Hi All
The security design principle in NIST SP 800-160, Vol. 1, that is critically important when building systems with commercial-off-the-shelf products (i.e., hardware, software, and firmware components) with limited to no knowledge of the products’ trustworthiness is “Self-Reliant Trustworthiness.”
Principle: The trustworthiness of a system element is achieved with minimal dependence on other elements.
In the ideal case, the trustworthiness of a system element occurs when the claim of trustworthiness is not dependent on protection from another system element. If an element is dependent on other elements to satisfy its trustworthiness claims, then that element’s trustworthiness is susceptible to any loss or degradation of the protection capability provided by the other element. The considerations for the extent to which a system element exhibits self-reliant trustworthiness include:
- The trustworthiness objective for the capability
- The trustworthiness of the system element in providing the capability
- The extent to which the capability provided by a system element is dependent on another element
- The extent to which the trustworthiness associated with a capability is dependent on another system element
An argument for “Self-Reliant Trustworthiness” can be applied at the discrete system element level, the level of an aggregate of elements, the system level, or the system-of-systems level. In all cases, the distinction between the capability provided and the trustworthiness responsibility for that capability must be preserved (e.g., self-reliant trustworthiness cannot be claimed if the protection assertions for trust are allocated to and dependent on some other entity). Similarly, when a system capability is distributed across multiple system elements, self-reliant trustworthiness requires that the trust expectations for the capability be properly allocated across the elements that comprise the distributed capability.
The judgment that a particular system element is self-reliant trustworthy is based on the system element’s ability to satisfy a specific set of requirements and associated assumptions. A system element that is self-reliant trustworthy for one set of requirements and assumptions is not necessarily self-reliant trustworthy for other sets of requirements and assumptions. Any changes in requirements, satisfaction of requirements, or in assumptions associated with requirements, necessitates a reassessment to determine that the system element remains self-reliant trustworthy.
The security design principle of “Self-Reliant Trustworthiness” is closely related to and works hand-in-hand with the design principle of “Substantiated Trustworthiness.”
https://csrc.nist.gov/pubs/sp/800/160/v1/r1/final
Regards
Caute_Cautim
