| Next revision | Previous revision |
| dido:02-crusible:99-annexes:annex-c-requirements:02-operational-requirements:or-003:or-003c [2026/07/23 10:01] – created nick_dido | dido:02-crusible:99-annexes:annex-c-requirements:02-operational-requirements:or-003:or-003c [2026/07/30 05:33] (current) – [Delivery Phase] nick_dido |
|---|
| ====== OR-003c — Security Domain Enforcement ====== | ====== OR-003c — Security Domain Resource Enforcement ====== |
| |
| [[dido:02-crusible:99-annexes:annex-c-requirements:02-operational-requirements:or-003:start|Go to OR-003 — Classified and Unclassified Environments]] | [[dido:02-crusible:99-annexes:annex-c-requirements:02-operational-requirements:or-003:start|Go to OR-003 — Classified and Unclassified Environments]] |
| ===== Statement ===== | ===== Statement ===== |
| |
| [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] SHALL restrict each operation to the resources and information authorized for its governing [[dido:99_annexes:annex-b-terms-and-definitions:s:security_domain|Security Domain]]. | [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] SHALL prevent an operation from accessing a resource not authorized for the operation's governing [[dido:99_annexes:annex-b-terms-and-definitions:s:security_domain|Security Domain]]. |
| |
| ===== Derived From ===== | ===== Derived From ===== |
| > //The system SHALL support classified and unclassified deployment environments.//[[dido:02-crusible:99-annexes:annex-b:cr-001|[C1]]] | > //The system SHALL support classified and unclassified deployment environments.//[[dido:02-crusible:99-annexes:annex-b:cr-001|[C1]]] |
| |
| OR-003c isolates the obligation to enforce the resource and information boundaries established for the Security Domain governing a Crucible operation. | OR-003c isolates the obligation to prevent a Crucible operation from accessing a resource outside the authorization boundary of its governing Security Domain. |
| |
| ===== Rationale ===== | ===== Rationale ===== |
| |
| A [[dido:99_annexes:annex-b-terms-and-definitions:c:classified_environment|Classified Environment]] or [[dido:99_annexes:annex-b-terms-and-definitions:u:unclassified_environment|Unclassified Environment]] can contain multiple [[dido:99_annexes:annex-b-terms-and-definitions:s:security_domain|Security Domains]] governed by different security policies, authorities, missions, compartments, or release restrictions. | A [[dido:99_annexes:annex-b-terms-and-definitions:c:classified_environment|Classified Environment]] or [[dido:99_annexes:annex-b-terms-and-definitions:u:unclassified_environment|Unclassified Environment]] can contain resources governed by different [[dido:99_annexes:annex-b-terms-and-definitions:s:security_domain|Security Domains]]. |
| |
| Successful operation within an environment does not by itself demonstrate that an operation remained within its authorized Security Domain. | Execution within an authorized environment does not by itself authorize access to every resource within that environment. |
| |
| OR-003c requires [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] to enforce the resource and information boundaries of the Security Domain governing each operation. | OR-003c prevents a Crucible operation from crossing the resource boundary established for its governing Security Domain. |
| |
| The responsible authority establishes the Security Domain, its boundary, and its authorizations. Crucible enforces those established authorizations and does not create the Security Domain through execution of this requirement. | The responsible authority establishes the Security Domain and identifies its authorized resources. Crucible enforces the established authorization. |
| |
| ===== Applies To ===== | ===== Applies To ===== |
| |
| * [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] | * [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] |
| * [[dido:99_annexes:annex-b-terms-and-definitions:s:security_domain|Security Domains]] | |
| * Crucible operations | * Crucible operations |
| * Information processed by Crucible operations | * [[dido:99_annexes:annex-b-terms-and-definitions:s:security_domain|Security Domains]] |
| * Resources accessed by Crucible operations | * Resources accessed by Crucible operations |
| * [[dido:99_annexes:annex-b-terms-and-definitions:c:classified_environment|Classified Environments]] | * [[dido:99_annexes:annex-b-terms-and-definitions:c:classified_environment|Classified Environments]] |
| - Each tested Crucible operation identifies its governing [[dido:99_annexes:annex-b-terms-and-definitions:s:security_domain|Security Domain]] | - Each tested Crucible operation identifies its governing [[dido:99_annexes:annex-b-terms-and-definitions:s:security_domain|Security Domain]] |
| - The governing Security Domain identifies the resources authorized for the tested operation | - The governing Security Domain identifies the resources authorized for the tested operation |
| - The governing Security Domain identifies the information authorized for the tested operation | - [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] permits the tested operation to access a resource authorized for the governing Security Domain |
| - [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] permits the tested operation to access resources authorized for the governing Security Domain | - Crucible prevents the tested operation from accessing a resource not authorized for the governing Security Domain |
| - Crucible permits the tested operation to process information authorized for the governing Security Domain | - Crucible records each resource-access denial caused by a Security Domain restriction |
| - Crucible denies the tested operation access to resources not authorized for the governing Security Domain | - Each denial record identifies the operation, governing Security Domain, requested resource, and denial result |
| - Crucible denies the tested operation access to information not authorized for the governing Security Domain | |
| - Crucible records each denial caused by a Security Domain restriction | |
| - Each denial record identifies the operation, governing Security Domain, requested resource or information, and denial result | |
| |
| ===== Referenced By ===== | ===== Referenced By ===== |
| ===== Delivery Phase ===== | ===== Delivery Phase ===== |
| |
| <todo>Determine the Delivery Phase for OR-003c.</todo> | Implemented and Verified. |
| |
| ===== Implementation Status ===== | ===== Implementation Status ===== |
| |
| <todo>Assess whether the current Crucible implementation restricts each operation to the resources and information authorized for its governing Security Domain.</todo> | <todo>Assess whether the current Crucible implementation prevents each operation from accessing resources not authorized for its governing Security Domain.</todo> |
| |
| ===== Requirement Status ===== | ===== Requirement Status ===== |
| |
| <todo>Define how each Security Domain identifies its authorized resources.</todo> | <todo>Define how each Security Domain identifies its authorized resources.</todo> |
| |
| <todo>Define how each Security Domain identifies its authorized information.</todo> | |
| |
| <todo>Define the behavior required when an operation does not identify a governing Security Domain.</todo> | <todo>Define the behavior required when an operation does not identify a governing Security Domain.</todo> |
| |
| <todo>Define the behavior required when a requested resource or information object lacks a Security Domain association.</todo> | <todo>Define the behavior required when a requested resource does not identify an associated Security Domain.</todo> |
| |
| <todo>Define the record required when Crucible denies an operation because of a Security Domain restriction.</todo> | <todo>Define the record required when Crucible denies resource access because of a Security Domain restriction.</todo> |
| |
| ---- | ---- |
| This page is a leaf requirement page and omits a trailing '':start'' from its namespace. | This page is a leaf requirement page and omits a trailing '':start'' from its namespace. |
| |
| OR-003c requires enforcement of an established Security Domain. It does not require Crucible to establish, authorize, or define a Security Domain. | OR-003c requires enforcement of an established Security Domain resource boundary. It does not require Crucible to establish, authorize, or define a Security Domain. |
| |
| The responsible authority establishes: | The responsible authority establishes: |
| * The Security Domain boundary | * The Security Domain boundary |
| * The governing security policy | * The governing security policy |
| * The authorized resources | * The resources authorized within the Security Domain |
| * The authorized information | |
| * The entities permitted to operate within the Security Domain | |
| |
| Changes to the Statement should preserve: | Changes to the Statement should preserve: |
| |
| * [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] as the responsible actor | * [[dido:99_annexes:annex-b-terms-and-definitions:c:crucible|Crucible]] as the responsible actor |
| * Restriction as the required behavior | * Prevention as the required behavior |
| * Each Crucible operation as the subject of enforcement | * A Crucible operation as the subject of enforcement |
| | * A resource as the controlled object |
| * The governing [[dido:99_annexes:annex-b-terms-and-definitions:s:security_domain|Security Domain]] as the source of authorization | * The governing [[dido:99_annexes:annex-b-terms-and-definitions:s:security_domain|Security Domain]] as the source of authorization |
| * Resources and information as the objects governed by the restriction | |
| |
| Requirements governing user or process authorization should remain in OR-003f — Security Domain Access Control. | |
| |
| Requirements governing the handling of authorized information should remain in OR-003d — Information Handling Rule Enforcement. | |
| |
| Requirements governing movement between Security Domains should remain in OR-003e — Cross-Domain Transfer Control. | |
| |
| To reference this requirement Statement from another wiki page, insert: | To reference this requirement Statement from another wiki page, insert: |