Trusted Computing Base (TCB)

The trusted computing base is every protection mechanism in a system, across hardware, firmware and software, that the system’s security policy depends on. The definition comes from the Orange Book (DoD 5200.28-STD, 1985) and it is about responsibility rather than location: a component is in the TCB if the system’s security relies on it behaving correctly, and outside if the system survives it misbehaving. The imaginary line around it is the security perimeter, and anything crossing that line has to be mediated.

Trusted here does not mean trustworthy or verified. It means depended upon. A kernel flaw can switch off every control layered above it, so the kernel is in the TCB whether or not anyone has checked it. That is also why minimality is a design goal: everything inside must be verified, verification effort grows with size, and a smaller TCB therefore supports higher assurance. The security kernel is the part of the TCB that implements the reference monitor concept, and protection rings are the hardware that keeps untrusted code outside the boundary.

Exam relevance: a scenario asking which components must be trusted, or where a boundary should be drawn, is asking about the trusted computing base. Watch for answer options that limit it to software: hardware and firmware are named in the definition, and a question may turn on recognising that all three are in scope.