PROCEEDINGS OTTAWA, CANADA CANADIAN COMPUTER SECURITY CONFERENCE 1990 SECOND ANNUAL HOSTED AND ORGANIZED BY MARCH 1990

Transcription

1 PROCEEDINGS 1990 SECOND ANNUAL CANADIAN COMPUTER SECURITY CONFERENCE MARCH 1990 OTTAWA, CANADA OTTAWA CONGRESS CENTRE THE SKTs - CHANGE, CHALLENGE AND CHOICE" HOSTED AND ORGANIZED BY TECHN1SCHE INFORMATIONSB1BLIOTHEK UNIVERS1TÂTSBIDLIOTHEK HANNOVER THE CANADIAN SYSTEM SECURITY CENTRE COMMUNICATIONS SECURITY ESTABLISHMENT GOVERNMENT OF CANADA TIB/UB Hannover CSE 1990

2 - Open TABLE OF CONTENTS 1. Conference Introduction t.2 Robert Vcrrett, Canadian System Security Centre, Communications Security Establishment, 2. Welcoming Remarks and Keynote Address 3.4 To be announced. 3. "Update on Security Policy and Standards", 5-8 Agnes Schryer, Admin Policy Branch, Treasury Board Secretariat, 4. "Future of Our Privacy", 9-12 E. Barry Baker, Office of Privacy Commissioner of Canada, 5. "Canadian System Security Centre Briefings", Various Speakers 6. "Computer Security and Datapac", Michael Chan, EDP Security Branch, Royal Canadian Mounted Police, 7. "The Canadian Open Systems Application Systems Interconnection Security Profile", Major J. Adams-Robenhymer, Department of National Defence, NDHQ, 8. "Le programme intégré de sécurité informatique nationale du Québec", François Bureau, Robert Lévesque, Centre de traitement informatique, Assemblée nationale du Québec, Québec (Québec) Criteria à l'assemblée "Computer Security: A User's Perspective", Lenora E. Haldenby, Operational Research and Analysis Establishment Department of National Defence, NDHQ, 10. "A.Security Reference Model for the Atomic Energy Ltd. Research Company (AECL-RC) Rainer Kossman, Whiteshell Nuclear Research Establishment, Atomic Energy of Canada, Pinawa (Manitoba) Morteza Niktash, Department of Systems and Computer Engineering, Carleton University, Information Warehouse", of Canada "An Integrated Micro/Mainframe Security Approach", Claude Vigeant, Cindy Walsh, Okiok Data, Laval (Québec) Not received in time for publication. vii

3 - Open TABLE DES MATIÈRES i. Introduction 1-2 Robert Verrett, Centre canadien de sécurité des systèmes, Centre de la sécurité des télécommunications 2. Remarques à venir. et allocution d'ouverture "Update on Security Policy and Standards", 5-8 Agnes Schryer, Admin Policy Branch, Treasury Board Secretariat, 4. "Future of Our Privacy", 9-12 E. Barry Baker, Office of Privacy Commissioner of Canada, 5. Exposés par divers membres du Centre canadien de sécurité des systèmes. 6. "Computer Security and Datapac", Michael Chan, EDP Security Branch, Royal Canadian Mounted Police, 7. "The Canadian Open Systems Application Criteria Systems Interconnection Security Profile", Major J. Adams-Robcnhymcr, Department of National Defence, NDHQ, 8. "Le programme intégré de sécurité informatique nationale du Québec", François Bureau, Robert Lévesque, Centre de traitement informatique, Assemblée nationale du Québec, Québec (Québec) à l'assemblée "Computer Security: A User's Perspective", Lenora EL Haldenby, Operational Research and Analysis Establishment Department of National Defence, NDHQ, 10. "A Security Reference Model for the Atomic Energy Ltd. Research Company (AECL-RC) Information Warehouse", Rainer Kossman, Whiteshell Nuclear Research Establishment, Atomic Energy of Canada, Pinawa (Manitoba) Mortcza Niktash, Department of Systems and Computer Engineering, Carleton University, of Canada "An Integrated Micro/Mainframe Security Approach", Claude Vigeant, Cindy Walsh, Okiok Data, Laval (Québec) Le texte n'avait pas été reçu au moment de l'impression des Actes. viii

4 TABLE OF CONTENTS 12. "CMHC's Development of a Disaster Recovery Plan", John Rouillard, Management Information Services Directorate, Canada Mortgage and Housing Corporation, 13. "Current Trends in Threats to Canadian Computer Systems", Ian Ross, EDP Security Branch, Royal Canadian Mounted Police, 14. "A Model of Risk Analysis and Management", Robin Moses, BIS Applied Systems Limited, London (England) Ian Glover, Central Computer and Telecommunications Agency London (England) 15. "The Future of Secure Electronic Data Processing Another Decade", Systems Research Educational Centre Stanley A Kurzban, International Business Machines Corporation, Thornwood, New York, (U.S.A) 16. "The Electronic Security Command Automated Accreditation Package (ACCPAK)", Horace B. Pcelc, Headquarters Electronic Security Command, Department of U.S. Air Force, San Antonio, Texas, (U.S.A) 17. "Covert Channels Within Open Systems Interconnection (OSI)", Michael J. Froh, Kruptos Inc., 18. "The Application of Software Testing in Secure Systems", Brad Tipler, Software Kinetics Limited, Stittsville (Ontario) 19. "Crying Wolf, Eugen Mate Bade, Canadian System Security Centre, Communications Security Establishment, 20. "Computer and Communication Technology: Issues of Management, Governance and the Law", Brian R. Bawden, Barrister & Solicitor, Osier, Hoskin and Harcourt, 21. Thursday's Opening Remarks Wilfred L. Camilleri, The Depository and Clearing Corporation 22. An Introduction to the Information Security Exchange (ISE), Gordon A McKay, Peat Marwick Stevenson & Kellogg Not received in time for publication. ix

5 - Another TABLE DES MATIERES 12. "CMHC's Development of a Disaster Recovery Plan", John Rouillard, Management Information Services Directorate, Canada Mortgage and Housing Corporation, 13. "Current Trends in Threats to Canadian Computer Systems", Ian Ross, EDP Security Branch, Royal Canadian Mounted Police, 14. "A Model of Risk Analysis and Management", Robin Moses, BIS Applied Systems Limited, London (England) Ian Glover, Central Computer and Telecommunications Agency London (England) 15. "The Future of Secure Electronic Data Processing Decade", Stanley A Kurzban, Systems Research Educational Centre International Business Machines Corporation, Thornwood, New York (U.S.A) 16. "The Electronic Security Command Automated Accreditation Package (ACCPAK)", Horace B. Peele, Headquarters Electronic Security Command, Department of U.S. Air Force, San Antonio, Texas (U.S.A) 17. "Covert Channels Within Open Systems Interconnection (OSI)", Michael J. Froh, Kruptos Inc., 18. "The Application of Software Testing in Secure Systems", Brad Tipler, Software Kinetics Limited, Stittsville (Ontario) 19. "Crying Wolf, Eugcn Mate Baric, Canadian System Security Centre, Communications Security Establishment, 20. "Computer and Communication Technology: Issues of Management, Governance and the Law", Brian R. Bawdcn, Barrister & Solicitor, Osier, Hoskin and Harcourt, 21. Remarques d'ouverture de jeudi Wilfred L. Camillcri, The Depository and Clearing Corporation 22. An Introduction to the Information Security Exchange (ÏSE), Gordon A McKay, Peat Marwick Stevenson & Kellogg Le texte n'avait pas été reçu au moment de l'impression x des Actes.

6 TABLE OF CONTENTS 23. "Information Risk Management", Charles E. Brophy, Crisp Management Ltd., Calgary (Alberta) 24. "Key Components of an Effective Information Security Program", Patrick J. Leslie, Information Security, Royal Bank of Canada, 25. "Serving End Users in the 90's", 3O1-302F Michael Nettlcton, Peat Marwick Stevenson & Kellogg, 26. "Systems Availability and Disaster Recovery: Evolutionary Developments and Revolutionary Trends", Carrie Liddy, Richard Brown, Comdisco Disaster Recovery Services Canada Ltd., Mississauga (Ontario) 27. "Smart Cards", David Braidwood, Information Security Technology, Royal Bank of Canada, 28. "The Security of Incorporating Integrated ("Smart" Cards) and Biometrics as a Security Computer Environment", Marcel Graves, Identity Systems International Incorporated, Edmonton (Alberta) Circuit Cards Gate for a 29. "Beyond the Third Facet", John Hopkinson, DMR Group Inc., 30. "Verifying Systems: The SECD Experience", Graham Birtwistle, Brian Graham, Todd Simpson, Computer Science Department, University of Calgary, Calgary (Alberta) 31. "Trusted Integrated Project Support Environments", Hicham N. Adra, John Allen, Kalman C Toth, CGI Group Inc., Not received in time for publication. xi

7 TABLE DES MATIÈRES 23. "Information Risk Management", Charles EL Brophy, Crisp Management Ltd., Calgary (Alberta) 24. "Key Components of an Effective Information Security Program", Patrick J. Leslie, Information Security, Royal Bank of Canada, 25. "Serving End Users in the 90's", F Michael Ncttleton, Peat Marwick Stevenson & Kellogg, 26. "Systems Availability and Disaster Recovery: Evolutionary Developments and Revolutionary Trends", Carrie Liddy, Richard Brown, Comdisco Disaster Recovery Services Canada Ltd., Mississauga (Ontario) 27. "Smart Cards", David Braidwood, Information Security Technology, Royal Bank of Canada, 28. "The Security of Incorporating Integrated ("Smart" Cards) and Biometrics as a Security Computer Environment", Marcel Graves, Identity Systems International Incorporated, Edmonton (Alberta) Circuit Cards Gate for a 29. "Beyond the Third Facet", John Hopkinson, DMR Group Inc., 30. "Verifying Systems: The SECD Experience", Graham BirtwisUe, Brian Graham, Todd Simpson, Computer Science Department, University of Calgary, Calgary (Alberta) 31. 'Trusted Integrated Project Support Environments", Hicham N. Adra, John Allen, Kalman C Toth, CGI Group Inc., Le texte n'avait pas été reçu au moment de l'impression des Actes. xii