Rainbow Series

Last updated
A complete set of the US DoD Rainbow Series computer security documents Rainbow series documents.jpg
A complete set of the US DoD Rainbow Series computer security documents

The Rainbow Series (sometimes known as the Rainbow Books) is a series of computer security standards and guidelines published by the United States government in the 1980s and 1990s. They were originally published by the U.S. Department of Defense Computer Security Center, and then by the National Computer Security Center.

Contents

Objective

These standards describe a process of evaluation for trusted systems. In some cases, U.S. government entities (as well as private firms) would require formal validation of computer technology using this process as part of their procurement criteria. Many of these standards have influenced, and have been superseded by, the Common Criteria.

The books have nicknames based on the color of its cover. For example, the Trusted Computer System Evaluation Criteria was referred to as "The Orange Book." [1] In the book entitled Applied Cryptography, security expert Bruce Schneier states of NCSC-TG-021 that he "can't even begin to describe the color of [the] cover" and that some of the books in this series have "hideously colored covers." He then goes on to describe how to receive a copy of them, saying "Don't tell them I sent you." [2]

Most significant Rainbow Series books

NIST Rainbow Series
DocumentTitleDateColor
5200.28-STD DoD Trusted Computer System Evaluation Criteria August 15, 1983Orange 
CSC-STD-002-85 DoD Password Management GuidelineApril 12, 1985Green 
CSC-STD-003-85 Guidance for Applying TCSEC in Specific EnvironmentsJune 25, 1985Light Yellow 
CSC-STD-004-85 Technical Rationale Behind CSC-STD-003-85: Computer Security RequirementsJune 25, 1985Yellow 
NCSC-TG-001 A Guide to Understanding Audit in Trusted SystemsJune 1, 1988Tan 
NCSC-TG-002 Trusted Product Security Evaluation ProgramJune 22, 1990Bright Blue 
NCSC-TG-003 Discretionary Access Control in Trusted SystemsSeptember 30, 1987Neon Orange 
NCSC-TG-004 Glossary of Computer Security TermsOctober 21, 1988Teal Green 
NCSC-TG-005 Trusted Network InterpretationJuly 31, 1987Red 
NCSC-TG-006 Configuration Management in Trusted SystemsMarch 28, 1988Amber 
NCSC-TG-007 A Guide to Understanding Design Documentation in Trusted SystemsOctober 6, 1988Burgundy 
NCSC-TG-008 A Guide to Understanding Trusted Distribution in Trusted SystemsDecember 15, 1988Dark Lavender 
NCSC-TG-009 Computer Security Subsystem Interpretation of the TCSECSeptember 16, 1988Venice Blue 
NCSC-TG-010 A Guide to Understanding Security Modeling in Trusted SystemsOctober 1992Aqua 
NCSC-TG-011 Trusted Network Interpretation Environments Guideline (TNI)August 1, 1990Red 
NCSC-TG-012Trusted Database Management System Interpretation [3] April 1991 
NCSC-TG-013 RAMP Program Document1989Pink 
NCSC-TG-013 V2 RAMP Program Document version 2March 1, 1995Pink 
NCSC-TG-014 Guidelines for Formal Verification SystemsApril 1, 1989Purple 
NCSC-TG-015 Guide to Understanding Trusted Facility ManagementOctober 18, 1989Brown 
NCSC-TG-016 Guidelines for Writing Trusted Facility ManualsOctober 1992Yellow-Green 
NCSC-TG-017 Identification and Authentication in Trusted SystemsSeptember 1991Light Blue 
NCSC-TG-018 Object Reuse in Trusted SystemsJuly 1992Light Blue 
NCSC-TG-019 Trusted Product Evaluation QuestionnaireMay 2, 1992Blue 
NCSC-TG-020 Trusted UNIX Working Group (TRUSIX) Rationale for Selecting Access Control List Features for the UNIX SystemJuly 7, 1989Silver 
NCSC-TG-020-A Trusted UNIX Working Group (TRUSIX) Rationale for Selecting Access Control List Features for the UNIX (R) SystemAugust 18, 1989Grey Silver 
NCSC-TG-021 Trusted Database Management System Interpretation of the TCSEC (TDI)April 1991Purple 
NCSC-TG-022 Trusted Recovery in Trusted SystemsDecember 30, 1991Yellow 
NCSC-TG-023 Security Testing and Test Documentation in Trusted SystemsJuly 1993Bright Orange 
NCSC-TG-024 Vol. 1/4 Procurement of Trusted Systems: An Introduction to Procurement Initiators on Computer Security RequirementsDecember 1992Purple 
NCSC-TG-024 Vol. 2/4 Procurement of Trusted Systems: Language for RFP Specifications and Statements of WorkJune 30, 1993Purple 
NCSC-TG-024 Vol. 3/4 Procurement of Trusted Systems: Computer Security Contract Data Requirements List and Data Item DescriptionFebruary 28, 1994Purple 
NCSC-TG-024 Vol. 4/4Procurement of Trusted Systems: How to Evaluate a Bidder's Proposal DocumentPublication TBAPurple 
NCSC-TG-025 Guide to Understanding Data Remanence in Automated Information Systems.September 1991Forest Green 
NCSC-TG-026 Writing the Security Features User's Guide for Trusted SystemsSeptember 1991Hot Peach 
NCSC-TG-027 Information System Security Officer Responsibilities for Automated Information SystemsMay 1992Turquoise 
NCSC-TG-028 Assessing Controlled Access ProtectionMay 25, 1992Violet 
NCSC-TG-029 Certification and Accreditation ConceptsJanuary 1994Blue 
NCSC-TG-030 Covert Channel Analysis of Trusted SystemsNovember 1993Light Pink 

References

  1. ↑ Steve Lipner, "The Birth and Death of the Orange Book" IEEE Annals of the History of Computing 37 no. 2 (2015): 19-31 at DOI
  2. ↑ Schneier, Bruce (1996), Applied Cryptography (2nd ed.), New York, NY: John Wiley and Sons, ISBN   978-0-471-11709-4
  3. ↑ "DITSCAP Application Manual" (PDF). DoD. July 31, 2000. Archived from the original (PDF) on Aug 30, 2004.
This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.