PROCEEDINGS 1990 SECOND ANNUAL CANADIAN COMPUTER SECURITY CONFERENCE 27-29 MARCH 1990 OTTAWA, CANADA OTTAWA CONGRESS CENTRE THE SKTs - CHANGE, CHALLENGE AND CHOICE" HOSTED AND ORGANIZED BY TECHN1SCHE INFORMATIONSB1BLIOTHEK UNIVERS1TÂTSBIDLIOTHEK HANNOVER THE CANADIAN SYSTEM SECURITY CENTRE COMMUNICATIONS SECURITY ESTABLISHMENT GOVERNMENT OF CANADA TIB/UB Hannover 89 126 208 948 CSE 1990
- Open TABLE OF CONTENTS 1. Conference Introduction t.2 Robert Vcrrett, Canadian System Security Centre, Communications Security Establishment, 2. Welcoming Remarks and Keynote Address 3.4 To be announced. 3. "Update on Security Policy and Standards", 5-8 Agnes Schryer, Admin Policy Branch, Treasury Board Secretariat, 4. "Future of Our Privacy", 9-12 E. Barry Baker, Office of Privacy Commissioner of Canada, 5. "Canadian System Security Centre Briefings", 13-14 Various Speakers 6. "Computer Security and Datapac", 15-32 Michael Chan, EDP Security Branch, Royal Canadian Mounted Police, 7. "The Canadian Open Systems Application Systems Interconnection Security Profile", Major J. Adams-Robenhymer, Department of National Defence, NDHQ, 8. "Le programme intégré de sécurité informatique nationale du Québec", François Bureau, Robert Lévesque, Centre de traitement informatique, Assemblée nationale du Québec, Québec (Québec) Criteria 33-42 à l'assemblée 43-60 9. "Computer Security: A User's Perspective", 61-84 Lenora E. Haldenby, Operational Research and Analysis Establishment Department of National Defence, NDHQ, 10. "A.Security Reference Model for the Atomic Energy Ltd. Research Company (AECL-RC) Rainer Kossman, Whiteshell Nuclear Research Establishment, Atomic Energy of Canada, Pinawa (Manitoba) Morteza Niktash, Department of Systems and Computer Engineering, Carleton University, Information Warehouse", of Canada 85-108 11. "An Integrated Micro/Mainframe Security Approach", 109-120 Claude Vigeant, Cindy Walsh, Okiok Data, Laval (Québec) Not received in time for publication. vii
- Open TABLE DES MATIÈRES i. Introduction 1-2 Robert Verrett, Centre canadien de sécurité des systèmes, Centre de la sécurité des télécommunications 2. Remarques à venir. et allocution d'ouverture 3-4 3. "Update on Security Policy and Standards", 5-8 Agnes Schryer, Admin Policy Branch, Treasury Board Secretariat, 4. "Future of Our Privacy", 9-12 E. Barry Baker, Office of Privacy Commissioner of Canada, 5. Exposés par divers membres du Centre canadien de sécurité des 13-14 systèmes. 6. "Computer Security and Datapac", 15-32 Michael Chan, EDP Security Branch, Royal Canadian Mounted Police, 7. "The Canadian Open Systems Application Criteria 33-42 Systems Interconnection Security Profile", Major J. Adams-Robcnhymcr, Department of National Defence, NDHQ, 8. "Le programme intégré de sécurité informatique nationale du Québec", François Bureau, Robert Lévesque, Centre de traitement informatique, Assemblée nationale du Québec, Québec (Québec) à l'assemblée 43-60 9. "Computer Security: A User's Perspective", 61-84 Lenora EL Haldenby, Operational Research and Analysis Establishment Department of National Defence, NDHQ, 10. "A Security Reference Model for the Atomic Energy Ltd. Research Company (AECL-RC) Information Warehouse", Rainer Kossman, Whiteshell Nuclear Research Establishment, Atomic Energy of Canada, Pinawa (Manitoba) Mortcza Niktash, Department of Systems and Computer Engineering, Carleton University, of Canada 85-108 11. "An Integrated Micro/Mainframe Security Approach", 109-120 Claude Vigeant, Cindy Walsh, Okiok Data, Laval (Québec) Le texte n'avait pas été reçu au moment de l'impression des Actes. viii
TABLE OF CONTENTS 12. "CMHC's Development of a Disaster Recovery Plan", 121-144 John Rouillard, Management Information Services Directorate, Canada Mortgage and Housing Corporation, 13. "Current Trends in Threats to Canadian Computer Systems", 145-150 Ian Ross, EDP Security Branch, Royal Canadian Mounted Police, 14. "A Model of Risk Analysis and Management", 151174 Robin Moses, BIS Applied Systems Limited, London (England) Ian Glover, Central Computer and Telecommunications Agency London (England) 15. "The Future of Secure Electronic Data Processing 175-182 - Another Decade", Systems Research Educational Centre Stanley A Kurzban, International Business Machines Corporation, Thornwood, New York, (U.S.A) 16. "The Electronic Security Command Automated Accreditation 183-198 Package (ACCPAK)", Horace B. Pcelc, Headquarters Electronic Security Command, Department of U.S. Air Force, San Antonio, Texas, (U.S.A) 17. "Covert Channels Within Open Systems Interconnection (OSI)", 199-216 Michael J. Froh, Kruptos Inc., 18. "The Application of Software Testing in Secure Systems", 217-234 Brad Tipler, Software Kinetics Limited, Stittsville (Ontario) 19. "Crying Wolf, 235-246 Eugen Mate Bade, Canadian System Security Centre, Communications Security Establishment, 20. "Computer and Communication Technology: Issues of 247-264 Management, Governance and the Law", Brian R. Bawden, Barrister & Solicitor, Osier, Hoskin and Harcourt, 21. Thursday's Opening Remarks 265-266 Wilfred L. Camilleri, The Depository and Clearing Corporation 22. An Introduction to the Information Security Exchange (ISE), 267-268 Gordon A McKay, Peat Marwick Stevenson & Kellogg Not received in time for publication. ix
- Another TABLE DES MATIERES 12. "CMHC's Development of a Disaster Recovery Plan", 121-144 John Rouillard, Management Information Services Directorate, Canada Mortgage and Housing Corporation, 13. "Current Trends in Threats to Canadian Computer Systems", 145-150 Ian Ross, EDP Security Branch, Royal Canadian Mounted Police, 14. "A Model of Risk Analysis and Management", 151-174 Robin Moses, BIS Applied Systems Limited, London (England) Ian Glover, Central Computer and Telecommunications Agency London (England) 15. "The Future of Secure Electronic Data Processing 175-182 Decade", Stanley A Kurzban, Systems Research Educational Centre International Business Machines Corporation, Thornwood, New York (U.S.A) 16. "The Electronic Security Command Automated Accreditation 183-198 Package (ACCPAK)", Horace B. Peele, Headquarters Electronic Security Command, Department of U.S. Air Force, San Antonio, Texas (U.S.A) 17. "Covert Channels Within Open Systems Interconnection (OSI)", 199-216 Michael J. Froh, Kruptos Inc., 18. "The Application of Software Testing in Secure Systems", 217-234 Brad Tipler, Software Kinetics Limited, Stittsville (Ontario) 19. "Crying Wolf, 235-246 Eugcn Mate Baric, Canadian System Security Centre, Communications Security Establishment, 20. "Computer and Communication Technology: Issues of 247-264 Management, Governance and the Law", Brian R. Bawdcn, Barrister & Solicitor, Osier, Hoskin and Harcourt, 21. Remarques d'ouverture de jeudi 265-266 Wilfred L. Camillcri, The Depository and Clearing Corporation 22. An Introduction to the Information Security Exchange (ÏSE), 267-268 Gordon A McKay, Peat Marwick Stevenson & Kellogg Le texte n'avait pas été reçu au moment de l'impression x des Actes.
TABLE OF CONTENTS 23. "Information Risk Management", 269-288 Charles E. Brophy, Crisp Management Ltd., Calgary (Alberta) 24. "Key Components of an Effective Information Security Program", 289-300 Patrick J. Leslie, Information Security, Royal Bank of Canada, 25. "Serving End Users in the 90's", 3O1-302F Michael Nettlcton, Peat Marwick Stevenson & Kellogg, 26. "Systems Availability and Disaster Recovery: Evolutionary 303-316 Developments and Revolutionary Trends", Carrie Liddy, Richard Brown, Comdisco Disaster Recovery Services Canada Ltd., Mississauga (Ontario) 27. "Smart Cards", 317-318 David Braidwood, Information Security Technology, Royal Bank of Canada, 28. "The Security of Incorporating Integrated ("Smart" Cards) and Biometrics as a Security Computer Environment", Marcel Graves, Identity Systems International Incorporated, Edmonton (Alberta) Circuit Cards 319-324 Gate for a 29. "Beyond the Third Facet", 325-340 John Hopkinson, DMR Group Inc., 30. "Verifying Systems: The SECD Experience", 341-362 Graham Birtwistle, Brian Graham, Todd Simpson, Computer Science Department, University of Calgary, Calgary (Alberta) 31. "Trusted Integrated Project Support Environments", 363-385 Hicham N. Adra, John Allen, Kalman C Toth, CGI Group Inc., Not received in time for publication. xi
TABLE DES MATIÈRES 23. "Information Risk Management", 269-288 Charles EL Brophy, Crisp Management Ltd., Calgary (Alberta) 24. "Key Components of an Effective Information Security Program", 289-300 Patrick J. Leslie, Information Security, Royal Bank of Canada, 25. "Serving End Users in the 90's", 301-302F Michael Ncttleton, Peat Marwick Stevenson & Kellogg, 26. "Systems Availability and Disaster Recovery: Evolutionary 303-316 Developments and Revolutionary Trends", Carrie Liddy, Richard Brown, Comdisco Disaster Recovery Services Canada Ltd., Mississauga (Ontario) 27. "Smart Cards", 317-318 David Braidwood, Information Security Technology, Royal Bank of Canada, 28. "The Security of Incorporating Integrated ("Smart" Cards) and Biometrics as a Security Computer Environment", Marcel Graves, Identity Systems International Incorporated, Edmonton (Alberta) Circuit Cards 319-324 Gate for a 29. "Beyond the Third Facet", 325-340 John Hopkinson, DMR Group Inc., 30. "Verifying Systems: The SECD Experience", 341-362 Graham BirtwisUe, Brian Graham, Todd Simpson, Computer Science Department, University of Calgary, Calgary (Alberta) 31. 'Trusted Integrated Project Support Environments", 363-385 Hicham N. Adra, John Allen, Kalman C Toth, CGI Group Inc., Le texte n'avait pas été reçu au moment de l'impression des Actes. xii