Assessing and Managing Security Risk in IT Systems

6: THE McCUMBER CUBE

INTRODUCTION

The McCumber Cube is shorthand for a paper published as “Information Systems Security: A Comprehensive Model,”¹ in October 1991. The model itself was also used by the National Security Telecommunications and Information Systems Security Committee (NSTISSC) and published in National Security Telecommunications and Information Systems Security Instruction’s (NSTISSI) National Information Systems Security (INFOSEC) Glossary.²

The McCumber Cube was developed as a response to the attempts in the late 1980s and early 1990s to define the relationship between the communications and computer security disciplines. As the advent of the Internet age dawned, it was clear the distinction made little sense. However, no one ...