DITSCAP/ Orange Book Essay

The difference surrounded by the Orange Book and the DITSCAP is that the Orange book depends on the education that comes from the computer packet that are inwardly the computer training systems for them to perform their tasks and to achieve their intended objectives. (Lee, 1999). On the other hand, DITSCAP take fors a ground for assessing the security of the information systems that are within the organizations, business firms, individuals and other private firms that give support to the firm.However, DITSCAP is diminished in its efficiency due to lack of a combined assay-mark and accreditation framework tool. When apply alone, DITSCAPN can be a very tiring process to the user as it has numerous cross checks of the policies and the get hold ofments. The complex and multiple information that exist between these diverse types of information hinder a persons ability to understand, generate, and assemble and to give protection to the systems. (Lee, 1999).In other words, DISCAP gives the process that is to be used, the activities that are going to be undertaken, description of the activities to be undertaken as well as the type and method of the management structure that is going to be followed during the process of witness and accreditation of the information technology systems that help to give the necessary security to the computers. This process aims at ensuring that the security process that is used gives the best security to the computers throughout the lifecycle.The certification levels of the DITSCAP comprises of four phases where the first phase involves the definition of the process. This involves understanding the organization, the environment in which the organization is in and the architecture of the organization that helps to identify the type of the security that is inevitable and the efforts that the organization is doing in order to achieve the accreditation. (Lee, 1999).The second phase, verification phase, involves an analysis of how t he security systems have evolved or have been modified for them to comply with the System security system Authority Agreement. The organization uses SSAA to come up with a modified and binding agreement before there is any growth on the system development or before making any change to the system. After the system accreditation, SSAA becomes the basis for the security configuration document. The third phase, validation phase ensures that there is a fully integrated information system as was earlier agreed on the SSAA.The fourth phase, post accreditation phase, gives the activities that are necessary for the continuity of the accredited information system to continue working in its computing environment and to face the challenges that the system may face in its entire life cycle. (Lee, 1999). The certification Levels yoke to the graduations defined within the Orange Book in that the certification and accreditation process which are interrelated and which give feedback to the other earlier phases when it is necessary.(Wong and Yeung, 2009). Each of these phases has some of the activities that require to be undertaken. In addition each of the activity has a series of tasks that need to be undertaken depending on the requirements. Each of these tasks gives out the input which represents the type of information needed to complete a given task as well as the outputs which gives the product of the task or the information which may also come as an input in other subsequent tasks.The certification and accreditation process has to be expanded in order to give more information roughly each of the stage and to ensure that the staff understand their role in the certification team. The value of the Minimal Checklist contained in Appendix 2 of the DITSCAP applications manual is that it establishes criteria to be used for certification and accreditation by giving a guide on the required efforts and other factors that are related to this system. Assurance is referred to a s the confidence which the features of security, characteristics and the functions of these features give to enforce the security policy.The assurance can be established for the business, the components and systems of the security. Therefore, certification leads to the assurance of a certain system in relation to its environment whereas accreditation shows whether the impacts joined with the system are either weak, tolerable or if they cannot be accepted at all. (Wong and Yeung, 2009). References Lee, S. E. (1999). Essays About Computer Security. Cambridge. Wong, A. and Yeung, A. (2009). Network Infrastructure Security. Springer.