Trusted computing base: hardware, software, amd firmware. 1 or more coponents enforce a unified security policy. uses a concept called reference monitor mediates any access by a user to any object such as data and resources, can never be bypassed, cannot by corrupted the best design isolates the reference monitor so it can't be altered by other objects or processes. You monitor it to see that it is working and that it is doing only what it is supposed to do. If you couldnt verify this the monitor wouldn't be very useful because you wouldn't know if malware had gotten around it. A trusted system can be expected to uphold any requirements that the data owners would have for reliability, security, and effectiveness. Otherwise you couldn't trust it.
Who owns the data in this system?
A user might own a data object but the reference monitor decides which subjects have access to any objects based on security clearance.
Subject: A subject is a person or a process that is trying to gain access to the object.
Object: An object is that specific thing in a trusted system that some person or process is trying to access.

Ring of Trust:
The center ring is also called the center host can access anything in any of the outer rings and is the most trusted. A host on the outermost ring is the least trusted and it can't do much. A host in one of the middle rings can access anything in a more outer ring, but nothing in a more inner ring than itself.
Rule 1)
Each host always trusts any host in a more inner ring than itself.
Rule 2)
No host trusts any host in a more outer ring than itself.
Rule 3)
Each host can trust nother host within their same ring.
Rule 4)
If a ring is segmented into separate networks, a host in one segment does not trust hosts from other segments.
TSEC:
Class A: The most secure. It would use formal security verification to make sure that the