Session objectives. Security Evaluation. Evaluation Standards. Can we trust a secure product/system? CSM27 Computer Security

Transcription

1 Overview Session objectives Security Evaluation CSM27 Computer Security Dr Hans Georg Schaathun University of Surrey Discuss advantages and limitations of security evaluations Clarify fundamental concepts and terminology in security evaluation Give an overview of the Common Criteria, enabling students to find appropriate documentation when needed Autumn 2008 Week 8 Dr Hans Georg Schaathun Security Evaluation Autumn 2008 Week 8 1 / 21 Dr Hans Georg Schaathun Security Evaluation Autumn 2008 Week 8 2 / 21 Overview Can we trust a secure product/system? Evaluation Standards Overview Do you trust the manufacturer? Can you scrutinise and evaluate the product/system yourself? Is there an indenpendent evaluation or certification? What is the difference between product and system? What practical difference does it make for the evaluator? TCSEC (Orange Book) USA CTCSEC Canada 1989 ITSEC Europe (EU Council 1995) Common Criteria Canada, France, Germany, the Netherlands, UK, and USA, 1998 International treaty: Common Criteria Recognition Agreement Evaluation Scheme needed to join Replaces TCSEC, ITSEC,... Dr Hans Georg Schaathun Security Evaluation Autumn 2008 Week 8 3 / 21 Dr Hans Georg Schaathun Security Evaluation Autumn 2008 Week 8 4 / 21

2 Target Purpose Product generic products generic requirements Security Classes (TCSEC) Protection Profile (Common Criteria) System local and individual requirements dialogue between security expert and non-expert user Distinctions in the Orange Book Evaluation assess achievement of claimed properties Certification suitability for a given application Accreditation acceptance for a given application Dr Hans Georg Schaathun Security Evaluation Autumn 2008 Week 8 5 / 21 Dr Hans Georg Schaathun Security Evaluation Autumn 2008 Week 8 6 / 21 Method Organisational Framework We have to avoid Different results from different evaluations Security bugs found after a positive evaluation Goals: Reproducability and Repeatability Two methodologies Product-oriented (aka. investigational) considers the final product Establishes trust in a particular product Process-oriented (aka. audit-oriented) considers the development process (Potentionally) Establishes trust in a particular producer Government Agencies (initial US approach) Private Enterprises with Government Accreditation Government Certificates (UK 1991) Private Certification (Germany) What is the contract between...? Sponsor Evaluator Manufacturer Dr Hans Georg Schaathun Security Evaluation Autumn 2008 Week 8 7 / 21 Dr Hans Georg Schaathun Security Evaluation Autumn 2008 Week 8 8 / 21

3 Organisational Challenges Structure Consistency across independent agencies Different people make different interpretations Interpretation drift Different interpretations at different times Functionality Which features are provided? Effectiveness Are the features appropriate for the requirements? Assurance How thorough/certain is the evaluation? The orange book couples the three considerations into discrete security classes ITSEC makes the three considerations separately Flexible framework; open for new requirements Dr Hans Georg Schaathun Security Evaluation Autumn 2008 Week 8 9 / 21 Dr Hans Georg Schaathun Security Evaluation Autumn 2008 Week 8 10 / 21 Basic Concepts International Treaty Common standards documents CC documents CC Evaluation Methodology (CEM) Member states may have different implementations Evaluation Scheme or National Scheme Protection Profile (PP) describes the protection needed in a given application scenario Security Target (ST) describes the protection provided by (classes of) systems/products ST implements a PP Dr Hans Georg Schaathun Security Evaluation Autumn 2008 Week 8 11 / 21 Dr Hans Georg Schaathun Security Evaluation Autumn 2008 Week 8 12 / 21

4 Security Functional Requirements Functional Requirements Classes An example This part of the CC defines the required structure and content of security functional components for the purpose of security evaluation. It includes a catalogue of functional components that will meet the common security functionality requirements of many IT products. Communications class (two families) Non-repudiation of origin Non-repudiation of receipt Cryptographic support Security Audit User data protection... Dr Hans Georg Schaathun Security Evaluation Autumn 2008 Week 8 13 / 21 Dr Hans Georg Schaathun Security Evaluation Autumn 2008 Week 8 14 / 21 Security Assurance Requirements Assurance Classes This CC Part 3 defines the assurance requirements of the CC. It includes the evaluation assurance levels (EALs) that define a scale for measuring assurance for component TOEs, the composed assurance packages (CAPs) that define a scale for measuring assurance for composed TOEs, the individual assurance components from which the assurance levels and packages are composed, and the criteria for evaluation of PPs and STs. Evaluation methodology for every document/product/system/etc. APE: Protection Profile Evaluation ASE: Security Target Evaluation Seven classes relating to product or system Development Delivery and Operation Tests... Dr Hans Georg Schaathun Security Evaluation Autumn 2008 Week 8 15 / 21 Dr Hans Georg Schaathun Security Evaluation Autumn 2008 Week 8 16 / 21

5 Evaluation Assurance Levels Do we need evaluation standards? EAL1: Functionally Tested EAL2: Structurally Tested EAL3: Methodically Tested and Checked EAL4: Methodically Designed, Tested, and Reviewed EAL5: Semiformally Designed and Tested EAL6: Semiformally Verfied Design Tested EAL7: Formally Verified Design and Tested Levels 5-7 have not been standardised internationally yet Controversial Requirement for government applications The standards are tokens of government trust Standardisation essential for public sector markets Little enthusiasm outside public sector [Gollmann] Some exceptional industries do want standardised evaluation At present: Smart Card Manufacturer Evaluation covers one version and one configuration Evaluation takes time probably not most recent version Dr Hans Georg Schaathun Security Evaluation Autumn 2008 Week 8 17 / 21 Dr Hans Georg Schaathun Security Evaluation Autumn 2008 Week 8 18 / 21 Cost and Benefit Exercise sheet Expensive : 10% 40% of development cost Fees to the evaluator Production of supporting documentation Delay to market Criterion in certain markets All depends on the customer Is the money better spent elsewhere? Security Management, etc.? Are Quality Standards an alternative? Refer to the Common Criteria portal Choose one protection profile (PP) which interests you, and the security targets (ST) of a product implementing this PP. Compare the PP and the ST, and identify any differences. Based on this comparison, what is your opinion of the product? For which applications is the product suitable? Dr Hans Georg Schaathun Security Evaluation Autumn 2008 Week 8 19 / 21 Dr Hans Georg Schaathun Security Evaluation Autumn 2008 Week 8 20 / 21

6 Discussion Exercise Compare Evaluation and Consultancy Consultants advise clients on suitable solutions for their applications (including security requirements). Where would you draw the boundary between evaluation and consultancy? What do consultants do? What does an evaluation do? Are there any situations where you would clearly choose one over the other? Dr Hans Georg Schaathun Security Evaluation Autumn 2008 Week 8 21 / 21