Rainbow Series 2207479 220648663 2008-06-20T21:54:16Z Eubot 231599 Hatnote formatting, see [[User:Eubot/Hatnote formatting]] {{for|the [[compact disc]] standards series|Rainbow Books}} The '''Rainbow Series''' (sometimes known as the '''Rainbow Books''') is a series of [[computer security]] standards published by the [[United States]] government in the 1980s and 1990s. They were originally published by the [[U.S. Departement of Defense]] Computer Security Center, and then by the [[National Computer Security Center]]. == Objective == These standards describe a process of evaluation for [[trusted system]]s. In some cases, U.S. government entities (as well as private firms) would require formal [[validation]] of computer technology using this process as part of their [[procurement]] criteria. Many of these standards have influenced, and have been superseded by, the [[Common Criteria]]. The books have nicknames based on the color of its cover. For example, the [[TCSEC|Trusted Computer System Evaluation Criteria]] was referred to as "The Orange Book." In the book entitled ''Applied Cryptography'', security expert [[Bruce Schneier]] states of NCSC-TG-021 that he "can't even begin to describe the color of [the] cover" and that some of the books in this series have "hideously colored covers." He then goes on to describe how to receive a copy of them, saying "Don't tell them I sent you."<ref>{{Citation | last = Schneier | first = Bruce | author-link = Bruce Schneier | title = Applied Cryptography | place = New York, NY | publisher = John Wiley and Sons | year = 1996 | edition = 2nd | isbn = 0-471-11709-9 }}</ref> ==Most Significant Rainbow Series Books== {| class="wikitable" |+ '''NIST Rainbow Series''' | '''Document''' | '''Title''' | '''Date''' | '''Color''' |- | [http://csrc.ncsl.nist.gov/publications/secpubs/rainbow/std001.txt 5200.28-STD] | ''DoD [[Trusted Computer System Evaluation Criteria]]'' | 15 Aug 1983 | style="background:orange; color:white" |[[Trusted Computer System Evaluation Criteria|Orange Book]]. |- | [http://csrc.ncsl.nist.gov/publications/secpubs//rainbow/std002.txt CSC-STD-002-85] | ''DoD Password Management Guideline'' | 12 Apr 1985 | style="background:green; color:white" |[[Password Management Guideline|Green Book]]. |- | [http://csrc.ncsl.nist.gov/publications/secpubs//rainbow/std003.txt CSC-STS-003-85] | ''Guidance for applying TCSEC in Specific Environments'' | 25 Jun 1985 | style="background:yellow; color:black" |[[Guidance for applying TCSEC in Specific Environments|Yellow Book]]. |- | [http://csrc.nist.gov/publications/secpubs/rainbow/tg001.txt NCSC-TG-001] | ''A Guide to Understanding Audit in Trusted Systems'' | 1 Jun 1988 | style="background:tan; color:white" |[[A Guide to Understanding Audit in Trusted Systems|Tan Book]]. |- | [http://csrc.nist.gov/publications/secpubs/rainbow/tg002.txt NCSC-TG-002] | ''Trusted Product Security Evaluation Program'' | 22 Jun 1990 | style="background:blue; color:white" |[[Trusted Product Security Evaluation Program|Bright Blue Book]]. |- | [http://csrc.nist.gov/publications/secpubs/rainbow/tg003.txt NCSC-TG-003] | ''Discretionary Access Control in Trusted Systems'' | 30 Sep 1987 | style="background:#F79B5A; color:white" |[[Discretionary Access Control in Trusted Systems|Neon Orange Book]] |- | [http://csrc.nist.gov/publications/secpubs/rainbow/tg004.txt NCSC-TG-004] | ''Glossary of Computer Security Terms'' | 21 Oct 1988 | style="background:aqua; color:black" |[[Glossary of Computer Security Terms|Aqua Book]] |- | [http://csrc.nist.gov/publications/secpubs/rainbow/tg005.txt NCSC-TG-005] | ''Trusted Network Interpretation'' | 31 Jul 1987 | style="background:red; color:white" |[[Trusted Network Interpretation|Red Book]] |- | [http://csrc.nist.gov/publications/secpubs/rainbow/tg006.txt NCSC-TG-006] | ''Configuration Management in Trusted Systems'' | 28 Mar 1988 | style="background:orange; color:white" |[[Configuration Management in Trusted Systems|Amber Book]] |- | [http://csrc.nist.gov/publications/secpubs/rainbow/tg007.txt NCSC-TG-007] | ''A Guide to Understanding Design Documentation in Trusted Systems'' |6 Oct 1988 | style="background:fuchsia; color:white" |[[A Guide to Understanding Design Documentation in Trusted Systems|Burgundy Book]] |- | [http://csrc.nist.gov/publications/secpubs/rainbow/tg008.txt NCSC-TG-008] | ''A Guide to Understanding Trusted Distribution in Trusted Systems'' |15 Dec 1988 | style="background:lavender; color:black" |[[A Guide to Understanding Trusted Distribution in Trusted Systems|Dark Lavender Book]] |- | [http://csrc.nist.gov/publications/secpubs/rainbow/tg009.txt NCSC-TG-009] | ''Computer Security Subsystem Interpretation of the TCSEC'' |16 Sep 1988 | style="background:blue; color:white" |[[Computer Security Subsystem Interpretation of the TCSEC|Venice Blue Book]] |- | [http://www.radium.ncsc.mil/tpep/library/rainbow/NCSC-TG-010.pdf NCSC-TG-010] | ''A Guide to Understanding Security Modeling in Trusted Systems'' | October 1992 | style="background:aqua; color:black" |[[A Guide to Understanding Security Modeling in Trusted Systems|Aqua Book]] |- |[http://ftp.fas.org/irp/nsa/rainbow/tg011.htm NCSC-TG-011] | ''Trusted Network Interpretation Environments Guideline (TNI)'' | 1 August 1990 | [[Trusted Network Interpretation Environments Guideline|Red Book]] |- |NCSC-TG-013 V2 | ''RAMP Program Document'' | 1 March 1995 | [[RAMP Program Document|Pink Book]] |- | [http://csrc.nist.gov/publications/secpubs/rainbow/tg014.txt NCSC-TG-014] | ''Guidelines for Formal Verification Systems'' |1 Apr 1989 | style="background:purple; color:white" |[[Guidelines for Formal Verification Systems|Purple Book]] |- | [http://csrc.nist.gov/publications/secpubs/rainbow/tg015.txt NCSC-TG-015] | ''Guide to Understanding Trusted Facility Management'' |18 Oct 1989 | style="background:brown; color:white" |[[Guide to Understanding Trusted Facility Management|Brown Book]] |- |[http://ftp.fas.org/irp/nsa/rainbow/tg016.htm NCSC-TG-016] | ''Guidelines for Writing Trusted Facility Manuals'' | October 1992 | [[Guidelines for Writing Trusted Facility Manuals|Yellow-Green Book]] |- |[http://ftp.fas.org/irp/nsa/rainbow/tg017.htm NCSC-TG-017] |''Identification and Authentication in Trusted Systems'' | September 1991 | [[Identification and Authentication in Trusted Systems|Light Blue Book]] |- |[http://ftp.fas.org/irp/nsa/rainbow/tg018.htm NCSC-TG-018] | ''Object Reuse in Trusted Systems'' |July 1992 |[[Object Reuse in Trusted Systems|Light Blue Book]] |- | [http://csrc.nist.gov/publications/secpubs/rainbow/tg019.txt NCSC-TG-019] | ''Trusted Product Evaluation Questionnaire'' |2 May 1992 | style="background:navy; color:white" |[[Trusted Product Evaluation Questionnaire|Blue Book]] |- |NCSC-TG-020 | ''Trusted UNIX Working Group (TRUSIX) Rationale for Selecting Access Control List Features for the UNIX System'' | 7 July 1989 | ([[Trusted UNIX Working Group (TRUSIX) Rationale for Selecting Access Control List Features for the UNIX System|Silver Book]]) |- |[http://ftp.fas.org/irp/nsa/rainbow/tg021.htm NCSC-TG-021] | ''Trusted Database Management System Interpretation of the TCSEC (TDI)'' | April 1991 | ([[Trusted Database Management System Interpretation of the TCSEC (TDI)|Purple Book]]) |- | [http://www.iwar.org.uk/comsec/resources/standards/rainbow/NCSC-TG-022.html NCSC-TG-022] |''Trusted Recovery in Trusted Systems'' |30 December 1991 | ([[Trusted Recovery in Trusted Systems|Yellow Book]]) |- |NCSC-TG-023 |''Security Testing and Test Documentation in Trusted Systems'' | | ([[Security Testing and Test Documentation in Trusted Systems|Bright Orange Book]]) |- |NCSC-TG-024 Vol. 1/4 |''Procurement of Trusted Systems: An Introduction to Procurement Initiators on Computer Security Requirements'' | December 1992 | ([[Procurement of Trusted Systems: An Introduction to Procurement Initiators on Computer Security Requirements|Purple Book]]) |- |NCSC-TG-024 Vol. 2/4 | ''Procurement of Trusted Systems: Language for RFP Specifications and Statements of Work'' | 30 June 1993 |([[Procurement of Trusted Systems: Language for RFP Specifications and Statements of Work|Purple Book]]) |- |NCSC-TG-024 Vol. 3/4 | ''Procurement of Trusted Systems: Computer Security Contract Data Requirements List and Data Item Description'' | 28 February 1994 | ([[Procurement of Trusted Systems: Computer Security Contract Data Requirements List and Data Item Description|Purple Book]]) |- |NCSC-TG-024 Vol. 4/4 | ''Procurement of Trusted Systems: How to Evaluate a Bidder's Proposal Document'' |Publication TBA |([[Procurement of Trusted Systems: How to Evaluate a Bidder's Proposal Document|Purple Book]]) |- | [http://www.fas.org/irp/nsa/rainbow/tg025-2.htm NCSC-TG-025] | ''Guide to Understanding [[Data remanence|Data Remanence]] in Automated Information Systems.'' |September 1991 | style="background:#228B22; color:white" |[[Guide to Understanding Data Remanence in Automated Information Systems|Forest Green Book]] |- |NCSC-TG-026 | ''Writing the Security Features User's Guide for Trusted Systems'' | September 1991 | ([[Writing the Security Features User's Guide for Trusted Systems|Hot Peach Book]]) |- |NCSC-TG-027 |''Information System Security Officer Responsibilities for Automated Information Systems'' | May 1992 | ([[Information System Security Officer Responsibilities for Automated Information Systems|Turquoise Book]]) |- |NCSC-TG-028 | ''Assessing Controlled Access Protection'' | 25 May 1992 | ([[Assessing Controlled Access Protection|Violet Book]]) |- |NCSC-TG-029 |''Certification and Accreditation Concepts'' |January 1994 |([[Certification and Accreditation Concepts|Blue Book]]) |- |[http://www.fas.org/irp/nsa/rainbow/tg030.htm NCSC-TG-030] | ''[[Covert channel|Covert Channel]] Analysis of Trusted Systems'' | November 1993 | style="background:LightPink ; color:black" |[[Covert Channel Analysis of Trusted Systems|Light Pink Book]] |} ==In Pop Culture== The movie [[Hackers (film)|Hackers]] contained a reference to the Rainbow Books that showed Dade naming off a series of books, one of them being the Red Book from this series. ==References== <references/> ==External links== * [http://csrc.ncsl.nist.gov/secpubs/rainbow/ NIST Security Publications] * [http://www.radium.ncsc.mil/tpep/library/rainbow/ Rainbow Series Library] from [[National Computer Security Center|NCSC]] * [http://www.fas.org/irp/nsa/rainbow.htm Rainbow Series] from [[Federation of American Scientists]], with more explanation [[Category:Computer security procedures]]