In 1990, the National Research Council published Computers at Risk(1) (CAR), a landmark book that emphasized the urgent need for the nation to focus attention on information security. The GSSP document is a direct result of recommendation number one from CAR (see Appendix A for CAR recommendation details).
Recommendation 1 -- Promulgation of a comprehensive set of Generally Accepted System Security Principles, referred to as GSSP, which would provide a clear articulation of essential features, assurances, and practices.
The CAR report proposes the Generally Accepted Accounting Practices as a model for GSSP. It cites the Building Code and the Underwriter's Laboratory as examples of GSSP in other fields. It also recommends building on the experience captured by using the TCSEC, the TNI, and the ITSEC documents to create a broader set of criteria that will drive a more flexible process for evaluating single-vendor and conglomerate systems.
Securing today's automated information systems and protecting information assets is a product of an iteration of processes. These processes are a progression of preventive, detective, and corrective measures. Information gathering; designing, selecting, or specifying safeguards; implementing safeguards; maintaining and administering safeguards; and estimating the value of information assets and their potential for impact due to loss or compromise are examples of preventive measures. Detective processes include measuring the effectiveness of preventive steps; and monitoring, recording, analyzing, responding to and reporting of events. Finally, promoting solutions to developers, management, and industry; training for security awareness and job-specific needs; and responding to environmental changes (e.g., organizational, threats, vulnerabilities, or new technologies) are examples of corrective actions. The introduction of an accepted, uniform, code of practice would strengthen these processes. Therefore, each of these processes should be carried out in accordance with generally accepted system security principles.