Front cover - IBM Redbooks

54 Lotus Security Handbook
10.Security Policy
To provide management direction and support for information security
Finally, with each section, there are detailed statements that comprise the
standard.
2.2.3 What ISO 17799 doesn’t contain
ISO 17799 provides general guidance on the wide variety of topics listed above,
but typically does not go into depth. It takes the “broad brush” approach.
ISO 17799 thus does not provide definitive or specific material on any security
topic, and it does not provide enough information to support an in-depth
organizational information security review, or to support a certification program.
However, ISO 17799 can be useful as a high-level overview of information
security topics that can help senior management to understand the basic issues
involved in each of the topic areas.
2.3 Common Criteria (International Standard 15408)
The Common Criteria for Information Technology Security Evaluation (CC)
defines general concepts and principles of IT security evaluation and presents a
general model of evaluation. It presents constructs for expressing IT security
objectives, for selecting and defining IT security requirements, and for writing
high-level specifications for products and systems.
The CC represents the outcome of a series of efforts to develop criteria for
evaluation of IT security that are broadly useful within the international
community. In the early 1980s the Trusted Computer System Evaluation Criteria
(TCSEC) was developed in the United States. In the early 1990s Europe
developed the Information Technology Security Evaluation Criteria (ITSEC) built
upon the concepts of the TCSEC. In 1990 the Organization for Standardization
(ISO) sought to develop a set of international standard evaluation criteria for
general use. The CC project was started in 1993 to bring all these (and other)
efforts together into a single international standard for IT security evaluation. The
new Criteria was to be responsive to the need for mutual recognition of
standardized security evaluation results in a global IT market. Figure 2-3 shows
the roadmap to the Common Criteria.