Publication Date:  16 February 1996
System Version:  GCCS 2.1/Update 5
Web Page Created:  

Setup.  To accomplish this lesson, you need GCCS connectivity and access to the GCCS Session Manager and JOPES applications from the JNAV window.

Overview.  This lesson covers selected GCCS and JOPES topics related to security and permissions.  In addition, you will login to the system, access JOPES applications, and navigate within the windows environment.

Now that you have a road map of what you will be doing for the next hour, the lesson continues by laying some basic groundwork for understanding some of the security and permissions issues associated with JOPES in the GCCS environment.

OBJECTIVE.  Without the use of references, identify three possible breaches of GCCS or JOPES security.

GCCS Security Program.  The initial GCCS LAN configuration operates in a Secret system high security mode of operation.  This means that all personnel with access to the system must possess at least a Secret clearance, but will not necessarily have a need-to-know for all data in the system.

Currently, none of the operating systems implemented in the initial GCCS installation, except for the 486 PC Tigersafe add-on security subsystem, have been evaluated by the National Computer Security Center (NCSC) and assigned a rating.  Until GCCS is accredited to operate in a specific security mode, it is recommended that special care be taken with data and files that need special protection.  You should assume that all users have access to all information in the system.

Note:  The NCSC is planning security certification tests during the time that the user assessment of the JOPES applications is occurring.

Software Security.  JOPES is a Secret high group of application programs resident on GCCS.  Access to these applications is controlled through several layers of permissions.
System Access Control.  The ISSO ensures that personnel requesting access to GCCS have a Secret security clearance.  The ISSO then assigns an initial password to each USERID and registers both in the system using the GCCS software.  The password is classified Secret while the USERID is unclassified.  The registration of the USERID and password provides that USERID access to the system, not necessarily any applications on the system.

Application Access Control.  Access to the various GCCS applications is controlled at two levels.  The first level of control is exercised by assigning various application icons to the Launch Window of each specific USERID.  The second level of control is exercised by granting each specific USERID access to the myriad of directories and files that make up each specific application.

Terminal Security Packages.  A security package requiring user identification and password access to many of the different types of workstations being used is generally automatically provided by the operating system and initial software load.  That is, when the machine is turned on or booted, the first screen provided will require a USERID and password for the operator to continue.  Currently, the most obvious exception to that is the DOS-based workstations that generally start at the DOS prompt when booting.  This is especially true if the DOS workstation is being used only to run the JOPES application JFAST.  Protection for those workstations can be provided by the use of an additional security package.  Using the security package, the workstation can be configured to require a USERID and password for access.  The COTS package usually used for security is called "Tigersafe." 

Personal Security.

Identification and Authentication.  Authorized GCCS users have unique identities and are required to identify themselves before accessing any of the systems' resources.  This is accomplished through the use of a USERID (identification) and password (authorization).  You are allowed to modify your password.  The following rules (extracted from the security manual) should apply to all individual passwords for GCCS:
Passwords must be at least six, but not more than eight, characters in length and contain at least two alpha characters and one numeric or punctuation character.

Note:  The system software will accept and work with 6, 7, or 8 character passwords.

Passwords will not display on the screen when entered.

The maximum number of password entry attempts is three successive tries.

Note:  The system currently allows you to try until you get it right.

Passwords will be changed at least every 90 days.

Note:  Currently, this is an individual users responsibility.  The software does not require it to happen.

Discretionary Access Control (DAC).  DAC is a further restriction of user access beyond the login point.  UNIX employs DAC to control access to various files.  UNIX files are controlled by three different types of permissions (read, write, and execute) that are assigned to three different categories of users (owner, group, and other).  The category of user to which your USERID belongs, and the type of permission granted to that USERID, controls what you can do with the information in that particular file.

Data (File) Access Controls.  Almost everything in GCCS (all of the programs, data, etc.) is stored in various files.  Access to each of those programs, databases, etc., is controlled by the relationship between your USERID and the DAC mechanism used by UNIX.

Database Access Control.  Access to the various databases in GCCS (JOPES, GSORTS, EVAC, etc.) is separately controlled by the combination of your USERID and the DAC mechanism used by UNIX.

Physical Security.  The hardware in the GCCS environment also has controls imposed on it.  Fiber-optic cables are treated differently than nonfiber-optic cable connections.  Servers and workstations may be placed in secure alarmed areas.  Computer screens should not be visible through outside windows and not visible to uncleared personnel within an office or building.

Product/Output Security.  System output can be assigned to three general categories:  output to the screen, output to hardcopy (printer), and output to a file (on the system or to a floppy disk or tape).

Screen.  Screen output will normally have classification markings at the top and bottom.  In JOPES, the level of classification (Secret, Confidential, Unclassified) is driven by the classification level assigned to the OPLAN.

Reports.  Reports generated by the JOPES software have classification markings on the top and bottom of each page.  The level of classification is again generated by the classification level of the OPLAN.

Files.  File output can be to the server or workstation hard drive.  File attributes on the hard drives do not have any provisions for classification markings.  Information downloaded to floppy disks or to tapes will require the appropriate markings.

Now that you have had a quick review of some of the security requirements and permission schemes being used, you will turn your attention to logging in to the system.

OBJECTIVE.  Given a GCCS environment, login to the server and access a specified GCCS application (JOPES).

General GCCS/JOPES Login and Navigation.  The first two security considerations you must deal with are your USERID and password.  A user account with a USERID will be created for you by the ISSO on the GCCS system, and you will be assigned an initial password.  You must use them to login to GCCS.
Login.  The login sequence may be a little different for each type of workstation.  The USERID and password protect classified information stored on the workstation and/or server and control access to the LAN.

Remote Login.  Remotely located (non-LAN) users will have a few additional steps to accomplish the login sequence.

Procedures.  Users will need to access the communications server either via a STU-III connection or a MUX/KG connection.

Character User Interface (CUI).  If the communications link (9600 baud or lower) cannot efficiently handle graphic applications or you have a non-mouse capable workstation, you may not be able to access the full capability of the graphical user interface (GUI) available to the more powerful machines.  You may have to use the CUI.  Functional capability will be impacted because several applications have only a graphics capability.  In addition, navigation will be different.  The GUI uses a mouse for navigation while CUI is strictly forms mode and keyboard driven.

The login you use for this lesson should be close to the standard procedure for all the UNIX based workstations (SPARC, WWS, and HP).

Note:  If logging into a UNIX based computer, all typed entries dealing with UNIX features (directories, files, login, etc.) are case sensitive (upper/lower case letters).

Note:  The { } symbol in a keystroke table denotes a user defined variable entry.

Note:  The application icons shown in Figure 2-1 are unique for each specific USERID.  Your Launch Window may have more or less icons available.

User Interface Screens/Windows.  The initial display consists of the GCCS Session Manager menu line across the top and a window interface called the Launch Window.
Session Manager.  The administrative tasks and applications you access from the Session Manager are taught by the USAF Air Education and Training Command (AETC).  This lesson primarily demonstrates some of the navigation required to access and administer JOPES functional applications from the Session Manager.

Note:  The Session Manager menus may be different for each specific type of workstation.

GCCS/JOPES Help and Assistance.  There are many different types of Help available when there is a question as to what is required in a single field or what specific windows are designed to do.
On-line Help.  If you have specific questions about this screen or any of the other GCCS interfaces, your first source of on-screen information is available from the Help options.  There are several styles of Help available in GCCS.
Some applications have Help buttons.

Some applications use the <F1> function key for Help.

Some applications have context-sensitive Help where you <POINT AND CLICK (left)> on text or an area of the screen.

Some applications have Help menu options like the screen in Figure 2-1.  The different styles will be pointed out or demonstrated as they occur.

The OK and Apply buttons at the bottom of the window serve different purposes.
If you select OK, the Help item pick-list closes and the Help information you selected displays.

If you select Apply, the Help item pick-list remains open and the Help information you requested displays.

This convention applies to all Session Manager menus that have the OK and Apply options.  OK terminates the function when finished, and Apply keeps the function active.

The scroll bar on the right side allows you to view additional information.

If you <POINT AND CLICK (left)> on an arrowhead, the display moves up or down one line.

If you <POINT AND CLICK (left)> above or below the button within the scroll bar, the display moves one page at a time.

If you drag the button to a new location, the display moves to that relative position.

In addition to the Help windows, there are other sources available for assistance if you are having system or functional problems.
Site Functional Manager.  The local Site Functional Manager generally enjoys the reputation of being a JOPES expert.  That reputation may or may not be appropriate, but that is how many users view the FM.  Many FMs have been working in the JOPES arena for extended periods of time.

Documentation.  DISA is also providing boxes of documentation as the loading of GCCS software progresses.  That documentation includes load and maintenance instructions for the System Administrators, guidance for the Database Administrators, and user's manuals for everyone who is interested.  In addition to these hard copies, many of the JOPES User Manuals and User Guides are also available on-line through the JNAV window.

JOPES Training Organization.  The staff at the JOPES Training Organization also are ready to provide assistance whenever possible.  They have a wealth of experience upon which to draw as well as being involved with the software currently being used in the client/server environment.

Global System Problem Report.  There may be occasions when Help cannot resolve software deficiencies or something does not provide the functional results expected.  When that happens, you should complete a Global System Problem Report, DISA Form 291, and forward it in accordance with site procedures.  See Appendix F to this document for a copy of the form and its completion instructions.

GCCS Session Manager Launch Window.  The Launch Window now displayed in the middle of the Session Manager screen allows you to select specific GCCS applications.  The applications available to you are based on the user account established for your USERID.  To launch an application, you can <POINT AND CLICK (left)> on the icon and <ENTER> or you can <POINT AND DOUBLE CLICK (left)> on the icon.  The first icon you will launch is JOPES.

JNAV Window.  The JNAV window provides access to many of the JOPES applications as well as providing access to Help information for each of those applications.  The words for the name of the application provides access to the help information, while the start button launches that application.

Navigation To and Between GCCS/JOPES Applications.  You can access several different applications and have them running at the same time.
Active Window.  Whenever you activate an application or menu option, such as System Services, the system creates an interface window (screen) for your use.  The new window will be the active window and the border will be gray instead of black.
If you wish to select a new application, such as FTPtool, <POINT AND DOUBLE CLICK (left)> on the application icon in the Launch Window if the icon is visible.  If the icon is not visible, <POINT AND CLICK (left)> on the header line or a border line of the Launch Window to bring it to the foreground and select the new application.  That selection will create a new active window for user interaction.

You currently have three windows open.  They are the Launch Window, the SS Help window, and the System Services window.  The more windows you have open, the slower the system becomes.  You should manage the number of open windows because processes on the windows in the background use memory and continue to run.  If you iconify a window, it consumes less memory.

Window Management.  The windows themselves have buttons and objects you can use to help manage the screen display.

Move.  You can move a window to a different location on the screen by dragging the window's header line to the new location.

Requirement.  Find the Launch Window and move it to the lower right corner of the Session Manager screen.  Move and resize the SS Help window; iconify it; and iconify the JNAV window.

Raise/Lower.  To bring a window to the foreground, <POINT AND CLICK (left)> on its header or border lines.  To put a window in the background, <POINT AND CLICK (right)> on the header or border lines.

Note:  Some workstations may provide you a menu when you <POINT AND HOLD (right)> on the header or border lines.  If that occurs, select the "lower" menu option.

Resize.  The Maximize/Minimize button [] in the upper right resizes the window to fill the whole screen or returns the window to its original size.  You can also resize a window by dragging the borders and corners to new locations.