Understanding Computer Security Levels and Data Protection Standards

Security Levels in Electronic Signatures

The various levels of assurance offered by electronic signatures carry specific benefits and risks. These should be carefully evaluated by any person, company, or institution before selecting a method to send or receive electronic documents.

Types of Security Levels (A-D)

• Level D: These systems have minimal security requirements; no special criteria are needed to be considered Class D.
• Level C1: Systems must allow separation between data and users. Users must be identified and validated to be admitted, and access to specific data must be restricted.
• Level C2: Users must be able to grant or deny access to specific data. The system must maintain an audit log of requests and failed access attempts to objects (files, etc.).
• Level B1: Requires mandatory access control. Each system object (user or data) is assigned a label with a hierarchical security level (e.g., Top Secret, Secret, Reserved) and specific categories (e.g., Accounting, Payroll, Sales).
• Level B2: Must feature a verifiable theoretical security model. A designated user with specific privileges must implement security policies, distinct from the system administrator. Input and output channels must be restricted to prevent data leakage or unauthorized introduction.
• Level B3: Requires a convincing argument for system safety. Protection must be defined for each object. A reference monitor must process access requests based on defined policies. The system must be highly resistant to penetration and include an audit system to detect potential breaches.
• Level A1: Must meet all requirements of Level B3, with the addition of a formally verified security model.

Information Security Standards

Organizations must remain at the forefront of change, as continuous, reliable, and timely information constitutes a major competitive advantage.

Core Objectives of Computer Security

To maintain robust security, organizations must ensure:

• Availability: Constant access to information systems.
• Recovery: Rapid and complete restoration of information systems.
• Integrity: The completeness and accuracy of information.
• Confidentiality: Protection of sensitive information from unauthorized access.