scope:

This Recommendation I International Standard addresses the application of security services in an Open Systems environment, where the term "Open Systems" is taken to include areas such as Database, Distributed Applications, Open Distributed Processing and OSI. The Security Frameworks are concerned with defining the means of providing protection for systems and objects within systems, and with the interactions between systems. The Security Frameworks are not concerned with the methodology for constructing systems or mechanisms.

The Security Frameworks address both data elements and sequences of operations (but not protocol elements) which are used to obtain specific security services. These security services may apply to the communicating entities of systems as well as to data exchanged between systems, and to data managed by systems.

The purpose of security audit and alarms as described in this Recommendation International Standard is to ensure that open system-security-related events are handled in accordance with the security policy of the applicable security authority. In particular, this framework:

a) Defines the basic concepts of security audit and alarms:

b) Provides a general model for security audit and alarms; and

c) Identifies the relationship of the Security Audit and Alarms service with other security services.

As with other security services, a security audit can only be provided within the context of a defined security policy.

The Security Audit and Alarms model provided in clause 6 supports a variety of goals not dl of which may be necessary or desired in a particular environment. The security audit service provides an audrt authority with the ability to specify the events which need to be recorded within a security audit trail.

The purpose of security audit and alarms as described in this Recommendation International Standard is to ensure that open system-security-related events are handled in accordance with the security policy of the applicable security authority.

In particular, this framework:

a) Defines the basic concepts of security audit and alarms:

b) Provides a general model for security audit and alarms; and

c) Identifies the relationship of the Security Audit and Alarms service with other security services.

A number of different types of standard can use this framework including :

1) Standard that incorporate the concept of audit and alarms :

2) Standard that specify abstract services that include audit and alarms;

3) Standard that specify uses of audit and alarms:

4) Standard that specify the means of providing audit and alarms within an open system architecture; and

5) Standards that specify audit and alarms mechanisms.

6) Such standard can use this framework as follows:

- Standard types 1),2),3),4) and 5) can use the terminology of this framework;

- Standard types 2),3),4) and 5) can use the facilities defined in clause 8; and

- Standard types 5) can be based upon the characteristics of mechanism defiend in clause 9.