Controlled interface: Difference between revisions

Revision as of 22:37, 28 December 2010

Revision as of 22:55, 28 December 2010

Line 7:

The [[Committee on National Security Systems]] (CNSS) publishes the 'NATIONAL INFORMATION ASSURANCE (IA) GLOSSARY', also known as CNSS Instruction No. 4009. In this glossary, a Controlled Interface is defined as follows: "Mechanism that facilitates the adjudication of different interconnected system security policies (e.g., controlling the flow of information into or out of an interconnected system".

Within the US government, the Director of Central Intelligence Directive 6/3 (DCID 6/3) states that multilevel security systems must meet the requirements for Protection Level 4 and 5 (PL-4 and PL-5), Integrity-High and Availability-High are required for multilevel security systems.

While some controlled interfaces are very complicated, others are very simple. A simple example of a controlled interface is a one-way data transfer system that moves data from a low-security network to a high-security network while not allowing any data transfer in the opposite direction. One-way controlled interfaces are also called [[data diodes]]. For example, a fiber [[Network Interface Controller]] (NIC) with only one optical path can be used as a data diode. However, all [[Internet protocol]]s involve two-way data traffic, and if there is a need to access the Internet from a high-security system, such a simple solution cannot be used.

== High Assurance Guards ==

A controlled interface whose security has been certified through the [[Common Criteria]] process is known as a [[High Assurance Guard]] (HAG) or High Assurance Controlled Interface (HACI).

[[Category:Computer security]]