IT-Security Evaluation Criteria

Organisation and Construction of Security Requirements:
Classb Family k Component Packages
Component
…. Protection Profile
Component Possible
Input sources
for PP
Classa Familiy j Component
Package:
Reusable set of either functional or assurance components (e.g, EALs )
Security Target (ST):
Set of security requirements used as a basis for evaluation of an identified
TOE
Family i Component
Component
…,
Component Security Target
Possible
Component Optional extended input sources
…… (non-CC) Security for ST
Component Requirements
Tillämpad datasäkerhet (DAVC17) – Security Evaluation Criteria Simone Fischer-Hübner 21
Tillämpad datasäkerhet (DAVC17) – Security Evaluation Criteria Simone Fischer-Hübner 22
Protection Profile (PP):
Implementation-independent, reusable set of security-requirements for a
category of TOEs that meet specific consumer needs
Example PPs:
- Commercial security profile
- Profiles to replicated TCSEC C2 and B1 requirements
- A role based access control (RBAC) profile
- Smart card profiles
- Firewall profiles
CC registry system for approved PPs
Functional Security Requirements (Part 2):
Classes of Security Functional Requirements:
• FAU (Security Audit)
• FCO (Communication/Non-Repudiation)
• FCS (Cryptographic Support)
• FDP (User Data Protection)
• FIA (Identification and Authentication)
• FMT (Security Management)
• FPR (Privacy)
• FPT (Protection of the TOE Security Functions)
• FRU (Resource Utilisation)
• FTA (TOE Access)
• FTP (Trusted path/channels).
Tillämpad datasäkerhet (DAVC17) – Security Evaluation Criteria Simone Fischer-Hübner 23
Tillämpad datasäkerhet (DAVC17) – Security Evaluation Criteria Simone Fischer-Hübner 24