vol 9 no. 4 March/April,
1985 pp. 18-20 This article is a review of the adequacy of asset
protection plans, policies, procedures and controls to enlighten top
management.
Bologna, Jack "Security Planning: The "Tapps" Method." Data
Processing & Communications Security vol 10 no. 4 Fall 1986 pp. 7-11
This article covers a system approach to assets protection. It discusses
an analytical process called Total Assets Protection Planning System
(TAPPS) which consist of organization, structure and mandate of the
security function.
Bologna, Jack "Selling Computer Security to Top Management." Data
Processing & Communications Security vol 8 no. 5 May/June 1984 pp.
13-16 This article discusses positive motivational impact, minimizing
risk, and cost feasibility in selling computer security to top managers.
Bologna, Jack "Why the Corporate Security Function is Being
Downsized." Data Processing & Communications Security vol 11 no. 2
Spring 1987 pp. 20-21 This article discusses the disbanding and
dilution of corporate security functions and how this effects the
security of a firm.
Bound, W.A.J. "Security Protecting Information Resources and Media."
Information Management vol 18 no. 8 August 1984 pp. 18-19 This
article discusses what a manager must consider when designing an
office security program to protect against the four vulnerabilities of a
system: personnel, physical, administrative, and technical.
Bowmen, Terry "Undercarpet Fiber Optics." Data Processing &
Communications Security vol 11 no. 2 Spring 1987 pp. 23-26 This
article discusses how fiber optics offer better security than copper cable
undercarpet. It also includes how to plan an undercarpet system.
Bramer, W.L. "Computer and Data Security is Battle Cry to the '80s."
Office vol 103 no. 3 March 1986 pp. 78-82 This article discusses the
number of organizations that are looking at their security procedures
and programs to deter computer abuse. The three main causes of
security problems are described.
Branstad, Dennis (editor) Computer Security And The Data Encryption
Standard February 1978 NBS SPEC PUB 500-27 Includes papers and
summaries of presentations made at a l978 conference on computer
security. Subject areas are physical security, risk assessment, software
security, computer network security, applications and implementation
of the Data Encryption Standard.
Brenner, Aaron. "LAN Security". LAN Magazine, Aug 1989.
Bunzel, Rick. "Flu Season" Connect, Summer 1988.
Burger, Ralf .Computer Viruses:a High-Tech Disease Abacus Software,
1989. For some reason, this book contains virus source code!
Cabell, D. "Network Backups." Micro Communications vol 2 no. 6 June
1985 pp. 14-18 This article describes how the only way to protect a
LAN, micro, mini, or mainframe from a complete system crash is
adequate backup.
Call, B. "Buttress Against Computer Crime." PC Week vol 2 no. 18 May
1985 pp. 111, 115 The physical protection of computers is becoming an
area of interest for more organizations. The increased number of
physical security devices illustrates this point and is discussed in this
article.
Carey, Cameron "Data Access Control: Help or Hindrance." Data
Processing & Communications Security vol 11 no. 4 Fall 1987 pp. 18-20
This article discusses limiting access to data and how to make access
control protection more of a help than a hindrance by developing a set
of priorities about various classes of data.
Cipher Irregular Newsletter From Institute of Electrical and Electronic
Engineers 9800 Savage Road Fort Meade, MD 20755 (301) 859-4376
This newsletter looks at security and privacy from a technical view.
Ciura, J.M. "Vital Records Protection: Identifying Essential
Information." Information Management vol 19 no. 2 February 1985 pp.
11 This article suggest that the best way to resume business activity
after an emergency or disaster is to have a vital records protection
program.
Clauss, Karl H. "How To Move A Data Center and Avoid a Disaster."
Infosystems vol no. December 1981 pp. 46-48, 50 This article describes
how ARCO Oil and Gas Company moved their computer center to a
new location and the points a company should consider when moving a
data center.
Clyde, Allen R. "Insider Threat on Automated Information Systems."
Data Processing & Communications Security vol 11 no. 4 Fall 1987 pp.
11-14 This articles discusses activities to detect sources of abuse that
are not widely implemented.
CM Bulletin Bimonthly Bulletin From National Classification
Management Society, Inc. 6116 Roseland Drive Rockville, MD 20852
(301) 231-9191 Free to members, non-members $15.00 annually This
bulletin contains articles pertaining to information security
management.
Cohen, Fred. Computer Viruses, Theory and Experiments. 7th Security
Conference, DOD/NBS Sept 1984.
Cohen, Fred. "Computer Viruses: Theory and Experiment." Computers
& Security, Vol. 6 (1987), pp. 22-35.
Cohen, Fred. "On the Implications of Computer Viruses and Methods of
Defense," Computers & Security, Vol. 7 (1988), pp. 167-184.
Cole, Gerald D. and Frank Heinrich Design Alternatives For Computer
Network Security (vol. 1) The Network Security Center: A System Level
Approach To Computer Network Security (vol. 2) January 1978 NBS
SPEC PUB 500-21 This two-volume study covers network security
requirements and design and implementation requirements of a special
computer dedicated to network security. The approach utilizes a
dedicated minicomputer to check authentication of network users, and,
to some extent, to check authorization. The study focuses on use of the
Data Encryption Standard to protect network data and recommends
procedures for generating, distributing and protecting encryption keys.
Collins, J.A. "Continuous Security Control Clamps Down on Abuse."
Data Management vol 23 no. 5 May 1985 pp. 56-59 The need for
computer access is discussed in this article that suggest that such
access should be a management, security-oriented process. Computer
security guidelines are also given.
COM-AND (Computer Audit News and Developments) Bimonthly
Newsletter From Management Advisory Services P.O. Box 151 57
Greylock Road Wellesley Hills, MA 02181 (617) 235-2895 $56.00
Annually This newsletter provides auditors with current trends,
practices, and developments in their field.
Computer Age: EDP Weekly Weekly Newsletter From EDP News
Services, Inc. 7043 Wimsatt Road Springfield, VA 22151 (703) 354-9400
$225.00 Annually Weekly roundup of computer industry news. Provides
analysis of computer events and trends. Articles include coverage of
computer security news.
Computer Fraud & Security Bulletin Monthly Newsletter From
Elsevier International 52 Vanderbilt Avenue New York, NY 10017
(212) 916-1250 $240.00 Annually This monthly newsletter deals with
computer crime and preventive measures that can be taken to avoid
misuse.
Computer Law Journal None Specified Journal From Center for
Computer Law Box 3549 Manhattan Beach, CA 90266 (213) 372-0198
$72.00 Annually This journal deals with all aspects of computer law
from copyright protection of software to penalties for abusing
computers.
Computer Law Newsletter Bimonthly Newsletter From Warner &
Stackpole 28 State Street Boston, MA 02109 (617) 725-1400 Free
Various subjects dealing with computer law including computer crime
are covered.
Computer Security Buyers Guide From Computer Security Institute
1988 General Security Members of CSI - Free; Non-members - $75.00
A buyers guide for a wide variety of of computer security products and
services.
Computer Security Digest Monthly Digest From Computer Protection
Systems, Inc. 150 N. Main Street Plymouth, MI 48170 (313) 459-8787
$110.00 Annually This digest addresses issues of current interest in
the area of computer security matters and related crime.
Computer Security Guidelines For Implementing The Privacy Act Of
1974 FIPS PUB 41 May 1975 Provides guidance in the selection of
technical and related procedural methods for protecting personal data
in automated information systems. Discusses categories of risks and
the related safeguards for physical security, information management
practices, and system controls to improve system security.
Computer Security Journal Twice A Year Journal From Computer
Security Institute 360 Church Street Northborough, MA 01532 (617)
393-2600 $60.00 members, $65.00 non-members annually This journal
contains technical papers on a wide variety of computer security
related topics including software, contingency planning, and security
management.
Computer Security Manual for Unclassified Systems From EG&G
Idaho, Inc. Information and Technical Services P.O. Box 1625 Idaho
Falls, ID 83415 April 30, 1987 General Security Call for current cost
(TBD) Discusses a variety of unclassified computer security issues.
Includes password usage, certification and other categories.
Computer Security Newsletter Bimonthly Newsletter Computer Security
Institute 360 Church Street Northborough, MA 01532 (617) 393-2600
$95.00 Annually, for members only. This newsletter covers a broad
range of computer security topics.
Computer Viruses - Proceedings of an Invitational Symposium, Oct
10/11, 1988; Deloitte, Haskins, and Sells; 1989
Computers & Security Six Times a Year Journal From Elsevier
International 52 Vanderbilt Avenue New York, NY 10017 (212)
916-1250 $89.00 Annually This technically oriented journal covers a
variety of topics concerning computer security.
COM-SAC (Computer Security, Audit, and Control) Twice A Year
Journal From Management Advisory Services & Publications P.O. Box
151 57 Greylock Road Wellesley Hills, MA 02181 (617) 235-2895 $55.00
Annually Most of this journal contains brief digests of articles on
computer security that have appeared in other publications, although it
does include some original articles.
Coontz, Constance "Protection through Isolation." Security Management
vol 31 no. 11 November 1987 pp. 53-55 This article discusses
compartmentalizing valuable data on dedicated PCs or small computer
systems to help protect it from hackers and moles.
CPR-R (Contingency Planning & Recovery Report) Quarterly Journal
From Management Advisory Services P.O. Box 151 57 Greylock Road
Wellesley Hills, MA 02181 (617) 235-2895 $75.00 annually This journal
is solely devoted to issues, practices and developments in contingency
planning, disaster recovery and business continuity.
Data Encryption Standard FIPS PUB 46 January 1977 Specifies an
algorithm to be implemented in electronic hardware devices and used
for the cryptographic protection of sensitive, but unclassified, computer
data. The algorithm uniquely defines the mathematical steps required
to transform computer data into a cryptographic cipher and the steps
required to transform the cipher back to its original form.
Datapro Reports on Information Security (2 Volumes) From Datapro
Research Corporation (609) 764-0100 1985 General Security $790.00
Annualy Includes management information, market surveys, and
product reports.
Data Processing & Communications Security Quarterly Magazine From
Assets Protection Publishing Box 5323 Madison, WI 53704 (608)
274-7751 $48.00 Annually This magazine covers a wide variety of
computer and communications security related topics.
Data Processing Digest Monthly Digest From Data Processing Digest,
Inc. P.O. Box 1249 Los Angelas, CA 90078 (916) 756-5138 This digest
covers more than 130 scientific, business trade, educational, and
computer journals. Articles are selected for the specific needs of DP
and IS management, computer professionals, and corporate executives.
Davidson, Thomas L. and White, Clinton E. Jr. "How to Improve
Network Security." Infosystems vol 30 no. 6 June 1983 pp. 110-112
This article discusses the need to protect network systems using
software locks, authorization schemes, logs, and data encryption.
Daview, D.W. & W.L. Price Security for Computer Networks: An
Introduction to Data Security in Teleprocessing and Electronic Funds
Transfer. John Wiley & Sons. 416 pp 1984. $34.95
Deitz, Larry "Computer Security in the Micro Age" Computers and
Electronics, June 1984, pp 68 ff
Denning D. E. Cyptography and Data Security Addison Wesley, 1982
Denning, D. E. An Intrusion-Detection Model IEEE Symposium on
Security and Privacy, April 1986.
Denning, Peter J.. "Computer Viruses". American Scientist, Vol 76,
May-June, 1988.
Denning, Peter J. "The Internet Worm". American Scientist, Vol 77,
March-April, 1989.
DES Modes Of Operation FIPS PUB 81 December 1980 Defines four
modes of operation for the Data Encryption Standard which may be
used in a wide variety of applications. The modes specify how data will
be encrypted (cryptographically occurrence and the damage protected)
and decrypted (returned to original form). The modes included in this
standard are the Electronic Codebook (ECB) mode, the Cipher Block
Chaining (CBC) mode, the Cipher Feedback (CFB) mode, and the
Output Feedback (OFB) mode.
Dewdney, A. K. "Computer Recreations - In the game called Core War
hostile programs engage in a battle of bits". Scientific American Mar
1984.
Dewdney, A. K. "Computer Recreations - A Core War bestiary of
viruses, worms and other threats to computer memories". Scientific
American Mar 1985.
Diamond, F.H. "Computer Network Security: The Need Was Never
Greater." Office vol 102 no. 2 August 1985 pp. 94-99 This article
discusses the advantages of using the callback approach in computer
networks to prevent hackers from getting onto a system.
Dobberstein, M. "To Have and Not to Have a Disaster." Computer
Decisions vol 17 no. 18 September 1985 pp. 102-126 This article deals
with the importance of actually testing contingency plans to see if they
work.
DoD Department of Defense Trusted Computer System Evaluation
Criteria, December, 1985. DOD 5200.28-STD. Library No. S225,711.
(the "Orange Book")
DoD Computer Security Center Computer Security Requirements:
Guidance for Applying the Department of Defense Trusted Computer
System Evaluation Criteria in Specific Environments DoD.
CSC-STD-003-85. 25 June, 1985, 13pp. *
Dvorak, John "Virus Wars: A Serious Warning". PC Magazine Feb 29,
1988.
EDP Security Bulletin Irregular Bulletin From Royal Canadian
Mounted Police Systems Branch 1200 Alta Vista Drive Ottawa, ON
KIA OR2 Canada This bulletin provides current information in the
field of electronic data processing security.
edpacs: The EDP Audit, Control and Security Newsletter Monthly
Newsletter From Auerbach Publishers 210 South Street Boston, MA
02111 (617) 292-8360 $96.00 Annually This newsletter is meant
primarily for the auditor, although it will benefit others with computer
security responsibility.
EDP Analyzer Monthly Journal From United Communications Group
4550 Montgomery Avenue Ste. 700N Bethesda, MD 20814 (301)
961-8700 Doug O'Boyle $159.00 annually
The EDP Auditor Quarterly Journal From EDP Auditors Association
P.O. Box 88180 373 S. Schmale Road Carol Stream, IL 60188-0180
(312) 682-1200 Available as part of annual membership. This journal is
intended for the EDP auditor and focuses on education and research.
Edwards, M. "The Sting in a Micro's Tail." Practical Computing vol 6
no. 12 December 1983 pp. 108-109 How criminals exploit information
technology is described in this article along with ways to stop them.
Elmer-Dewitt, Phillip "Invasion of the Data Snatchers!." Time
Magazine vol 123 no. 13 September 26, 1988 pp. 62-67 Discusses the
current threat to computer systems posed by computer viruses.
Computer viruses are defined and several examples of viruses are
given.
Epner, S.A. "Computer Security: Plenty of Questions but No Easy
Answers." Office vol 101 no. 3 March 1985 pp. 74-76 This article covers
the physical security of computer equipment including air conditioning
and power to pass cards and security guards.
Edwards, J. "Ends in Sight for the Copy-Protection Debate." PC Week
vol 3 no. 1 January 1986 pp. 101 & 105 This protection of software
from unauthorized use may be coming to an end as Microsoft
Corporation has decided to lift the protection from several of its
software programs.
Federal Information Processing Standards Publication 83, Guideline on
User Authentication Techniques for Computer Network Access Control.
National Bureau of Standards, Sept, 1980.
Federal Information Processing Standards Publication 73, Guidelines
for Security of Computer Applications; National Bureau of Standards,
June, 1980.
Federal Information Processing Standards Publication 112, Password
Usage. National Bureau of Standards, May, 1985.
Federal Information Processing Standards Publication 87, Guidelines
for ADP Contingency Planning; National Bureau of Standards, March,
1981.
Fiedler, David and Hunter, Bruce M. UNIX System Administration.
Hayden Books, 1987
Fisher, M.J. "New Security Device "Fingers" Culprit." MIS Week vol 6
no. 35 September 1985 pp. 12 This article describes a new product that
uses a fingerprint device to verify a user's identity and then allow
access on the computer system.
Fisher, Sharon "DARPA Sets Up Response Teams to Tackle ARPANET
Emergencies" InfoWorld, March 20, 1989, p. 43.
Fitzgerald, Jerry. Business Data Communications: Basic Concepts,
Security, and Design. John Wiley and Sons, Inc., 1984
Flach, Joseph P. "Increasing Programming Efficiency While Preventing
the "F" Word." Data Processing & Communications Security vol 11 no.
4 Fall 1987 pp. 15-17 This article gives examples of ways to identify
fraudulent code in a production program.
Flynn, L. "Data Security: How Much is Too Much?" InfoWorld, March
20, 1989, p. 41-43.
Fong, Elizabeth A Data Base Management Approach To Privacy Act
Compliance June 1977 NBS SPEC PUB 500-10 Discusses how
commercially available data base management systems can be used to
implement Privacy Act requirements for the handling of personal data.
Forensic Accounting Review Monthly Newsletter From Computer
Protection Systems, Inc. 150 N. Main Street Plymouth, MI 48170 (313)
459-8787 $110.00 Annually This newsletter takes an in-depth look at
the problems of computer fraud and provides possible solutions.
Gait, Jason Maintenance Testing For The Data Encryption Standard
August 1980 NBS SPEC PUB 500-61 Describes four tests that can be
used by manufacturers and users to check the operation of data
encryption devices. These tests are simple, efficient, and independent
of the implementation of the Data Encryption Standard (FIPS 46).
Gait, Jason Validating The Correctness Of Hardware Implementations
Of The Nbs Data Encryption Standard November 1977 NBS SPEC
PUB 500-20 Describes the design and operation of the NBS testbed
that is used for the validation of hardware implementations of the
Data Encryption Standard (DES). This report provides the full
specification of the DES algorithm, a complete listing of the DES test
set and a detailed description of the interface to the testbed.
GAO: "Financial Integrity Act: Actions Needed to Correct ADP
Internal Control Weaknesses"
GAO: "Computer Security: Compliance with Training Requirements of
the Computer Security Act of 1987"
Gasser, Morrie. Building a Secure Computer System. Van Nostrand
Reinhold, New York, 1988.
Gaydasch, Alexander "Postimplementation Audits - A Quick, Easy
Approach." Data Management vol no. February 1983 pp. 54, 55, 69
This article describes post- implementation audits and how they help
to determine whether a computer system has met its original criteria.
Gazarek, Kenneth F. "Cabinets for Electromagnetic
Interference/Radio-Frequency Interference and TEMPEST Shielding."
Data Processing & Communications Security vol 9 no. 6 July/August
1985 pp. 12-13 This article discusses the electromagnetic interference
and radio-frequency interference control options, designing and
building metal cabinets that provide effective shielding.
Gilgor, V.D. On the Design and the Implementation of Secure Xenix
Workstation IEEE Symposium on Security and Privacy, April 1987.
Glossary For Computer Systems Security February 1974 FIPS PUB 39
Evaluating security of computer systems. A reference document
containing approximately 170 terms and definitions pertaining to
privacy and computer security.
Goldstein, Bruce "Information Security: The Information Resource
Management." Approach Data Processing & Communications Security
vol 8 no. 5 May/June 1984 pp. 18-22 This article addresses information
as a asset that must be protected as any other asset. It also discusses
information research management providing the framework for a
comprehensive information security program.
Grampp, F.T. and Morris, R. H. "UNIX Operating System Security".
AT&T Bell Laboratories Technical Journal, Oct 1984.
Guidelines For Adp Contingency Planning FIPS PUB 87 March 1981
Describes what should be considered when developing a contingency
plan for an ADP facility. Provides a suggested structure and format
which may be used as a starting point from which to design a plan to
fit each specific operation.
Guidelines For Adp Physical Security And Risk Management June 1974
FIPS PUB 31 Provides guidance to Federal organizations in developing
physical security and risk management programs for their ADP
facilities. Covers security analysis, natural disasters, failure of
supporting utilities, system reliability, procedural measures and
controls, protection of off-site facilities, contingency plans security
awareness, and security audit. Can be used as a checklist for planning.
Guidelines For Automatic Data Processing Risk Analysis FIPS PUB 65
August 1979 Presents a technique for conducting a risk analysis of an
ADP facility and related assets. Provides guidance on collecting,
quantifying, and analyzing data related to the frequency of caused by
adverse events. This guideline describes the characteristics and
attributes of a computer system that must be known for a risk analysis
and gives an example of the risk analysis process.
Guideline For Computer Security Certification And Accreditation FIPS
PUB 102 September 1983 Describes how to establish and how to carry
out a certification and accreditation program for computer security.
Certification consists of a technical evaluation of a sensitive system to
see how well it meets its security requirements. Accreditation is the
official management authorization for the operation of the system and
is based on the certification process.
Guideline On Electrical Power For Adp Installations FIPS PUB 94
September 1982 Provides information on factors in the electrical
environment that affect the operation of ADP systems. Describes the
fundamentals of power, grounding, life-safety, static electricity, and
lightning protection requirements, and provides a checklist for
evaluating ADP sites.
Guidelines On Evaluation Of Techniques For Automated Personal
Identification FIPS PUB 48 April 1977 Discusses the performance of
personal identification devices, how to evaluate them and
considerations for their use within the context of computer system
security.
Guidelines For Security Of Computer Applications FIPS PUB 73 June
1980 Describes the different security objectives for a computer
application, explains the control measures that can be used, and
identifies the decisions that should be made at each stage in the life
cycle of a sensitive computer application. For use in planning,
developing and operating computer systems which require protection.
Fundamental security controls such a data validation, user identity
verification, authorization, journalling, variance detection, and
encryption are discussed.
Guidelines For Implementing And Using The Nbs Data Encryption
Standard FIPS PUB 74 April 1981 Provides guidance for the use of
cryptographic techniques when such techniques are required to protect
sensitive or valuable computer data. For use in conjunction with FIPS
PUB 46 and FIPS PUB 81.
Guidelines On Integrity Assurance And Control In Database
Applications FIPS PUB 88 August 1981 Provides explicit advice on
achieving database integrity and security control. Identifies integrity
and security problems and discusses procedures and methods which
have proven effective in addressing these problems. Provides an
explicit, step-by-step procedure for examining and verifying the
accuracy and completeness of a database.
Guidelines On User Authentication Techniques For Computer Network
Access Control FIPS PUB 83 September 1980 Provides guidance in the
selection and implementation of techniques for authenticating the
users of remote terminals in order to safeguard against unauthorized
access to computers and computer networks. Describes use of
passwords, identification tokens, verification by means of personal
attributes, identification of remote devices, role of encryption in
network access control, and computerized authorization techniques.
Hagopian, Greg "Planning and Implementing a Security Package."
Data Processing & Communications Security vol 10 no. 4 Fall 1986 pp.
17-20 This article discusses vendor selection and legal issues.
Harris, N.L. "Rigid Administrative Procedures Prevent Computer
Security Failure." Data Management vol 22 no. 12 December 1984 pp.
13-14, 16 The best way to keep a security program from failing is the
use of strict administrative procedures. This article also discusses why
some systems fail.
Harrison, M.A. and Ruzzo, W.L. Protection in Operating Systems
Comm of the ACM, Aug 1976.
Helsing, Cherly W. "Disaster Recovery Options." Security vol 24 no. 7
July 1987 pp. 100-103 This article has suggestions on how to find a
recovery plan that fits your firm without damaging your profits.
Highland, Harold J. "From the Editor -- Computer Viruses." Computers
& Security, Aug 1987.
Holtzman, Henry "Keeping Your Offices Safe and Sound" Modern
Office Technology, May 1985 pp 92 ff.
Highland, Harold J. Protecting Your Microcomputer System. John
Wiley & Sons, Inc. N.Y.1984
Horgan, J. "Thwarting The Information Thiefs." IEEE Spectrum vol 22
no. 7 July 1985 pp. 30-41 Many organizations are protecting their
communication output from electronic interception by trying to detect
and foil the surveillance using a variety of methods.
Hutton's Building System and Controls Catalog From Hutton
Publishing Co., Inc. 1988 Environmental Security Free This catalog
provides a wide variety of environmental computer security related
products and services.
Industrial Security Letter Irregular Newsletter From Defense
Investigative Service Directorate for Industrial Security 1900 Half
Street, SW Washington, D.C. 20324 Free to qualified readers. This
newsletter provides operating procedures for the Defense Industrial
Security Program (DISP) operations at cleared facilities.
Inglesby, Tom "Fighting Flash 'n' Flicker" Infosystems November, 1984,
pp 88 ff.
Internal Auditor Bimonthly Journal From Institute of Internal
Auditors 249 Maitland Avenue Altamonte Springs, FL 32701 (305)
830-7600 $24.00 Annually This journal looks at techniques and
principles of internal control and auditing.
Israel, Howard "Computer Viruses: Myth or Reality?". Proceeding of
the 10th National Computer Security Conference, Gaithersburg MD,
Sept 1987.
Isaac, Irene Guide On Selecting Adp Backup Process Alternatives NBS
SPEC PUB 500-134 November 1985 Discusses the selection of ADP
backup processing support in advance of events that cause the loss of
data processing capability. Emphasis is placed on management support
at all levels of the organization for planning, funding, and testing of an
alternate processing strategy. The alternative processing methods and
criteria for selecting the most suitable method are presented, and a
checklist for evaluating the suitability of alternatives is provided.
Jackson, Carl B. "Passwords: Comments from the Information Systems
Security Association." Security vol 24 no. 7 July 1987 pp. 105 Discusses
relevant security issues and how to bring an appropriate degree of
LAN information security to your organization.
Johnson, B. "Criminal Minds Keep Pace with Technology. Stop, Thief!."
Computerworld vol 15, 16 no. 52, 1 December 28, 1981, January 4,
1982 pp. This article looks at some of the common problems that the
DP industry faces today including computer security, asset protection,
and computer fraud prevention.
Johnston, R.E. "What You Need To Know." Infosystems vol 32 no. 1
January 1985 pp. 56 Outlined in this article are those things that
should be considered when establishing a computer security program
or updating an existing program.
Johnston, Stuart J. "Microsoft OS/2 LAN Manager: Network Access
Control Issues Remain" InfoWorld, March 20, 1989, p. 42.
Jordan, Halmuth "The Search for Privacy." Security Management vol
31 no. 11 November 1987 pp. 32-36 This article focuses on some of the
difficulties the legal profession is having by looking at American and
West German law regarding electronic surveillance.
Joseph, Mark K. "Toward the Elimination of the Effects of Malicious
Logic: Fault Tolerance Approaches" Proceeding of the 10th National
Computer Security Conference, Gaithersburg MD, Sept 1987
Journal of the National Classification Management Society Annually
Journal From National Classification Management Society, Inc. 6116
Roseland Drive Rockville, MD 20852 (301) 231-9191 Free to Members
Only Identifies communications and information processing systems
their vulnerabilities and a range of methods for improving the security
of these systems.
Karser, Paul A. "Limiting the Damage Potential of Discretionary
Trojan Horses" Proceedings of the Symposium on Security and Privacy
1987 Oakland CA, Published by the IEEE.
Kluepfel, Henry M. "Computer Security for the Abuser Friendly
Environment." Data Processing & Communications Security vol 9 no. 2
November/December 1984 pp. 16-20 This article discusses the
underlying lack of adequate controls in computer systems and their
relation to computer abuse and crime.
Koelle, Jim "What's in the Cards?." Security vol 23 no. 12 December
1986 pp. 42-44, and 46 This article discusses microchips and how they
promise to revolutionize access card technology with fast, calculating,
and advanced memories.
Kontur, J.S. and Letham, L. "Locking Up System Security." Electronic
Week vol 58 no. 7 February 18, 1985 pp. 68-72 This article describes a
system that cannot be broken into by unauthorized users. It uses a
random-number generator and encryption logic.
Korzeniowski, P. "Security Dynamics Releases Two-Part Security
System." Computerworld vol 19 no. 42 October 1985 pp. 19, 23 This
article discusses a product Security Dynamics has designed that is an
inexpensive security protection device which keeps hackers out of
systems.
Korzeniowski, P. "ADAPSO Making Progress on Software Protection
Device." Computerworld vol 19 no. 24 June 1985 pp. 8 This article
discusses how the Association of Data Processing Service Organizations
(ADAPSO) is getting ready to announce its progress in creating a
software authorization mechanism.
Kull, D. "How to Make Even E.F. Hutton Listen." Computer Decisions
vol 17 no. 18 September 1985 pp. 42-50 The most effective way for an
organization to prevent breaches in a computer system is to plug the
holes that have already been used to violate the system and identify
the intruders.
Lapid, Ahituv, and Newmann "Approaches to Handling 'Trojan Horse'
Threats" Computer & Security Sept 1986.
LaPlante, Alice "Study Finds IS Managers Are More People-Oriented"
InfoWorld, March 20, 1989, p.5
Lasden, Martin "Computer Crime." Computer Decisions vol no. June
1981 pp. 104-106, 108 112, 116, 118, 120, 122, 124 This article
discusses actual computer crimes that have taken place and the factors
that escalate the risk of an organization from these types of crime.
Lemke, Fred H. "Blackouts and Computer Power Protection." Data
Processing & Communications Security vol 12 no. 2 Spring 1988 pp.
19-23 This article is a study that was taken to see emerging patterns
of blackouts that may be useful in helping evaluate your level of
blackout vulnerability and then set up appropriate levels of power
protection for your electronic systems.
Lemke, Fred H. "Computer Power Protection." Data Processing &
Communications Security vol 8 no. 4 March/April 1984 pp. 31-33 This
article gives examples of how to protect your facility against the
harmful effects of an electrical power outage.
Leuser, K.G. "Security Programs: Only as Good as We Make Them."
Office vol 100 no. 2 August 1984 pp. 91-92 Discusses how an effective
security program helps to foil or discourage people with dishonest
intentions. Looks at the office administrator's domain to identify areas
of potential vulnerability.
Levitt, Karl N., Peter Neumann, and Lawrence Robinson The SRI
Hierarchical Development Methodology (HDM) And Its Application To
The Development Of Secure Software October 1980 NBS SPEC PUB
500-67 Describes the SRI Hierarchical Development Methodology for
designing large software systems such as operating systems and data
management systems that must meet stringent security requirements.
Linden, Jack "Automated EDP Risk Analysis and Management." Data
Processing & Communications Security vol 9 no. 1 September/October
1984 pp. 16-18 This article gives a cost effective first step in developing
a successful computer security program using a cost benefit analysis
approach.
Lobel, J. "Third Decade of Concern." Computerworld vol 16 no. 6
February 8, 1982 pp. 1D/31-34 & 36 The author looks at some of the
issues associated with distributed data processing including privacy,
crime, and security.
Longley, Dennis and Shain, Michael. Data and Computer Security
Lucas, D. "The Invisible Enemy." Business Computing and
Communication vol no. February 1985 pp. 18-20 This article describes
how home computer users are breaking into some of Britain's
mainframe computers. Various procedures that can protect against
intrusion are also discussed by the author.
Lundell, Allan. A video based on his book VIRUS! called VIRUS! The
Video. Write him at 175 Flintrock Lane, Ben Lomond, CA 95005.
McCarthy, Charles J. "Passwords." Data Processing & Communications
Security vol 10 no. 4 Fall 1986 pp. 13-14 This article discusses the two
primary password configurations passwords defined by user, and
passwords assigned to a user. It shows the differences between these
two from a security view.
McGowan, Kevin J. "Computer Power Protection." Data Processing &
Communications Security vol 9 no. 5 May/June 1985 pp. 21-25 This
article looks at understanding AC power conditions in data processing
site preparation and its criticality for preventing future computer
downtime and disruptions.
McKibbin, W.L. "Who Gets The Blame For Computer Crime."
Infosystems vol 30 no. 7 July 1983 pp. 34-36 MIS managers are
ultimately responsible for the security of their computers. Since they
are responsible they should make sure upper management is aware of
the vulnerabilities of their computers.
McLellan, Vin "Computer Systems Under Siege" The New York
Times, January 31, 1988.
Meason, Robert "System Security at the Terminal." Data Processing &
Communications Security vol 10 no. 4 Fall 1986 pp. 16-17 This article
discusses considerations of MIS management protection of the
processor from access by unauthorized users.
Menkus, Belden "Agencies Fail to Appreciate Threat to Data Security"
Government Computer News, April 29, 1988, p. 36.
Miskiewicz, J. "DP Security: A Delicate Balance." Computer Decisions
vol 17 no. 8 April 1985 pp. 104-106 This article discusses the delicate
balance between protecting vital resources in a data processing facility
and enhancing productivity.
Minoli, D. "Backup Needs Merit Special Attention." Computerworld vol
19 no. 15 April 1985 pp. 91, 96 This article focuses on the merits of
backing up a data center to prevent a major disaster from critically
affecting a company.
Moore, Gwendolyn B., John L. Kuhns, Jeffrey L. Treffzs and Christine
A. Montgomery Accessing Individual Records From Personal Data Files
Using Nonunique Identifiers NBS SPEC PUB 500-2 February 1977
Analyzes methodologies for retrieving personal information using
nonunique identifiers such as name, address, etc. This study presents
statistical data for judging the accuracy and efficiency of various
methods.
Moulton, R. "Prevention: Better Than Prosecution." Government Data
Systems vol 10 no. 6 November/December 1981 pp. 20 & 22-23 The
focus of this paper is on deterrence of computer abuse, whether it is
unintentional or intentional.
Munro, N. & Danca, R.A. "Federal Officials Puzzled by Computer Virus
Attacks", Government Computer News, April 29, 1988.
Murray, W.H. "Security Considerations for Personal Computers," IBM
System Journal, Vol. 23, No. 3 (1984), pp. 297-304.
Murray, W.H. "Security Risk Assessment in Electronic Data Processing
Systems," IBM Publication Number G320-9256-0 (1984).
Murray, W.H. "Good Security Practices for Information Systems
Networks," IBM Publication Number G360-2715-0 (1987).
Murray, W.H. "An Executive Guide to Data Security," IBM Publication
Number G320-5647-0 (1975).
Murray, W.H. "Security, Auditability, System Control Publications
Bibliography," IBM Publication Number G320-9279-2 (1987).
Muzerall, Joseph V. and Carty, Thomas J. "COMSEC and Its Need for
Key Management." Data Processing & Communications Security vol 11
no. 2 Spring 1987 pp. 11-14 This article explains the establishment of
a standard set of protection mechanisms for both the classified and
private user communities.
Mylott, T.R. "Computer Security and the Threats from Within." Office
vol 101 no. 3 March 1985 pp. 45-46, 190 This article explains that the
greatest computer-related danger to a company may be from internal
threats by employees.
National Computer Security Center, Personal Computer Security
Considerations December, 1985. NCSC-WA-002-85.
National Institute of Justice NIJ Reports Bimonthly Journal From
National Criminal Justice Reference Service Box 6000 Rockville, MD
20850 (301) 251-5500 Free to registered users of the NIJ. This journal
provides summaries of research reports to help keep you up to date
with advances in the field of criminal justice.
NBS Special Publication 500-120. Security of Personal Computer
Systems: A Management Guide. National Bureau of Standards, Jan
1985.
Neugent, William, John Gilligan, Lance Hoffman, and Zella G.
Ruthberg Technology Assessment; Methods For Measuring The Level Of
Computer Security October 1985 NBS SPEC PUB 500-133 The
document covers methods for measuring the level of computer security,
i.e. technical tools or processes which can be used to help establish
positive indications of security adequacy in computer applications,
systems, and installations. The report addresses individual techniques
and approaches, as well as broader methodologies which permit the
formulation of a composite measure of security that uses the results of
these individual techniques and approaches.
Nicolai, Carl "Encryption Decyphered" Computers and Electronics, June
1984, pp 64 ff.
NIST Special Publication 500-166. Computer Viruses and Related
Threats: A Management Guide. National Institute of Standards and
Technology, Aug 1989. Available from Superintendent of Documents,
U.S. Government Printing Office, Washington, D.C. 20402. Order by
stock no. 003-003-02955-6 for $2.50 prepaid. Editors and reporters can
get a copy from the NIST Public Information Division, 301/975-2762.
The guide is intended to help managers prevent and deter virus
attacks, detect when they occur, and contain and recover from an
attack. It provides general guidance for management and users, plus
more specific guidance for multi-user computer environments and for
personal computer environments. It also contains a list of suggested
readings.
Orceyre, Michel J. and Robert H. Cortney, Jr. Edited by Gloria R.
Bolotsky Considerations In The Selection Of Security Measures Of
Automatic Data Processing Systems Details methods and techniques for
protecting data NBS SPEC PUB 500-33 processed by computer and
transmitted via telecommunications lines. This report identifies the
controls that can be instituted to protect ADP systems when risks and
potential losses have been identified.
Parker, D.B. "The Many Faces of Data Vulnerability." IEEE Spectrum
vol 21 no. 5 May 1984 pp. 46-49 Discussed in this paper are both the
need for new computer security methods and the attainable limits that
can be reached by computer security.
Parker, T. "Public domain software review: Trojans revisited,
CROBOTS, and ATC." Computer Language. April 1987.
Patrick, Robert L. Performance Assurance And Data Integrity Practices
January 1978 NBS SPEC PUB 500-24 Details practices and methods
that have been successful in preventing or reducing computer system
failures caused by programming and data errors. The methods
described cover large data processing applications, scientific computing
applications, programming techniques and systems design.
Personal Identification News Monthly Newsletter From Personal
Identification News P.O. Box 11018 Washington, DC 20008 (202)
364-8586 $265.00 Annually This newsletter discusses advanced access
control technologies including plastic cards and authentication to
biometrics.
Pieper, Oscar R. "Voice Authentication Wages A War on Data Base
Fraud." Data Processing & Communications Security vol 8 no. 6
July/August 1984 pp. 12-13 This article reviews the present state of
voice authentication technology and how it applies to secure data bases
from bogus intruders.
Police & Security Bulletin Monthly Newsletter From Lomond
Publications P.O. Box 88 Mt.Airy, MD 21771 (301) 829-1496 $72.00
Annually This newsletter is designed for specialist in law enforcement,
criminal justice and security.
Power, Kevin "Over Half of Agencies Meet Security Training
Deadline" Government Computer News, May 15, 1989, p. 85.
Pozzo, M.M., Gray, T.E. "An approach to containing computer viruses"
Computer & Security, Aug 1987.
Pozza, M.M., Gray, T.E. "Managing Exposure to Potentially Malicious
Rograms" Proceeding of the 9th National Computer Security
Conference, Gaithersburg MD, Sept 1986.
Privacy Journal Monthly Journal From Privacy Journal P.O. Box
15300 Washington, DC 20003 (202) 547-2865 $89.00 Annually This
journal looks at privacy issues and how they relate to all levels of
government and private sectors.
Pujals, J.M. "What is a Contingency Plan?." Data Processing &
Communications Security vol 12 no. 1 Winter 1988 pp. 19-23 This
article tells how to construct a contingency plan and goes over the
major mandatory steps that have to be taken to end up with a
workable product.
Raimondi, D. "E.F. Hutton Underscores Practicality in Backup Plan."
Computerworld vol 19 no. 15 April 1985 pp. 19 Describes how E.F.
Hutton has built a new computer room as part of its disaster recovery
plan.
Rames, David "Recovering From Disasters." Computer Decisions vol no.
September 1981 pp. 108-110, 112, 114, 120, 122, 124, 126-131, 188-189
Described in this article are criteria for developing an emergency
backup plan and examples of emergency backup alternatives.
Reber, Jan "The Essence of Industrial Espionage." Data Processing &
Communications Security vol 10 no. 1 Winter 1986 pp. 24-25 This
article discusses understanding espionage by a characteristic all spies
have in common "access to the target".
Reeds, J. A. and Weinberger, P. J. "File Security and the UNIX
Systems Crypt Command" AT&T Bell Laboratories Journal, Oct 1984
Reid, T. R. "Fending Off a 'Computer Virus' Means Taking Only a
Few Precautions" Washington Post, Feb 15, 1988.
Rhodes, B. "Micro Security That Makes Sense." Computer Decisions vol
17 no. 9 May 1985 pp. 72, 74-76 This article describes security
procedures that can be used by employees to solve microcomputer
security problems.
Risk Management Manual (3 Volumes) From The Merrit Company
1985 (Bimonthly Supplements) Risk Management $283.00 This manual
provides easy-to-understand fundamentals and specifics for initiating
and maintaining a risk management program.
Roberts, J.E. "Filing Software Copyrights." Computerworld vol 19 no.
36 September 1985 pp. 116 This article describes how copyrighting
software is accomplished and what copyrighted software means.
Roberts, Ralph. Computer Viruses COMPUTE! Publications Inc., 1989.
Rosch, W. "Three Products Help Cork Computer Leaks, Feature
Blocked Access, Disk-File Encryption." PC Week vol 2 no. 18 May 1985
pp. 122-124 This article discusses a trio of products to help prevent
unauthorized access to a computer system.
Rosch, Winn L. "Internal Security" PC Week May 7, 1985 pp 89 ff.
Rosen, Richard D. and Dvorsky, James "Portable Data Carrier
Technology." Data Processing & Communications Security vol 12 no. 1
Winter 1988 pp. 9-19 This article presents an overview of the general
field of portable data carrier technology. Included are not only smart
cards but other devices and systems that are beginning to emerge in
the marketplace.
Rosenthal, Lynne S. Guideline on Planning and Implementing
Computer Systems Reliability NBS Spec PUB 500-121 January 1985
This report presents guidance to managers and planners on the basic
concepts of computer system reliability and on the implementation of a
management program to improve system reliability. Topics covered
include techniques for quantifying and evaluating data to measure
system reliability, designing systems for reliability, and recovery of a
computer system after it has failed or produced erroneous output. An
appendix contains references and a list of selected readings.
Ruder, Brian and J. D. Madden An Analysis Of Computer Security
Safeguards For Detecting And Preventing Intentional Computer Misuse
January 1978 NBS SPEC PUB 500-25 Analyzes 88 computer safeguard
techniques that could be applied to recorded actual computer misuse
cases. Presents a model for use in classifying and evaluating
safeguards as mechanisms for detecting and preventing misuse.
Ruthberg, Zella G. Audit And Evaluation Of Computer Security Ii:
System Vulnerabilities And Controls April 1980 NBS SPEC PUB
500-57 Proceedings of the second NBS/GAO workshop to develop
improved computer security audit procedures. Covers eight sessions:
three sessions on managerial and organizational vulnerabilities and
controls and five technical sessions on terminals and remote
peripherals, communication components, operating systems,
applications and non-integrated data files, and data base management
systems.
Ruthberg, Zella and Bonnie Fisher Work Priority Scheme For Edp
Audit And Computer Security Review August 1986 NBSIR 86-338 This
publication describes a methodology for prioritizing the work performed
EDP auditors and computer security reviewers. Developed at an
invitational workshop attended by government and private sector
experts, the work plan enables users to evaluate computer systems for
both EDP audit and security review functions and to develop a
measurement of the risk of the systems. Based on this measure of risk,
the auditor can then determine where to spend review time.
Ruthberg, Zella and Robert McKenzie (editors) Audit And Evaluation
Of Computer Security October 1977 NBS SPEC PUB 500-19 Reports on
the recommendations of audit and computer experts to improve
computer security audit procedures. Subjects covered include audit
standards, administrative and physical controls, program and data
integrity, and audit tools and techniques.
Ruthberg, Zella G. and William Neugent Overview Of Computer
Security Certification And Accreditation April 1984 NBS SPEC PUB
500-109 This publication is a summary of and a guide to FIPS PUB
102, Guideline to Computer Security Certification and Accreditation. It
is oriented toward the needs of ADP policy managers, information
resource managers, ADP technical managers, and ADP staff in
understanding the certification and accreditation process.
Rutz, Frank "DOD Fights Off Computer Virus" Government Computer
News Feb 5, 1988.
Samuel, J. "Defense Net Broken Into - Again", Communications Week,
December 5, 1988, p.1
Schabeck, Timothy A. Computer Crime Investigation Manual From
Assets Protection 1980 Abuse/Misuse/Crime $39.95 Clear and precise
overview of computer hardware, software, operations, and job
functions.
Schiller, Michael "Security at the Touch of a Finger." Data Processing
& Communications Security vol 9 no. 6 July/August 1985 pp. 15-17
This article discusses using biometric security systems for high-tech
solutions to access control problems.
Schmonsees, Robert J. "Identification and Authentication: The Security
Challenge of the 80's." Data Processing & Communications Security vol
9 no. 4 March/April, 1985 pp. 22-23 This article discusses the computer
security issues of identification and authentication showing the
common problems and offering some suggestions for improving by
random passcode.
Schnaidt, Patricia. "Fasten Your Safety Belt". LAN Magazine, Oct
1987.
Schriever, Joe F. "Structuring for Security." Data Processing &
Communications Security vol 9 no. 1 September/October 1984 pp. 14-16
This article is a set of guidelines that will remove ambiguities as to
what will be done by whom to provide system security.
Schweig, Barry B. "Decision Matrix: A Risk Handling Decision Aid."
Data Processing & Communications Security vol 8 no. 4 March/April
1984 pp. 16-18 This article discusses conceptualizing a decision-matrix
as an integral component of a risk management process.
Scoma, Louis "How Secure Is Your Computer Operation From A
Disaster." Office vol no. August 1981 pp. 96, 98 The failures of
companies to protect their computer centers is discussed along with the
need for recovery systems to serve as backup security.
Security Monthly Magazine From Cahners Publishing Company 275
Washington Street Newton, MA 02158 (617) 964-3030 Free to qualified
readers. This magazine is written for the industrial and commercial
loss-prevention specialist.
Security Awareness Bulletin Irregular Bulletin From Department of
Defense Security Institute (DoDSI) C/O Defense General Supply
Richmond, VA 23297-5091 Free Discusses security awareness and
compliance with security procedures through dissemination of
information to security trainers.
Security Dealer Monthly Magazine From PTN Publishing Co. 210
Crossways Park Drive Woodbury, NJ 11797 (517) 496-8000 $10.00
Annually This magazine contains articles relating to security products
and general security procedures.
Security Distributing & Marketing Monthly Magazine From Cahners
Publishing Company 275 Washington Street Newton, MA 02158 (617)
964-3030 Free to qualified readers. This magazine is written for
dealers, distributors, and installers of loss prevention equipment,
including crime and fire prevention and detection products and
services.
Security Letter Biweekly Newsletter From Security Letter, Inc. 166
East 96th Street New York, NY 10128 (212) 348-1553 $147.00
Annually This newsletter looks at industrial and commercial security,
and emphasizes not only corporate security planning but also physical
security systems and personnel security.
Security Management Monthly Magazine From American Society for
Industrial Security 1655 N. Ft. Meyer Drive Suite 1200 Arlington, VA
22209-3198 (703) 522-5800 $65.00 Annually This magazine was written
for managers in charge of both security and loss prevention.
Security Systems Monthly Magazine From PTN Publishing Company
210 Crossways Park Drive Woodbury, NJ 11797 (516) 496-8000 Free to
qualified readers. This magazine covers topics of interest to the
professional security director- industrial, governmental, institutional, or
retail.
Security Systems Digest Biweekly Digest From Washington Crime
News Service 7043 Wimsatt Road Springfield, VA 22151-4070 (703)
941-6600 $95.00 Annually This digest provides news on the latest
developments in security systems.
Shaw, James K. and Stuart W. Katzke Executive Guide To Adp
Contingency Planning July 1981 NBS SPEC PUB 500-85 This
document provides, in the form of questions and answers, the
background, and basic essential information required to understand the
developmental process for automatic data processing (ADP) contingency
plans. The primary intended audience consists of executives and
managers who depend on ADP resources and services, yet may not be
directly responsible for the daily management or supervision of data
processing activities or facilities.
Shoch, J.F and Hupp, J.A. "The 'Worm' Programs: Early Experience
with a Distributed Computation". Communications of the ACM, Mar
1982.
Shabeck Computer Crime Investigation A comprehensive manual for
investigating computer crimes. 380 pp $39.95 Computer Protection
Systems.
Shabeck Emergency Planning Guide for Data Processing Centers
Provides information necessary for preparing an effective
emergency/disaster plan for your organization. 92 pp $10. Computer
Protection Systems.
Shabeck Managing Microcomputer Security Addresses security in a
wide variety of micro settings. 180 pp $25. Computer Protection
Systems.
Shannon, Terry C., Technical Editor Computer Security Handbook: The
Practitioner's "Bible" From Computer Security Institute 1985 General
Security $95.00 Contains a number of articles and technical papers
dealing with computer security issues such as training and security
safeguards.
Sharp, Brown "Computer Viruses Invade a Low-Immunity Congress.
Government Computer News, September 4, 1989, p. 11.
Shoch, J. F. and Hupp, J. A. "The Worm Programs: Early Experience
with a Distributed Computation" Communications of the ACM, Mar
1982.
Shoop, Tom & David J. Stang "Beating Back a Virus Attack"
Government Executive, April, 1990, p. 40 ff.
Smid, Miles E. A Key Notarization System For Computer Networks
October 1979 NBS SPEC PUB 500-54 Describes a system for key
notarization, which can be used with an encryption device, to improve
data security in computer networks. The key notarization system can
be used to communicate securely between two users, communicate via
encrypted mail, protect personal files, and provide a digital signature
capability.
Software Protection Monthly Journal From Law and Technology Press
P.O. Box 3280 Manhattan Beach, CA 90266 (213) 470-9976 $187.00
This journal provides current developments oriented around software
protection methods, products, and services.
Spafford, Eugene H. "The Internet Worm Program: An Analysis".
Purdue Technical Report CSD-TR-823, Nov 28, 1988.
Srinivasan, C.A. and Dascher, P.E. "Computer Security and Integrity:
Problems and Prospects." Infosystems vol 28 no. 5 May 1981 pp. 5
Pages Various aspects of computer security are discussed including
data security, data privacy, data integrity, etc.
Standard On Computer Data Authentication FIPS PUB 113 May 1985
This standard specifies a Data Authentication Algorithm (DAA) which,
when applied to computer data, automatically and accurately detects
unauthorized modifications, both intentional and accidental. Based on
the Data Encryption Standard (DES), this standard is compatible with
requirements adopted by the Department of Treasury and the banking
community to protect electronic fund transfer transactions.
Standard On Password Usage FIPS PUB 112 May 1985 This standard
defines ten factors to be considered in the design, implementation and
use of access control systems that are based on passwords. It specifies
minimum security criteria for such systems and provides guidance for
selecting additional security criteria for password systems which must
meet higher security requirements.
Stang, David J. Computer Security National Computer Security
Association, Washington, D.C. 1990. Revised every three months or
more often.
Stang, David J. Computer Viruses National Computer Security
Association, Washington, D.C. 1990. Revised every three months or
more often.
Stang, David J. Defend Your Data! A Guide to Data Recovery National
Computer Security Association, Washington, D.C. 1990. Revised every
three months or more often.
Stang, David J. "How to Sell Data Integrity" Reseller Management,
March 1990, p. 131ff.
Stang, David J. "PC Viruses: The Desktop Epidemic" The Washington
Post, January 14, 1990, p. B3.
Steinauer, Dennis D. Security Of Personal Computer Systems - A
Management Guide NBS SPEC PUB 500-120 This publication provides
practical advice on the following issues: physical and environmental
protection system and data access control; integrity of software and
data; backup and contingency planning; auditability; communications
protection. References to additional information, a self-audit checklist,
and a guide to security products for personal computers are included in
the appendices.
Stieglitz, M. "Security For Shared Resources." Micro Communications
vol 2 no. 6 June 1985 pp. 19-26 This article discusses data security
products and procedures for network use. Includes description of
encryption techniques that are now popular.
Sugawara, S. "Report Says Computers Are at Risk. Government Told
to Tighten Security" The Washington Post, November 22, 1988, p. C1,
C2.
Taft, Darryl K. "Computer Security Center Sees Opportunity in UNIX"
Government Computer News, September 4, 1989, p. 68.
Thompson, Ken. "Reflections on Trusting Trust (Deliberate Software
Bugs)" Communications of the ACM, Vol 27, Aug 1984.
Tinto, Mario. "Computer Viruses: Prevention, Detection, and
Treatment." National Computer Security Center C1 Tech. Rpt.
C1-001-89, June 1989.
Troy, Eugene F. Security For Dial-up Lines May 1986 NBS SPEC PUB
500-137 Ways to protect computers from intruders via dial- up
telephone lines are discussed in this guide. Highlighted are hardware
devices which can be fitted to computers or used with their dial-up
terminals to provide communications protection for non-classified
computer systems. Six different types of hardware devices and the
ways that they can be used to protect dial-up computer
communications are described. Also discussed are techniques that can
be added to computer operating systems or incorporated into system
management or administrative procedures.
U.S. Government Telecommunications: General Security Requirements
for Equipment Using the Data Encryption Standard Federals Standard
1027.
Vernick, Paul R. "Providing Data Processing Recovery Backup." Data
Processing & Communications Security vol 9 no. 4 March/April, 1985
pp. 14-16 This article covers some of the major emergency and recovery
planning options available that need to be considered prior to the
occurrence of any serious emergency.
Walsh, Timothy J. and Healy, Richard J. Protection of Assets (4
Volumes) From The Merrit Company 1974 (Updated Monthly) General
Security $285.00 This manual helps you design and maintain an
effective, cost saving, on-going program for total assets protection.
Weber, A. "Effective Security Programs Start with Awareness." Data
Management vol 23 no. 11 November 1985 pp. 34-35 Educating end
users is the key to helping prevent crime and computer abuse in an
organization.
Weixel, S. "Most accidents happen when companies neglect the basics."
ComputerWorld, March 13, 1989, p.83.
Weller, Reginald H. "Off-Site Data Storage: A Changing Industry."
Data Processing & Communications Security vol 9 no. 5 May/June 1985
pp. 18-20 This article discusses selecting a backup site while meeting
the criteria of integrity, reliability, access, reasonable cost, appropriate
location, good security, and comprehensive insurance coverage.
Westin, Alan F. ERS, Personnel Administration, And Citizen Rights
NBS SPEC PUB 500-50 July 1979 Reports on the impact of computers
on citizen computer rights in the field of personnel record keeping.
This study traces the changing patterns of employment and personnel
administration and examines the trends in computer use in personnel
administration. It recommends policy actions to guide the management
of personnel systems that respect citizen rights.
White, Steve, David Chess, & Jimmy Kuo "Coping with Computer
Viruses and Related Problems" IBM, Thomas J. Watson Research
Center, Distribution Services F-11 Stormytown, Post Office Box 218,
Yorktown Heights, New York 10598. 1989.
White, L. "Data Security - You Can't Work Without It." Computerworld
vol 19 no. 11A March 1985 pp. 27-30 The problem of the disgruntled
employee or ex-employee who sabotages a computer system is seen as
more of a threat than an outside hacker.
Withrow, J.B. Security Handbook for Small Computer Users From
National Technical Information Service April 1985 Microcomputer
Security $13.95 This manual discusses various security issues dealing
with small computers and the responsibilities users of small computers
have towards security.
Witten, I. H. "Computer (In)security: infiltrating open systems." Abacus
(USA) Summer 1987.
Wolbrecht, J.E. "Can Your Records Storage Center Stand a Disaster."
Office vol 102 no. 3 September 1985 pp. 112-113 A manager's
responsibility to protect a records storage center by recognizing
vulnerable areas and making them more secure is discussed.
Wood, Helen The Use Of Passwords For Controlled Access To Computer
Resources May 1977 NBS SPEC PUB 500-9 Describes the need for and
uses of passwords. Password schemes are categorized according to
selection technique, lifetime, physical characteristics and information
content. Password protection and cost considerations are discussed. A
glossary and annotated bibliography are included.
Wood, Charles Cresson "A New Approach to Computer User
Authentication." Data Processing & Communications Security vol 10
no. 4 Fall 1986 pp. 21-26 This article gives a new approach to
authentication called dial-guard. It addresses the two problems of
password/users IDs not providing sufficient security and identifying the
location of dial-up users.
Wood, Charles Cresson "Information Security with One-Way
Functions." Data Processing & Communications Security vol 9 no. 5
May/June 1985 pp. 14-16 This article explains how one-way functions
can be used to safeguard information that is too sensitive to be
protected via encryption.
Wright, J.R. Jr. "User Responsibility for Security." Government Data
Systems vol 15 no. 1 December 1985 through January 1986 pp. 52-55
This article looks at the circular "Management of Federal Information
Resources" printed by the Office of Management and Budget. This
circular provides guidance to Federal Managers concerning computer
security and the associated responsibilities.
Young, Catherine L. "Taxonomy of Computer Virus Defense
Mechanisms" Proceeding of the 10th National Computer Security
Conference, Gaithersburg MD, Sept 1987.
Zalud, Bill "Security and DP Cooperate to Attack Computer Crime."
Security vol 24 no. 10 October 1987 pp. 52-56, & 58 This article
stresses teamwork as computer crime becomes a company fact of life by
effectively cuts across a number of functional areas.
Zimmerman, J.S. "P.C. Security: So What's New." Datamation vol 31
no. 21 November 1985 pp. 89-92 This article looks at the problems
data security officers are going to encounter even as they implement
safeguards for micros.
Zimmerman, J.S. "Is Your Computer Insecure?" Datamation vol 31 no.
10 May 1985 pp. 119-120 This article challenges widely accepted
notions concerning computer security. It suggest that people's views
should be changed so that the challenge will be making a security
system work instead of beating it.
How to order ICST publications
These publications are available through the Government Printing
Office (GPO) and the National Technical Information Service (NTIS).
The source and price for each publication are indicated. Orders for
publications should include title of publication, NBS publication
number (Spec. Pub. 000, Tech. Note 000, etc.) and NTIS or GPO
number. Your may order at the price listed; however, prices are subject
to change without notice. Submit payment in the form of postal money
order, express money order or check made out to the Superintendent of
Documents for GPO-stocked documents or to the National Technical
Information Service for NTIS-stocked documents.
Mailing addresses are:
Superintendent of Documents, U.S. Government Printing Office,
Washington, DC 20402
National Technical Information Service, 5285 Port Royal Road,
Springfield, VA 22161
Telephone numbers for information are: GPO Order Desk: (202)
783-3238; NTIS Orders: (703) 487-4780; NTIS Information: (703)
487-4600
About FIPS (Federal Information Processing Standards) Publications
FIPS PUBS are sold by the National Technical Information Service
(NTIS), U.S. Department of Commerce. A list of current FIPS covering
all ICST program areas is available from: Standards Processing
Coordinator (ADP), Institute for Computer Sciences and Technology
Technology Building, B-64, National Bureau of Standards,
Gaithersburg, MD 20899 (30l) 975-2817
Downloaded From P-80 International Information Systems 304-744-2253