Closed_sessions_REV2.pdf

SOFTWARE CLOSED SESSION REQUIREMENT

One of the primary responsibilities of the SCC is to deliver Computer Software Configured Items

(CSCI) to our users. In the past, we have accepted open session and packet written CD/DVDs and have been able to re-image them using our software to make them duplicable and unalterable by users.

Although no changes were made to the software, it is technically a new disc and not the original configured item delivered to the SCC. For these reasons, the SCC will no longer accept open session closed multi-session or packet written disks for distribution. The following information for this policy decision is explained in the next paragraphs.

Many standard disk replicators are unable to make verifiable copies of open session disks. In addition, open session disks can be modified after images are created from them, and in all likelihood any disks that can be replicated from open session masters will be modifiable as well. It is a security risk to have master disks and/or distributed copies which are open to modification either accidentally or purposefully, and with or without malicious intent. The master disk needs to be replicable, verifiable and not subject to modification after copies have been made and fielded.

Packet-written disks also pose problems for standard replicators, since their header information is written before the disk contents are created; they also cannot be packaged into standard ISO images for electronic distribution. Packet-written masters received by the SCC must be copied to a hard drive and re-written to a new master, and then verified file-by-file, before the software can be replicated, duplicated, distributed or archived. The simpler and less labor-intensive method is for the software developer to provide the disks in a standard format.

Any approved CD/DVD burning software will have in its preferences an option to select Disk at

Once (DAO), Closed Session for creating the disk. The Help section of the software can provide instructions on how to change these setting to create Closed Session disks. If needed, the SCC can provide guidance.

For those involved in contracting issues, please specify to the contractors who deliver software that this is a requirement for them also.

In addition, ALL software delivered to SCC must have the appropriate Distribution Statements on the media. For guidance on Distribution Statements, please refer to DODI 5230.24, August 23, 2012.