Rainbow Series
2207479
220648663
2008-06-20T21:54:16Z
Eubot
231599
Hatnote formatting, see [[User:Eubot/Hatnote formatting]]
{{for|the [[compact disc]] standards series|Rainbow Books}}
The '''Rainbow Series''' (sometimes known as the '''Rainbow Books''') is a series of [[computer security]] standards published by the [[United States]] government in the 1980s and 1990s. They were originally published by the [[U.S. Departement of Defense]] Computer Security Center, and then by the [[National Computer Security Center]].
== Objective ==
These standards describe a process of evaluation for [[trusted system]]s. In some cases, U.S. government entities (as well as private firms) would require formal [[validation]] of computer technology using this process as part of their [[procurement]] criteria. Many of these standards have influenced, and have been superseded by, the [[Common Criteria]].
The books have nicknames based on the color of its cover. For example, the [[TCSEC|Trusted Computer System Evaluation Criteria]] was referred to as "The Orange Book." In the book entitled ''Applied Cryptography'', security expert [[Bruce Schneier]] states of NCSC-TG-021 that he "can't even begin to describe the color of [the] cover" and that some of the books in this series have "hideously colored covers." He then goes on to describe how to receive a copy of them, saying "Don't tell them I sent you."<ref>{{Citation
| last = Schneier
| first = Bruce
| author-link = Bruce Schneier
| title = Applied Cryptography
| place = New York, NY
| publisher = John Wiley and Sons
| year = 1996
| edition = 2nd
| isbn = 0-471-11709-9 }}</ref>
==Most Significant Rainbow Series Books==
{| class="wikitable"
|+ '''NIST Rainbow Series'''
| '''Document'''
| '''Title'''
| '''Date'''
| '''Color'''
|-
| [http://csrc.ncsl.nist.gov/publications/secpubs/rainbow/std001.txt 5200.28-STD]
| ''DoD [[Trusted Computer System Evaluation Criteria]]''
| 15 Aug 1983
| style="background:orange; color:white" |[[Trusted Computer System Evaluation Criteria|Orange Book]].
|-
| [http://csrc.ncsl.nist.gov/publications/secpubs//rainbow/std002.txt CSC-STD-002-85]
| ''DoD Password Management Guideline''
| 12 Apr 1985
| style="background:green; color:white" |[[Password Management Guideline|Green Book]].
|-
| [http://csrc.ncsl.nist.gov/publications/secpubs//rainbow/std003.txt CSC-STS-003-85]
| ''Guidance for applying TCSEC in Specific Environments''
| 25 Jun 1985
| style="background:yellow; color:black" |[[Guidance for applying TCSEC in Specific Environments|Yellow Book]].
|-
| [http://csrc.nist.gov/publications/secpubs/rainbow/tg001.txt NCSC-TG-001]
| ''A Guide to Understanding Audit in Trusted Systems''
| 1 Jun 1988
| style="background:tan; color:white" |[[A Guide to Understanding Audit in Trusted Systems|Tan Book]].
|-
| [http://csrc.nist.gov/publications/secpubs/rainbow/tg002.txt NCSC-TG-002]
| ''Trusted Product Security Evaluation Program''
| 22 Jun 1990
| style="background:blue; color:white" |[[Trusted Product Security Evaluation Program|Bright Blue Book]].
|-
| [http://csrc.nist.gov/publications/secpubs/rainbow/tg003.txt NCSC-TG-003]
| ''Discretionary Access Control in Trusted Systems''
| 30 Sep 1987
| style="background:#F79B5A; color:white" |[[Discretionary Access Control in Trusted Systems|Neon Orange Book]]
|-
| [http://csrc.nist.gov/publications/secpubs/rainbow/tg004.txt NCSC-TG-004]
| ''Glossary of Computer Security Terms''
| 21 Oct 1988
| style="background:aqua; color:black" |[[Glossary of Computer Security Terms|Aqua Book]]
|-
| [http://csrc.nist.gov/publications/secpubs/rainbow/tg005.txt NCSC-TG-005]
| ''Trusted Network Interpretation''
| 31 Jul 1987
| style="background:red; color:white" |[[Trusted Network Interpretation|Red Book]]
|-
| [http://csrc.nist.gov/publications/secpubs/rainbow/tg006.txt NCSC-TG-006]
| ''Configuration Management in Trusted Systems''
| 28 Mar 1988
| style="background:orange; color:white" |[[Configuration Management in Trusted Systems|Amber Book]]
|-
| [http://csrc.nist.gov/publications/secpubs/rainbow/tg007.txt NCSC-TG-007]
| ''A Guide to Understanding Design Documentation in Trusted Systems''
|6 Oct 1988
| style="background:fuchsia; color:white" |[[A Guide to Understanding Design Documentation in Trusted Systems|Burgundy Book]]
|-
| [http://csrc.nist.gov/publications/secpubs/rainbow/tg008.txt NCSC-TG-008]
| ''A Guide to Understanding Trusted Distribution in Trusted Systems''
|15 Dec 1988
| style="background:lavender; color:black" |[[A Guide to Understanding Trusted Distribution in Trusted Systems|Dark Lavender Book]]
|-
| [http://csrc.nist.gov/publications/secpubs/rainbow/tg009.txt NCSC-TG-009]
| ''Computer Security Subsystem Interpretation of the TCSEC''
|16 Sep 1988
| style="background:blue; color:white" |[[Computer Security Subsystem Interpretation of the TCSEC|Venice Blue Book]]
|-
| [http://www.radium.ncsc.mil/tpep/library/rainbow/NCSC-TG-010.pdf NCSC-TG-010]
| ''A Guide to Understanding Security Modeling in Trusted Systems''
| October 1992
| style="background:aqua; color:black" |[[A Guide to Understanding Security Modeling in Trusted Systems|Aqua Book]]
|-
|[http://ftp.fas.org/irp/nsa/rainbow/tg011.htm NCSC-TG-011]
| ''Trusted Network Interpretation Environments Guideline (TNI)''
| 1 August 1990
| [[Trusted Network Interpretation Environments Guideline|Red Book]]
|-
|NCSC-TG-013 V2
| ''RAMP Program Document''
| 1 March 1995
| [[RAMP Program Document|Pink Book]]
|-
| [http://csrc.nist.gov/publications/secpubs/rainbow/tg014.txt NCSC-TG-014]
| ''Guidelines for Formal Verification Systems''
|1 Apr 1989
| style="background:purple; color:white" |[[Guidelines for Formal Verification Systems|Purple Book]]
|-
| [http://csrc.nist.gov/publications/secpubs/rainbow/tg015.txt NCSC-TG-015]
| ''Guide to Understanding Trusted Facility Management''
|18 Oct 1989
| style="background:brown; color:white" |[[Guide to Understanding Trusted Facility Management|Brown Book]]
|-
|[http://ftp.fas.org/irp/nsa/rainbow/tg016.htm NCSC-TG-016]
| ''Guidelines for Writing Trusted Facility Manuals''
| October 1992
| [[Guidelines for Writing Trusted Facility Manuals|Yellow-Green Book]]
|-
|[http://ftp.fas.org/irp/nsa/rainbow/tg017.htm NCSC-TG-017]
|''Identification and Authentication in Trusted Systems''
| September 1991
| [[Identification and Authentication in Trusted Systems|Light Blue Book]]
|-
|[http://ftp.fas.org/irp/nsa/rainbow/tg018.htm NCSC-TG-018]
| ''Object Reuse in Trusted Systems''
|July 1992
|[[Object Reuse in Trusted Systems|Light Blue Book]]
|-
| [http://csrc.nist.gov/publications/secpubs/rainbow/tg019.txt NCSC-TG-019]
| ''Trusted Product Evaluation Questionnaire''
|2 May 1992
| style="background:navy; color:white" |[[Trusted Product Evaluation Questionnaire|Blue Book]]
|-
|NCSC-TG-020
| ''Trusted UNIX Working Group (TRUSIX) Rationale for Selecting Access Control List Features for the UNIX System''
| 7 July 1989
| ([[Trusted UNIX Working Group (TRUSIX) Rationale for Selecting Access Control List Features for the UNIX System|Silver Book]])
|-
|[http://ftp.fas.org/irp/nsa/rainbow/tg021.htm NCSC-TG-021]
| ''Trusted Database Management System Interpretation of the TCSEC (TDI)''
| April 1991
| ([[Trusted Database Management System Interpretation of the TCSEC (TDI)|Purple Book]])
|-
| [http://www.iwar.org.uk/comsec/resources/standards/rainbow/NCSC-TG-022.html NCSC-TG-022]
|''Trusted Recovery in Trusted Systems''
|30 December 1991
| ([[Trusted Recovery in Trusted Systems|Yellow Book]])
|-
|NCSC-TG-023
|''Security Testing and Test Documentation in Trusted Systems''
|
| ([[Security Testing and Test Documentation in Trusted Systems|Bright Orange Book]])
|-
|NCSC-TG-024 Vol. 1/4
|''Procurement of Trusted Systems: An Introduction to Procurement Initiators on Computer Security Requirements''
| December 1992
| ([[Procurement of Trusted Systems: An Introduction to Procurement Initiators on Computer Security Requirements|Purple Book]])
|-
|NCSC-TG-024 Vol. 2/4
| ''Procurement of Trusted Systems: Language for RFP Specifications and Statements of Work''
| 30 June 1993
|([[Procurement of Trusted Systems: Language for RFP Specifications and Statements of Work|Purple Book]])
|-
|NCSC-TG-024 Vol. 3/4
| ''Procurement of Trusted Systems: Computer Security Contract Data Requirements List and Data Item Description''
| 28 February 1994
| ([[Procurement of Trusted Systems: Computer Security Contract Data Requirements List and Data Item Description|Purple Book]])
|-
|NCSC-TG-024 Vol. 4/4
| ''Procurement of Trusted Systems: How to Evaluate a Bidder's Proposal Document''
|Publication TBA
|([[Procurement of Trusted Systems: How to Evaluate a Bidder's Proposal Document|Purple Book]])
|-
| [http://www.fas.org/irp/nsa/rainbow/tg025-2.htm NCSC-TG-025]
| ''Guide to Understanding [[Data remanence|Data Remanence]] in Automated Information Systems.''
|September 1991
| style="background:#228B22; color:white" |[[Guide to Understanding Data Remanence in Automated Information Systems|Forest Green Book]]
|-
|NCSC-TG-026
| ''Writing the Security Features User's Guide for Trusted Systems''
| September 1991
| ([[Writing the Security Features User's Guide for Trusted Systems|Hot Peach Book]])
|-
|NCSC-TG-027
|''Information System Security Officer Responsibilities for Automated Information Systems''
| May 1992
| ([[Information System Security Officer Responsibilities for Automated Information Systems|Turquoise Book]])
|-
|NCSC-TG-028
| ''Assessing Controlled Access Protection''
| 25 May 1992
| ([[Assessing Controlled Access Protection|Violet Book]])
|-
|NCSC-TG-029
|''Certification and Accreditation Concepts''
|January 1994
|([[Certification and Accreditation Concepts|Blue Book]])
|-
|[http://www.fas.org/irp/nsa/rainbow/tg030.htm NCSC-TG-030]
| ''[[Covert channel|Covert Channel]] Analysis of Trusted Systems''
| November 1993
| style="background:LightPink ; color:black" |[[Covert Channel Analysis of Trusted Systems|Light Pink Book]]
|}
==In Pop Culture==
The movie [[Hackers (film)|Hackers]] contained a reference to the Rainbow Books that showed Dade naming off a series of books, one of them being the Red Book from this series.
==References==
<references/>
==External links==
* [http://csrc.ncsl.nist.gov/secpubs/rainbow/ NIST Security Publications]
* [http://www.radium.ncsc.mil/tpep/library/rainbow/ Rainbow Series Library] from [[National Computer Security Center|NCSC]]
* [http://www.fas.org/irp/nsa/rainbow.htm Rainbow Series] from [[Federation of American Scientists]], with more explanation
[[Category:Computer security procedures]]