Which term below MOST accurately describes the Trusted Computing
Base (TCB)?
A.
A piece of information that represents the security level of an object
B.
A computer that controls all access to objects by subjects
C.
Formal proofs used to demonstrate the consistency between a systems specification and a
security model
D.
The totality of protection mechanisms within a computer system
Explanation:
The Trusted Computing Base (TCB) The totality of protection
mechanisms within a computer system, including hardware,
firmware, and software, the combination of which is responsible for
enforcing a security policy. A TCB consists of one or more components
that together enforce a unified security policy over a product or
system. The ability of a trusted computing base to correctly enforce a
security policy depends solely on the mechanisms within the TCB
and on the correct input by system administrative personnel of
parameters (e.g., a users clearance) related to the security policy.
*Answer “A computer that controls all access to objects by subjects” describes the reference
monitor concept. The reference
monitor is an access control concept that refers to an abstract machine
that mediates all accesses to objects by subjects. The Security Kernel
consists of the hardware, firmware, and software elements of a Trusted
Computing Base (or Network Trusted Computing Base partition) that
implement the reference monitor concept. It must mediate all accesses,
be protected from modification, and be verifiable as correct.
*Answer “A piece of information that represents the security level of an object” refers to a
sensitivity label. Asensitivity label is a piece of
information that represents the extra security level of an object and
describes the sensitivity (e.g., classification) of the data in the object.
Sensitivity labels are used by the TCB as the basis for mandatory
access control decisions.
*Answer “Formal proofs used to demonstrate the consistency between a systems specification
and a security model” describes formal verification. This is the process of using
formal proofs to demonstrate the consistency (design verification)
between a formal specification of a system and a formal security policy
model or (implementation verification) between the formal specification
and its program implementation. Source: DoD 5200.28-STD
Department of Defense Trusted Computer System Evaluation Criteria