Security implications of personal computer connectivity

Technical Report · Tue Nov 01 04:00:00 EST 1988

OSTI ID:6685815

Andrews, Jr, W H

To prepare for future investigations into the security implications of interconnecting personal computers (PCs) and specific sensitive and classified Department of State computer systems and networks, the Joint Center for Information Security Technology has performed a study of the effect that linking PCs to typical host computers or networks can have on the security of both the PCs and host systems. This report summarizes the findings of the study, which consisted of an extensive literature survey and a thorough examination of several capabilities present in a PC that do not exist in a typical computer video display terminal (VDT). Significant host vulnerabilities result from the PC's intelligence and programmability, its local storage capability, its hardware and software configurability, and its ability to accommodate a wide variety of peripheral devices. The most significant requirement for a safe connection identified by this report is a carefully designed, implemented, and maintained PC hardware and software configuration control program. Critical consequences of this connection will be to increase the scope of responsibility and the background preparation required of the PC and host Information System Security Officers. This phase of the study was not intended to produce specific recommendations for correcting identified vulnerabilities, but it is clear that allowing connection of PCs to any given host without implementing a set of security controls carefully matched to the particular systems being interconnected is dangerous. Each of the issues raised in this report should be examined for applicability to the specific connection being considered.

• Research Organization: Oak Ridge National Lab., TN (USA)
• DOE Contract Number: AC05-84OR21400
• OSTI ID: 6685815
• Report Number(s): ORNL/TM-10978; ON: DE89003423
• Country of Publication: United States
• Language: English

Related Subjects

99 GENERAL AND MISCELLANEOUS
990220* -- Computers
Computerized Models
& Computer Programs-- (1987-1989)
COMPUTER NETWORKS
COMPUTERS
DIGITAL COMPUTERS
INFORMATION SYSTEMS
MICROCOMPUTERS
PERSONAL COMPUTERS
SECURITY