2 cissp ® Official Study Guide Eighth Edition

313
Know what confinement, bounds, and isolation are. 
Confinement restricts a process to 
reading from and writing to certain memory locations. Bounds are the limits of memory 
a process cannot exceed when reading or writing. Isolation is the mode a process runs in 
when it is confined through the use of memory bounds.
Be able to define 
object
 and 
subject
 in terms of access. 
The subject is the user or process 
that makes a request to access a resource. The object is the resource a user or process wants 
to access.
Know how security controls work and what they do. 
Security controls use access rules to 
limit the access by a subject to an object.
Be able to list the classes of TCSEC, ITSEC, and the Common Criteria. 
The classes of 
TCSEC include verified protection, mandatory protection, discretionary protection, and 
minimal protection. Table 8.4 covers and compares equivalent and applicable rankings for 
TCSEC, ITSEC, and the CC (remember that functionality ratings from F7 to F10 in ITSEC 
have no corresponding ratings in TCSEC).
Define a trusted computing base (TCB). 
A TCB is the combination of hardware, software, 
and controls that form a trusted base that enforces the security policy.
Be able to explain what a security perimeter is. 
A security perimeter is the imaginary 
boundary that separates the TCB from the rest of the system. TCB components communi-
cate with non-TCB components using trusted paths.
Know what the reference monitor and the security kernel are. 
The reference monitor is 
the logical part of the TCB that confirms whether a subject has the right to use a resource 
prior to granting access. The security kernel is the collection of the TCB components that 
implement the functionality of the reference monitor.