How Our Current Program Evolved

Until a few years ago, NRL maintained a traditional risk management security program to protect its computer assets. An asset is any software information, administrative, physical, communications, or personnel resource within an activity. This program evaluated each computer individually against a comprehensive set of security related threats and criteria.

Computer threats are any circumstances or events with the potential to cause harm to the computer system or processing activities. The presence of a threat does not mean that it will actually cause harm, only that it represents a potential weakness or vulnerability in the security of the system.

It was soon recognized that our PC's were being exposed to many more threats as time went on, especially those represented by the hacker/cracker community. Some of the many threats included:

Increasing number of systems

Physical Access

Lack of built-in security mechanisms

Available operating system code

Easily transportable

Lack of user awareness

LAN accessibility

Our major area of concern was that no vulnerability test or program was available to directly evaluate the 4000+ ISs monitored by NRL. The ultimate recognition of the potential hacker/cracker threat resulted in an expansion of the existing risk management program as well as the implementation of a new network oriented system testing & evaluation (ST&E) program. The overall IS security program currently in place is more visible and active in testing both stand-alone IS, and also our networks for security weaknesses. Not only has this new program been successful, but it has significantly reduced potential computer security weaknesses we may have previously been exposed to.