Re: Draft Security Policy

["Robert E. Van Cleef" <[e-mail]>]

Steve;

Protection against denial of service, both intentional and accidental,
is my major justification for implementing computer security in a
research environment. For example, most of the damage caused by the
Morris Worm could be classified damage caused by a "denial of service"
attack.

The other reason I use is insurance of data integrity. Intentional
or accidental corruption of data must be avoided.

The use of the term "accidental" is important. In my experience, there
are more instances of denial of service or corruption of data problems
caused by the actions of authorized users or system administrators than
by outside intruders. 

In a "research" environment, privacy is not the primary concern of system
security. The primary concerns are system availability and data integrity,
privacy is a secondary concern.

Bob

::Message-Id: <[e-mail]>
::Date: Thu, 18 Oct 90 05:56:19 PDT
::From: Steven Blair <[e-mail]>
::Subject: Re:  Draft Security Policy
::
::>> protection of systems against denial of service
::
::HUH??