Date: October 13, 1995
From: Russell Davis
Subject: Security Archiving Recommendations
These are my recommendations for including security functions within the Archive Reference Model. I am glad that the group decided to include security within this ISO process.
In the model, there are five areas listed. I would consider these as minimal security functions which would help organizations implement their security policies (many of which are risk based).
For information ingested over unreliable networks, such as the Internet, some form of authentication may be required. I recommend that an optional "Authenticator" be included within this functional area. This would include encryption, digital signatures, and other approaches.
There may be a site requirement to ensure the integrity of this area. I recommend that "Integrity Control" be included in this functional area.
In additional to possible integrity requirements, a site may wish to have a backup capability. I recommend that "Integrity Control" and "Backup" be included within this functional area. These could include checksums, electronic signatures, digital signatures, or other approaches.
A typical archive will need to distinguish between a system administrator and a typical user. Moreover, what functions can be performed are also controlled. For example, you would not necessarily want a user to update archived information. I recommend that "Access Control" and a "User Authenticator" be included within this functional area.
An archive might want to include some type of authentication to disseminated information. I recommend that an optional authenticator be included within this functional area.
A service of NOST at NSSDC. Comments and suggestion are always welcome.
Curator: John Garrett (firstname.lastname@example.org) +1.301.441.4169
Responsible Official: Code 633.2 / Don Sawyer (email@example.com) +1.301.286.2748
Last Revised: December 1, 1995, John Garrett