Security Library

This document describes the X/Open Distributed Security Framework (XDSF). It identifies information system security services required to meet the needs of distributed information systems and provides guidance on the specification and integration of these services.

XSSO-PAM provides a standard interface between applications and sign-on systems so that whatever the underlying technology of the application's authentication technology, they will plug-and-play with a 'coordinating primary' single sign-on system.

This document defines:

• A set of generic events of relevance at a global distributed system level; for example, end-user system sign-on and the initiation and termination of communication sessions
• A common portable audit record format to facilitate the merging and analysis of audit information from multiple components at the distributed system level
• An API for use by applications to submit events to XDAS
• An API to import audit data from existing component-specific audit services to XDAS
• An API to configure event preselection criteria for event submission to XDAS
• An API to read records from an XDAS audit trail

Technical Corrigendum 1 for XSSO (P702).

A generally accepted definition of authorization is the granting of access rights to a subject (for example, a user or a program).

CDSA is a set of layered security services that provides the infrastructure for extensible and interoperable security solutions. It provides complete flexibility through the use of plug-in security modules that use common Application Programming Interfaces (APIs).

The CDSA/HRS (Common Data Security Architecture: Human Recognition Service) API uses the EMM (Elective Module Manager) facilities provided in the CDSA CSSM (Common Security Services Manager), to provide a generic authentication service for CDSA.

Information security is increasingly vital for businesses of all sorts.

The Guide is intended as an introductory text to CDSA, which is a set of layered security services that provides the infrastructure for extensible and interoperable security solutions.

This document presents a record of the Intrusion Attack and Response Workshop – Saving Private Data. It contains a checklist for managers whose responsibilities include their company's Incident Response Plan (IRP). The complete script is included, annotated with the main issues raised and the lessons to be learned.