Contributors - CyberSecurity Malaysia

32.Usually, in any CC scheme, there will be four partiesinvolved in the evaluation and certification of a product:1) The developer who developed the product or thesponsor who sponsored the developer for their productcertification. [Note: The term ‘sponsor’ will be usedonwards to represent the sponsor/developer in thecontext of this article]2) The consultant who has been contracted by thesponsor to produce the documentation necessary forevaluation. However, the consultant is an optionalparticipant depending on the sponsor’s willingnessto hire them. The sponsor can also produce the CCdocumentation on their own.3) The evaluation facilities/laboratory which is thephysical venue/location used in evaluating the productagainst CC requirements by the evaluators.4) The certification body, usually a government agencythat oversees the evaluation process and eventuallygives out the certificate that states the product hasbeen successfully evaluated and therefore, certified.How does the use of a CC certified productincrease CNII security, resilience and self-reliance?Common Criteria is a product security framework.CC comprises three important parts:Part 1: Introduction and the CC General ModelPart 2: Security Functional ComponentsPart 3: Security Assurance ComponentsAll three parts are linked in a Common EvaluationMethodology (CEM). Part 1 is all about CC in general. Part2 describes security requirements in CC language. Thesponsor needs to interpret their product security functionsin terms of CC language by picking and matching the SecurityFunctional Requirements (SFR) in Part 2 to the productsecurity functions. This is important in standardising thesecurity functions used in one terminology, which is theCC terminology. Part 3 is the assurance requirement thatcovers major aspects of a product development process– security problem definition, security features usedto mitigate security problems, development, life cycle,testing, and vulnerability assessment. Identification anderadication of security flaws discovered on the product,system or life-cycle development during evaluation willresult in a more robust IT product or system. Improvementof security engineering practices for the IT product orsystem developers during development and maintenanceactivities is important, and if neglected, may result invulnerability of the product or system.The important thing to highlight is that assurancerequirement in CC comprise standard phases of a productdevelopment process and emphasises the security ofthe environment where the product is installed. Securityis not only enforced by the product but also depends onthe people and environment that surround the product.Thus, it gives consumers (who can be public consumers,consumers from the government sector or private sector)a level of assurance on the reliability and security featuresenforced by the product.How to promote CC implementationPromote CC benefits to local developersMarket Access: When a product gets CC certification, theproduct gains access to new markets and opportunities,especially in countries that are a signatory to the CommonCriteria Recognition Arrangement such as Australia,Germany, United States, United Kingdom, Japan and Korea.In these countries, CC is mutually recognised as a standardthat provides assurance of the reliability of any evaluatedsecurity feature.Independent Verification: Gaining independent verificationof security claims in an ICT product or system usingstandard terms (CC terms) for product comparison isadvantageous and becomes a market differentiator. Aproduct which is CC certified definitely has an advantagebecause its security functions have been evaluated andverified by an evaluation facility.Increase security awareness to consumerIn CC evaluation, a documentation called Security Target(ST) will be produced by the sponsor to define their Targetof Evaluation (TOE), which are parts of product featuresthat will be evaluated. The ST also specifies the scope ofevaluation, security problems that the TOE solves, theassumptions put into the environment that will ensure theeffectiveness of the TOE, and the evaluated TOE securityfeatures. Thus, a consumer who is aware of informationsecurity will definitely want to know all the contents thathave been specified in the ST as their basis for productcomparison.Government directive on purchasing CC certifiedproductsThe first step to implement this directive is to call forthe developments of Protection Profile (PP) from usercommunities, IT product developers, or a combinationof both user and developer. A PP is a specification of acommon set of security requirements for a security problemwhich is not product specific, evaluated by an evaluationfacility and verified by a certification body. A PP can beon a Firewall, Smart Card, network device, or any systemor device that is protecting valuable assets (information,infrastructure) in government sectors. PP is treated as arequirement for security features of that particular producttype. Policies can be developed to reflect any product thatis going to be purchased by the government. It is critical toprotect the government’s assets. Hence, there is a need fora product to comply with the requirements in a PP, whichmeans that the product needs to be CC certified.