National Institute of Standards and Technology
Technology Administration
U.S. Department of Commerce

An Introduction to Computer Security:
The NIST Handbook

Special Publication 800-12

User
Issues

Assurance

Contingency
Planning

I&A

Training

Personnel

Access
Controls

Audit

Planning

Risk
Management

Crypto

Physical
Security

Policy

Support
&
Operations

Program
Management

Threats

Table of Contents

I. INTRODUCTION AND OVERVIEW
Chapter 1
INTRODUCTION
1.1
1.2
1.3
1.4
1.5

Purpose . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Intended Audience . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Organization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Important Terminology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Legal Foundation for Federal Computer Security Programs .

3
3
4
5
7

Chapter 2
ELEMENTS OF COMPUTER SECURITY
2.1
2.2
2.3
2.4
2.5
2.6
2.7
2.8

Computer Security Supports the Mission of the Organization. 9
Computer Security is an Integral Element of Sound
Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Computer Security Should Be Cost-Effective. . . . . . . . . . . . . . . . 11
Computer Security Responsibilities and Accountability Should
Be Made Explicit. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Systems Owners Have Security Responsibilities Outside Their
Own Organizations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Computer Security Requires a Comprehensive and Integrated
Approach. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .