Page 519 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

newer, more advanced standards. The relentless march of time and

technology aside, these are the major critiques of TCSEC; they help to
explain why newer standards are now in use worldwide:

Although the TCSEC puts considerable emphasis on controlling
user access to information, it doesn’t exercise control over what
users do with information once access is granted. This can be a
problem in military and commercial applications alike.

Given the origins of evaluation standards at the U.S. Department of
Defense, it’s understandable that the TCSEC focuses its concerns
entirely on confidentiality, which assumes that controlling how

users access data is of primary importance and that concerns about
data accuracy or integrity are irrelevant. This doesn’t work in
commercial environments where concerns about data accuracy and
integrity can be more important than concerns about
confidentiality.

Outside the evaluation standards’ own emphasis on access

controls, the TCSEC does not carefully address the kinds of
personnel, physical, and procedural policy matters or safeguards
that must be exercised to fully implement security policy. They
don’t deal much with how such matters can impact system security
either.

The Orange Book, per se, doesn’t deal with networking issues
(though the Red Book, developed later in 1987, does).

To some extent, these criticisms reflect the unique security concerns of
the military, which developed the TCSEC. Then, too, the prevailing
computing tools and technologies widely available at the time
(networking was just getting started in 1985) had an impact as well.
Certainly, an increasingly sophisticated and holistic view of security
within organizations helps to explain why and where the TCSEC also
fell short, procedurally and policy-wise. But because ITSEC has been

largely superseded by the Common Criteria, coverage in the next
section explains ITSEC as a step along the way toward the Common
Criteria (covered in the section after that).

ITSEC Classes and Required Assurance and