Common Criteria CC-101 Introduction

Transcription

1 Common Criteria CC-101 Introduction Yanet Manzano Florida State University 1 Outline CC History Informally Defined Official Definition Goals Parts Important Definitions Interest Parties Consumers Developers Evaluators 2 1

2 C C CC stands for Common Criteria the named used historically for the standards in lieu of its official ISO name of Evaluation Criteria for Information Technology Security 3 CC History Developed through a collaboration among national security and standards organizations within: Canada The Netherlands France Germany The United Kingdom The United States As a common standards to replace their 4 existing security evaluation criteria. 2

3 CC Informally Defined A standard method of expressing requirements A catalog of possible security requirements A matching set of assurance test procedures A standard testing methodology 5 CC Official Definition NIAP Common Criteria Evaluation and Validation Scheme for IT Security (CCEVS) Meant to be used as the basis for evaluation of security products and systems Established by NIST and NSA under NIAP National Information Assurance Partnership 6 3

4 CC Goals To provide: cost-effective evaluation of IT products performed to consistent standards a wider choice of evaluated products for consumer greater understanding of consumer requirements 7 CC Parts Part 1: Introduction and General Model Part 2: Security Functional Requirements Part 3: Security Assurance Requirements 8 4

5 Important Definitions (1) Functional Requirement: Define security Behavior of the IT product or system Implemented requirements become security functions Security Requirements : For establishing confidence in security functions Correctness of implementation 9 Important Definitions (2) Target of Evaluation (TOE): An IT product or system and its associated administrator, and user guidance documentation that is the subject of an evaluation Protection Profile(PP): An implementationindependent set of security requirements for a category of TOEs that meet specific consumer needs Security Target(ST): A set of security 10 requirements and specifications to be used as the 5

6 CC Interested Parties 3 Key CC User Groupings 11 CC Interested Parties: Consumers Part 1: Introduction and General Model Background information and reference purposes. Guidance structure for PPs Part 2: Security Functional Requirements Guidance and reference when formulating statements of requirements for security functions Part 3: Security Assurance Requirements Guidance when determining required level of assurance 12 6

7 CC Interested Parties: Developers (1) Part 1: Introduction and General Model Background Information Reference for development of requirements an formulating security specifications for TOEs. 13 CC Interested Parties: Developers (2) Part 2: Security Functional Requirements Reference when (a) and (b) for TOEs. (a) interpreting statements of functional requirements (b) formulating functional specifications Part 3: Security Assurance Requirements Reference when (a) and (b) for TOEs. (a) interpreting statements of assurance requirements 14 7

8 CC Interested Parties: Evaluators (1) Part 1: Introduction and General Model Background Information Reference purposes Guidance structure for PPs and STs 15 CC Interested Parties: Evaluators (2) Part 2: Security Functional Requirements Mandatory statement of evaluation criteria when determining whether a TOE meets claimed security functions Part 3: Security Assurance Requirements Mandatory statement of evaluation criteria when: Determining the assurance of TOEs Evaluating PPs, or STs 16 8

9 CC-101 Future Presentations: CC-101 > CC Part 1 CC-101 > CC Part 2 CC-101 > CC Part