The methodology for this framework rates network assurance based on the vulnerability of the transmission technologies to the network attack types described in . This level of vulnerability has then been associated with the information security classification levels defined in the QGISCF, as shown in table 1 below. Information security classification level (ISCL) PUBLIC UNCLASSIFIED IN-CONFIDENCE PROTECTED HIGHLY PROTECTED NTSAL-0 NTSAL-1 NTSAL-3 NTSAL-4 Network transmission security assurance level (NTSAL) Table 1: NTSAL to Information security framework The uses vulnerability as a generic means to provide guidance on securing classified information to the appropriate assurance level during transmission. Attacker ability to Outline of protection mechanisms execute Confidentiality Integrity protection Attachment control protection NTSAL-4 Extremely Information and Message Trusted validation computationally cipher keys authentication of very strong entity Provides difficult and very protected by integrity with identification and minimal low probability for very strong data message replay authentication exposure even international encryption. protection. controls restricting to espionage attachment to the organisations. network. NTSAL-3 Computationally Information and Message Strong entity difficult requiring a cipher keys authentication identification and Provides highly protected by integrity provided. authentication low sophisticated strong data controls restricting exposure attack requiring encryption. attachment to the to cryptographic skill network. and resources. A fair degree of Information in Basic message Basic entity specialised skill the clear on a integrity checking authentication Provides needed for the low vulnerability provided. controls or device moderate majority of would medium or via based access exposure be attackers, standard grade control. to providing encryption over moderation a shared/public protection domain network. NTSAL-1 or 0 Potential to be Shared access Basic or no No specific thwarted by an medium, data message error prevention against unskilled attacker sent in checking little to unauthorised –
The methodology for this framework rates network assurance based on the vulnerability of the transmission technologies to the network attack types described in . This level of vulnerability has then been associated with the information security classification levels defined in the QGISCF, as shown in table 1 below. Information security classification level (ISCL) PUBLIC UNCLASSIFIED IN-CONFIDENCE PROTECTED HIGHLY PROTECTED NTSAL-0 NTSAL-1 NTSAL-3 NTSAL-4 Network transmission security assurance level (NTSAL) Table 1: NTSAL to Information security framework The uses vulnerability as a generic means to provide guidance on securing classified information to the appropriate assurance level during transmission. Attacker ability to execute Outline of protection mechanisms Confidentiality protection Integrity protection Attachment control NTSAL-4 Provides minimal exposure to Extremely computationally difficult and very low probability for even international espionage organisations. Information and cipher keys protected by very strong data encryption. Message authentication integrity with message replay protection. Trusted validation of very strong entity identification and authentication controls restricting attachment to the network. NTSAL-3 Provides low exposure to Computationally difficult requiring a highly sophisticated attack requiring cryptographic skill and resources. Information and cipher keys protected by strong data encryption. Message authentication integrity provided. Strong entity identification and authentication controls restricting attachment to the network. Provides moderate exposure to A fair degree of specialised skill needed for the majority of would be attackers, providing moderation protection Information in the clear on a low vulnerability medium or via standard grade encryption over a shared/public domain network. Basic message integrity checking provided. Basic entity authentication controls or device based access control. NTSAL-1 or 0 Potential to be thwarted by an unskilled attacker Shared access medium, data sent in Basic or no message error checking – little to No specific prevention against unauthorised
NTSAF_v200.docx