Chapter 26 System Evaluation and Assurance

《Chapter 26 System Evaluation and Assurance》由会员上传分享，免费在线阅读，更多相关内容在学术论文-天天文库。

1、CHAPTER26SystemEvaluationandAssuranceIfit’sprovablysecure,itprobablyisn’t.—LarsKnudsenIthinkanytimeyouexposevulnerabilitiesit’sagoodthing.—AttorneyGeneralJanetReno[1068]OpensourceisgoodforsecuritybecauseitpreventsyoufromeventryingtoviolateKerckhoffs’sLaw.—EricRaymond26.1IntroductionIvecoveredalo

2、tofmaterialinthisbook,someofitquitedifficult.ButIveleftthehardestpartstothelast.Thesearethequestionsofassurancewhetherthesystemwillworkandevaluationhowyouconvinceotherpeopleofthis.Howdoyoumakeadecisiontoshiptheproduct,andhowdoyousellthesafetycasetoyourinsurers?Assurancefundamentallycomesdowntothe

3、questionofwhethercapablemotivatedpeoplehavebeatuponthesystemenough.Buthowdoyoudefineenough?Andhowdoyoudefinethesystem?Howdoyoudealwithpeoplewhoprotectthewrongthing,becausetheirmodeloftherequirementsisout-of-dateorplainwrong?Andhowdoyouallowforhumanfailures?Therearemanysystemswhichcanbeoperatedjust

4、finebyalertexperiencedprofessionals,butareunfitforpurposebecausetheyretootrickyforordinaryfolktouseorareintolerantoferror.Butifassuranceishard,evaluationisevenharder.Itsabouthowyouconvinceyourboss,yourclientsand,inextremis,ajurythatthesystem857858Chapter26■SystemEvaluationandAssuranceisindeedfitfor

5、purpose;thatitdoesindeedwork(orthatitdidworkatsomeparticulartimeinthepast).Thereasonthatevaluationisbothnecessaryandhardisthat,often,oneprincipalcarriesthecostofprotectionwhileanothercarriestheriskoffailure.Thiscreatesanobvioustension,andthird-partyevaluationschemessuchastheCommonCriteriaareofte

6、nusedtomakeitmoretransparent.26.2AssuranceAworkingdefinitionofassurancecouldbeourestimateofthelikelihoodthatasystemwillfailinaparticularway.Thisestimatecanbebasedonanumberoffactors,suchastheprocessusedtodevelopthesystem;theidentityofthepersonorteamwhodevelopedit;particulartechnicalassessments,suc

7、hastheuseofformalmethodsorthedeliberateintroductionofanumberofbugstoseehowmanyofthemarecaughtbythetestingteam;andexperi-encewhichultimatelydependsonhavingamodelofhowreliabilitygrows(ordecays)overtimeasasystemissubjectedtotes