ISO Archiving Standards - Second US Workshop - Davis Memo

Date: October 13, 1995
From: Russell Davis
Subject: Security Archiving Recommendations

These are my recommendations for including security functions within the Archive Reference Model. I am glad that the group decided to include security within this ISO process.

In the model, there are five areas listed. I would consider these as minimal security functions which would help organizations implement their security policies (many of which are risk based).

1. Ingest

   For information ingested over unreliable networks, such as the Internet, some form of authentication may be required. I recommend that an optional "Authenticator" be included within this functional area. This would include encryption, digital signatures, and other approaches.

2. Metadata Management

   There may be a site requirement to ensure the integrity of this area. I recommend that "Integrity Control" be included in this functional area.

3. Data Storage

   In additional to possible integrity requirements, a site may wish to have a backup capability. I recommend that "Integrity Control" and "Backup" be included within this functional area. These could include checksums, electronic signatures, digital signatures, or other approaches.

4. Access

   A typical archive will need to distinguish between a system administrator and a typical user. Moreover, what functions can be performed are also controlled. For example, you would not necessarily want a user to update archived information. I recommend that "Access Control" and a "User Authenticator" be included within this functional area.

5. Dissemination.

   An archive might want to include some type of authentication to disseminated information. I recommend that an optional authenticator be included within this functional area.

Wider Views