National Cryptologic School

[John Young <jya@pipeline.com>]

DAW provided this URL:

   http://csrc.nist.gov/training/in170.zip

   1996-04-29 Introduction to Computer Security
   National Cryptologic School
   Interactive Courseware Trainee Guide
   (formerly, CP-133) (37 zipped files, DOS program) 

We've had a look at this course, a primer on CompSec
and a required course for all DoD employees. It takes 
some fiddling to get past the sign-on block. Hint: after
unzipping execute "student.exe" and enter "CP" as the 
lesson. Repeat for other listed files, CPxxx - CPxxx.

It's basic stuff but worthwhile for its claims, these among 
others:

1. Most hackers are employees of the target.

2. Negligence, accidents and sloppy sys-administration are 
prime causes of disruptions, perhaps more than deliberate 
attacks.

3. Environmental weaknesses are often overlooked by
security experts too focussed on computer systems.

It lists these security documents as references:

   EO 12356 [superceded by EO 12958]
   DCID 1/16 [Director of Central Intelligence Directive]
   DoDDir 5200.28
   DoD 5200.28 STD
   Public Law 100-235
   NSA/CSS Dir 10-27
   NSA/CSS Manual 130-1 (NSAM 130-1)
   NSA/CSS Manual 130-2 (NSAM 130-2)
   NSA/CSS Reg 130-2
   NTISSAM COMPSEC 1-87
   The Rainbow Series
   OMB A-130

Does anyone know of a source for the DCID series and the
NSA/CSS series? Some of the others are available on the Web 
-- see AltaVista.

While looking for these we ran across an informative implementation 
of infosec and compsec:

   Information Systems Accreditation Document, 4 Volumes

   System Security Requirements for the
   Department of Defense Intelligence Information System

   Automated Message Handling System (AMHS) V2.x

   By:   McDonnell Douglas Aerospace
   For:   Electronic Systems Center,  Air Force Materiel Command

Which we've put at:

   http://jya.com/amhs.htm