System Assurance

Abstract

The aim of system assurance is to verify that a system enforces a desired set of security goals. For example, we would like to know that a new operating system that we are developing can protect the secrecy of one group of users’ data from another group. First, we would like to know that the operating system mechanisms (e.g., reference monitor) and policies (e.g., multilevel security) are appropriate to enforce the goal. Second, we would like to know whether the operating system implementation correctly implements intended mechanisms and policies. System assurance describes both what determines reasonable goal and what is a satisficing implementation, and system assurance also describes how a secure operating system should be built and maintained.