Trusted Computer System Evaluation Criteria

Trusted Computer System Evaluation Criteria
Name	Trusted Computer System Evaluation Criteria
Abbreviation	TCSEC
Developed by	United States Department of Defense, National Computer Security Center
Initial release	1983
Latest release	1985
Status	Historical
Influence	Common Criteria, Orange Book, DoD policy

Trusted Computer System Evaluation Criteria

The Trusted Computer System Evaluation Criteria was a United States Department of Defense document that defined criteria for assessing the security of computerized systems. It provided a structured taxonomy linking assurance requirements to assurance levels used by agencies such as the National Security Agency, the Central Intelligence Agency, and procurement organizations in the United States Department of Defense. The document shaped evaluation practice in contexts including DEFCON, NIST, and international standardization bodies such as the International Organization for Standardization.

Overview

The criteria established graded assurance classes and functional security requirements intended to guide procurement and certification decisions within organizations like the United States Air Force, the United States Navy, and the United States Army. It introduced concepts that influenced work at institutions including the RAND Corporation, the SRI International, and the Carnegie Mellon University Software Engineering Institute. The framework emphasized access control mechanisms, audit capabilities, trusted computing bases, and formal verification approaches practiced at research centers such as MIT, Stanford University, and Berkeley.

History and Development

Development traces to initiatives led by the United States Department of Defense and operational needs identified after projects at ARPA and evaluations following deployments in programs like MILNET and systems used by the Federal Aviation Administration. Early contributors and reviewers included contractors and laboratories such as Boeing, Honeywell, IBM, Digital Equipment Corporation, and academic teams at Cornell University and Princeton University. The document emerged amid policy discussions involving the Office of the Secretary of Defense and review panels convened with participation from the National Bureau of Standards and the RAND Corporation. Publication in the 1980s coincided with contemporaneous policy discourse in venues such as the House Armed Services Committee and briefings to the President of the United States's technology advisors.

Criteria and Evaluation Classes

The criteria defined hierarchically ordered evaluation classes that combined functional requirements and assurance requirements used by evaluators from the National Computer Security Center and test laboratories like Mitre Corporation affiliates. Functional requirements referenced mechanisms such as discretionary access control and mandatory access control, which were demonstrated in implementations from Multics, VMS, and later UNIX derivatives. Assurance classes ranged from minimal protection in basic classes to rigorous formal verification in higher classes, echoing methods practiced at Bell Labs and described in literature from ACM and IEEE conferences. Evaluation involved test plans executed by laboratories including commercial evaluators and government labs tied to DARPA research programs.

Implementation and Use in Government and Industry

Government procurement programs in agencies like the Department of Energy, Department of Defense, and the Federal Bureau of Investigation adopted the criteria for specifying security requirements in acquisition contracts with vendors such as Sun Microsystems, Hewlett-Packard, and Microsoft. Industry consortia including the Open Group and standards committees at ISO and IEC referenced the taxonomy when harmonizing with emerging international standards; research centres including Bellcore and Texas Instruments performed compliance work. Evaluation outcomes informed accreditation decisions at installations managed by the National Reconnaissance Office and operational deployments within NASA research centers.

Criticism and Limitations

Critics from institutions such as Carnegie Mellon University and policy analysts at the Brookings Institution argued that the criteria prioritized verification over usability, citing case studies from deployments at Lawrence Livermore National Laboratory and Los Alamos National Laboratory. Analysts from RAND Corporation and commentators in Communications of the ACM pointed to cost and development overheads when applying formal methods advocated in the upper assurance classes, while vendors like DEC and IBM highlighted integration challenges in commercial product lines. Legal and policy observers at the Heritage Foundation and congressional oversight committees noted limits when reconciling the criteria with procurement practice and rapidly evolving architectures exemplified by projects at Intel and AT&T.

Legacy and Influence on Modern Security Standards

The document’s taxonomy and evaluation concepts influenced successors and harmonization efforts culminating in frameworks such as the Common Criteria, and informed guidance from agencies like NIST and advisory work by ISO/IEC JTC 1. Principles introduced by the criteria fed into secure operating system research at MITRE, formal methods work at Oxford University, and commercial assurance programs at vendors such as Cisco Systems and Oracle Corporation. The legacy persists in modern certification schemes used by entities including the European Union Agency for Cybersecurity and national evaluation laboratories worldwide, and in academic curricula at institutions such as University of Cambridge and ETH Zurich.

Category:Computer security standards