NSA paper on computer security

Kragen posted to
BUGTRAQ:

“The Inevitability of Failure: The Flawed Assumption of Security
in Modern Computing Environments”, published by six NSA employees,
was published at the 21st National Information Systems Security
Conference in October, in Arlington, Virginia, USA. (See http://csrc.nist.gov/nissc/1998/
and http://csrc.nist.gov/nissc/1998/papers.html
for more on the conference.)

The paper is available in HTML at http://www.jya.com/paperF1.htm
and in PDF at http://csrc.nist.gov/nissc/1998/proceedings/paperF1.pdf

It discusses, among other things:

• why mandatory security mechanisms are useful outside the
  context of classification levels, even on single-user systems;
• trusted-path mechanisms, like the PASSCRED stuff recently
  implemented in Linux and NT’s Ctrl-Alt-Del login feature.