Security of computer systems

Passwords are one of many methods used to authenticate authorized users. As security of computer systems performing regulated operations is so very critical, expectations for activities (such as assignment, security, and maintenance of passwords) are clearly established by the FDA. Before Part 11, the FDA expected4 that passwords would be ... 

Abstract This paper is devoted to energy security of computer systems... 

Abstract. Improving the security of computing systems embedded into commercial airplanes has become a major concern for the avionics industry. This paper deals with one of the techniques that can be applied to improve the security of such systems vulnerability assessment. More precisely, this paper presents experiments carried out on an experimental embedded operating system in order to assess vulnerabilities in its low-level implementation layers. The main characteristics of this embedded system, the platform used to carry out our experiments, as well as the first results of these experiments are described. 

Reinmann BC, Warren AD. User-oriented criteria for the selection of Dds software. Commun ACM 28 (2) 166-179, Feb. 1985. Report evaluates lab-safety trends. R and D 37.12 13, 1995. Romano CA. Privacy, confidentiality, and security of computerized systems The nursing responsibility. Computers Nurs 99-104, May/June 1987. 

The evaluation of computer systems performing regulated operations is the first phase to achieving an organized, prioritized, and balanced Part 11 Remediation Project approach. The objective of the evaluation is to identity the system s functional and/or procedural gaps results of the evaluation will determine whether the operational, maintenance, or security procedures specific to the system will provide a controlled environment, which ensures the integrity of the electronic records and/or signatures as stated in the Part 11 requirements. 

The average cost per hour of computer system downtime across thirty domains such as banking, manufacturing, retail, health insurances, securities, reservations, etc., has recently been estimated at nearly 950,000 by the US Association of Contingency Planners2. 

Once the systems from the three levels are validated, the same levels of security, change control, and disaster contingency will be applied to all. (See Chap. 7 for a thorough examination of computer systems validation and additional discussion about some of its more challenging compliance aspects. Also see Chap. 7 for a comprehensive examination of FDA s expectations as they relate to computer system validation). 

Identihcation of computer systems Defined specifications for computer systems Control procedures for software programs Security access on computer systems Archiving records Quality assurance Staff training... 

Operations (i) a security risk document identifies likely and possible risks to the security of computer-resident data and (w) SOPs ensure the consistent, controlled use of the system. 

The use of Web browsers and Intranet facilities looks set to become very popular in the next generation of computer systems. Many suppliers of corporate computer systems are already building such facilities into their current products. Issues concerning security and data integrity, however, do exist. Although any problems will undoubtedly be overcome, it may take a few years before this technology is mature enough for exploitation in the pharmaceutical industry. 

The safeguards and security-dedicated computer system at the ICPP provides storage basin and operations personnel with a detailed processing list, criticality safety with additional administrative controls, and S S with a means of monitoring process activities. In addition tO providing criticality controls, various operational plans can be readily evaluated. The computerized system has been used for the 1978 and 1980 dissolution campaigns and has proved an invaluable aid to plant operation. 

Intrusion detection is defined as active monitoring of computer systems or networks in desktop IT domains to detect attacks and misuse [1]. Intrusion detection systems are instruments, which provide IDS process (from event detection, evaluation, escalation, and documentation). An IDS detects so called cyber attacks based on analysis of log records of unexpected activities and known attacker activities [9]. The detection of malicious activities on the computer systems are the main task of IDS, so it focuses on computer security. The realisation of safety requirements is not the goal for IDS in homogeneous desktop IT systems. 

A collection and assessment of methods of keeping systems secure whilst continuing to operate with an acceptable level of safety and reliability will draw on the experience of the EWICS TC7 membership. A number of confidential case studies have already been performed using the operating experience of computer systems used in the transport, chemical and energy industries. 

The CC for Information Technology Security Evaluation is an International Standards Organization/Intemational Electrotechnical Commission (ISO/ lEC 15408) for computer security certification. CC is a framework in which computer system users can specify their security functional and assurance requirements, vendors can then implement and r make claims about the security attributes of their products, and testing laboratories can evaluate the products to determine if they actually meet the claims. CC provides assurance that the process of specification, implementation, and evaluation of a computer security product has been conducted in a rigorous and standard manner. The EAL level does not measure the security of the system itself, it simply states at what level the system was tested to see if it met all the requirements. 

The hardware and software used to implement LIMS systems must be vahdated. Computers and networks need to be examined for potential impact of component failure on LIMS data. Security concerns regarding control of access to LIMS information must be addressed. Software, operating systems, and database management systems used in the implementation of LIMS systems must be vahdated to protect against data cormption and loss. Mechanisms for fault-tolerant operation and LIMS data backup and restoration should be documented and tested. One approach to vahdation of LIMS hardware and software is to choose vendors whose products are precertified however, the ultimate responsibihty for vahdation remains with the user. Vahdating the LIMS system s operation involves a substantial amount of work, and an adequate vahdation infrastmcture is a prerequisite for the constmction of a dependable and flexible LIMS system. 

This would affect every business that was linked to a computer juid the commotion and hysteria tliat surrounded the Y2K bug were due to the present age s dependence on computers. For c.xamplc, it was feared that the go eminent s computer system would print social security checks with amounts seen in the year 1900 and that banks would calculate dividends based on interest rates from the year 1900. The problems could have been catastrophic. Fortunately, tlie response to the "potential Y2K disaster was effective in that most corrections or patches were made before the year 2000. However, these corrections were costly and required large amounts of money to be spent." ... 

There are a surprising number of computer-con-trolled systems in homes today, all acting independently to control heating, cooling, security, lighting, appliances, entertainment equipment and even coffee makers. Houses of the future will integrate all of these computerized functions into centralized home automation systems that will help optimize energy... 

Automated dissolution equipment in most cases must be compliant with the FDA electronic records and electronic signatures regulation (21 CFR Part 11). The requirements of the regulation include use of validated systems, secure storage of records, computer generated audit trails, system and data security via limited access privileges, and the use of electronic signatures. 

Among other things, the new emphasis on homeland security pointed to the need to protect and enhance the security of the nation s critical infrastructure. Critical infrastructure can be defined or listed in many ways. Generally, governments use the term to describe material assets that are essential for the functioning of an economy and a society. For the purpose of this text, critical infrastructure is defined as those assets of physical and computer-based systems that are essential to the minimum operations of our economy and government. Critical infrastructures (in the authors opinion), are the following ... 

Any location that has a connection to the SCADA network is a target, especially unmanned or unguarded remote sites. Conduct a physical security survey and inventory access points at each facility that has a connection to the SCADA system. Identify and assess any source of information including remote telephone/ computer network/fiber optic cables that could be tapped radio and microwave links that are exploitable computer terminals that could be accessed and wireless local area network access points. Identify and eliminate single points of failure. The security of the site must be adequate to detect or prevent unauthorized access. Do not allow live network access points at remote, unguarded sites simply for convenience. 

Release data related to the SCADA network only on a strict, need-to-know basis, and only to persons explicitly authorized to receive such information. Social engineering, the gathering of information about a computer or computer network via questions to naive users, is often the first step in a malicious attack on computer networks. The more information revealed about a computer or computer network, the more vulnerable the computer/network is. Never divulge data revealed to a SCADA network, including the names and contact information about the system operators/administrators, computer operating systems, and/or physical and logical locations of computers and network systems over telephones or to personnel unless they are explicitly authorized to receive such information. Any requests for information by unknown persons need to be sent to a central network security location for verification and fulfillment. People can be a weak link in an otherwise secure network. Conduct training and information awareness... 

Office of Management and Budget. Guidance for Preparation and Submission of Security Plans for Federal Computer Systems Containing Sensitive Information. 0MB bulletin no. 88-16. Washington, DC Office of Management and Budget, July 6,1988. 

---