- [Narrator] The government is, by necessity,
very serious about cybersecurity,
and has had rigorous cybersecurity programs
in place for decades,
long before the private sector began
considering information security issues.
In order to manage the complexity of securing
many diverse systems,
the US government developed standardized evaluation models
designed to help them understand
the security requirements of different situations
and the security capabilities of different products.
In 1983, the National Security Agency
issued the Trusted Computer System Evaluation Criteria,
abbreviated TCSEC.
The security community quickly discarded
that bulky name and began referring to this book
by the distinctive color of its cover,
calling it the Orange Book.
The Orange Book described the security requirements
that the Department of Defense used for computer systems
and the process that the government would follow
when evaluating systems under that model.
It was widely used in the military computing community
for decades, but it was rarely referenced
outside the circles of government agencies and contractors.
The Orange Book is no longer used
as it was replaced in 2005
by an international standard
known as the Common Criteria.
The Common Criteria was a great boon
for systems developers because it unified
the evaluation systems used
by most NATO member nations,
allowing developers to create systems once
and then sell them to all NATO partners.
The government uses a certification and accreditation
process to determine whether a system
may be used in the government setting.
The details of this process are highly technical
and best left to government procurement specialists
and their contractors.
For the purpose of the exam
you should know at a very high level
how the process works.
Certification is the process of determining
that a technology product meets
the requirements of a certain level of certification.
This is not a decision made
in the context of a particular operating environment
but is instead a government-wide decision
that a product meets certain security requirements.
Accreditation, on the other hand, is a decision made
after certification, and it is a specific decision
as to whether a technology system
may be used in a specific environment.
When an accrediting authority makes
an accreditation decision,
they have four options.
They can grant full authorization to operate,
known as ATO, for a three-year period,
or they may grant an interim authorization to operate,
IATO, for six months while security issues are corrected,
or they may grant an interim authorization to test,
IATT, that allows use for testing purposes only,
or they may prohibit the use of the system
by issuing a denial of authorization to operate, DATO.
One exam tip on all this terminology.
Certification and accreditation are very different
processes even though people often mistakenly use
the terms interchangeably.
Authorization, on the other hand,
is the same thing as accreditation.