Using the common criteria for IT security evaluation

Using the Common Criteria for IT Security Evaluation

Volumn , Issue , 2002, Pages 1-289

  Herrmann, Debra S ^a  

^a Biological Computing Initiative   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

CRITICAL INFRASTRUCTURES; LIFE CYCLE; MERGERS AND ACQUISITIONS; NASA; PUBLIC WORKS; SECURITY SYSTEMS;

ACQUISITION POLICIES; CRITICAL INFRASTRUCTURE SYSTEMS; EDUCATIONAL SETTINGS; GOVERNMENT OFFICIALS; INFORMATION ASSURANCE; INTELLIGENCE AGENCIES; INTERNATIONAL STANDARDS; PRESIDENTIAL DECISION DIRECTIVES;

NETWORK SECURITY;

EID: 85055232535     PISSN: None     EISSN: None     Source Type: Book    
DOI: 10.1201/9781420031423     Document Type: Book

References (127)

1. DoD 5200.28-M, ADP Computer Security Manual: Techniques and Procedures for Implementing, Deactivating, Testing, and Evaluating Secure Resource-Sharing ADP Systems, U.S. Department of Defense, January 1973.
2. DoD 5200.28-M, ADP Computer Security Manual: Techniques and Procedures for Implementing, Deactivating, Testing, and Evaluating Secure Resource-Sharing ADP Systems, with 1st Amendment, U.S. Department of Defense, June 25, 1979.
3. CSC-STD-001-83, Trusted Computer System Evaluation Criteria (TCSEC), National Computer Security Center, U.S. Department of Defense, August 15, 1983.
4. DoD 5200.28-STD, Trusted Computer System Evaluation Criteria (TCSEC), National Computer Security Center, U.S. Department of Defense, December 1985.
5. CSC-STD-003-85, Guidelines for Applying the Trusted Computer System Evaluation Criteria (TCSEC) in Specific Environments, National Computer Security Center, U.S. Department of Defense, June 1985.
6. CSC-STD-004-85, Technical Rationale Behind CSC-STD-003-83, National Computer Security Center, U.S. Department of Defense, 1985.
7. NCSC-TG-025, version 2, A Guide to Understanding Data Remembrance in Automated Information Systems (AIS), National Computer Security Center, U.S. Department of Defense, September 1991.
8. NCSC-TG-005, version 1, Trusted Network Interpretation of the TCSEC, National Computer Security Center, U.S. Department of Defense, July 1987.
9. NCSC-TG-011, version 1, Trusted Network Interpretation of the TCSEC, National Computer Security Center, U.S. Department of Defense, August 1, 1990.
10. NCSC-TG-021, version 1, Trusted DBMS Interpretation of the TCSEC, National Computer Security Center, U.S. Department of Defense, April 1991.
11. DDS-2600–6243–91, version 1, Compartmented-Mode Workstation Evaluation Criteria, Defense Intelligence Agency, U.S. Department of Defense, 1991.
12. Federal Criteria for Information Technology Security, version 1.0 (Vols. I and II), jointly published by the U.S. National Institute of Standards and Technology and National Security Agency, December 1992.
13. Information Technology Security Evaluation Criteria (ITSEC), version 1.2, Office for Official Publications of the European Communities, June 1991.
14. Information Technology Security Evaluation Manual (ITSEM), Office for Official Publications of the European Communities, 1992.
15. Secure Information Processing versus the Concept of Product Evaluation, Technical Report ECMA TR/64, European Computer Manufacturers’ Association, December 1993.
16. Guidelines for the Security of Infor mation Systems, Organization for Economic Cooperation and Development (OECD), November 1992.
17. The Canadian Trusted Computer Product Evaluation Criteria (CTCPEC), Canadian System Security Centre, Communications Security Establishment, version 3.oe, 1993.
18. UKSP01, UK IT Security Evaluation Scheme: Description of the Scheme, Communications-Electronics Security Group, March 1991.
19. ISO/IEC 15408-1(1999-12-01), Information Technology — Security Techniques — Evaluation Criteria for IT Security — Part 1: Introduction and General Model.
20. ISO/IEC 15408-2(1999-12-01), Information Technology — Security Techniques — Evaluation Criteria for IT Security — Part 2: Security Functional Requirements.
21. ISO/IEC 15408-3(1999-12-01), Information Technology — Security Techniques — Evaluation Criteria for IT Security — Part 3: Security assurance requirements
22. ISO/IEC PDTR 15446(2001-04), Information Technology — Security Techniques — Guide for the Production of Protection Profiles and Security Targets.
23. Arrangement on the Recognition of Common Criteria Certificates in the Field of Information Technology Security, May 23, 2000.
24. CEM-97/017, Common Methodology for Information Technology Security Evaluation, Part 1: Introduction and General Model, version 0.6, November 1997.
25. CEM-99/045, Common Methodology for Information Technology Security Evaluation, Part 2: Evaluation Methodology, version 1.0, August 1999.
26. CC/CEM supplements: (a) CEM-2001/0015R, Common Methodology for Information Technology Security Evaluation, Part 2: Evaluation Methodology, Supplement: ALC_FLR — Flaw Remediation, version 1.1, February 2002; and (b) CCIMB-2002-04-011, Common Methodology for Information Technology Security Evaluation, Supplement: ASE — Security Target Evaluation, (draft) version 0.6, May 2002.
27. CCIMB Final Interpretation-004, ACM_SCP. 1C Requirements Unclear, November 12, 2001.
28. CCIMB Final Interpretation-006, Virtual Machine Description, October 15, 2000.
29. CCIMB Final Interpretation-Augmented and Conformant Overlap, July 31, 2001.
30. CCIMB Final Interpretation-009, Definition of “Counter,” April 13, 2001.
31. CCIMB Final Interpretation-013, Multiple SOF Claims for Multiple Domains in a Single TOE, October 15, 2000.
32. CCIMB Final Interpretation-024, Required Evaluation Evidence for Commercial “Off the Shelf” (COTS) Products, February 16, 2001.
33. CCIMB Final Interpretation-025, Level of Detail Required for Hardware Descriptions, July 31, 2001.
34. CCIMB Final Interpretation-027, Events and Functions in AGD_ADM, February 16, 2001.
35. CCIMB Final Interpretation-031, Obvious Vulnerabilities, February 16, 2001.
36. CCIMB Final Interpretation-032, Strength of Function Analysis in ASE_TSS, October 15, 2000.
37. CCIMB Final Interpretation-033, Use of “Check” in Part 3, October 15, 2000.
38. CCIMB Final Interpretation-037, ACM on Product or TOE?, February 16, 2001.
39. CCIMB Final Interpretation-043, Meaning of “Clearly Stated” in APE/ASE_OBJ.1, February 16, 2001.
40. CCIMB Final Interpretation-049, Threats Met by Environment, February 16, 2001.
41. CCIMB Final Interpretation-055, Incorrect Components Referenced in Part 2 Annexes, FPT_RCV, October 15, 2000.
42. CCIMB Final Interpretation-058, Confusion Over Refinement, July 31, 2001.
43. CCIMB Final Interpretation-062, Confusion Over Source of Flaw Reports, July 13, 2001.
44. CCIMB Final Interpretation-064, Apparent Higher Standard for Explicitly Stated Requirements, February 16, 2001.
45. CCIMB Final Interpretation-065, No Component to call out Security Function Management, July 31, 2001.
46. CCIMB Final Interpretation-067, Application Notes Missing in ST, October, 15, 2000.
47. CCIMB Final Interpretation-069, Informal Security Policy Model, March 30, 2001.
48. CCIMB Final Interpretation-074, Duplicate Informative Text for ATE_COV.2-3 and ATE_DPT.1-3, October 15, 2000.
49. CCIMB Final Interpretation-075, Duplicate Informative Text for ATE_FUN.1-4 and ATE_IND.2-1, October 15, 2000.
50. CCIMB Final Interpretation-080, APE_REQ.1-12 Does Not Use “Shall Examine … to Determine,” October 15, 2000.
51. CCIMB Final Interpretation-084, Separate Objectives for TOE and Environment, February 16, 2001.
52. CCIMB Final Interpretation-092, Release of the TOE, July 31, 2001.
53. CCIMB Final Interpretation-094, FLR Guidance Documents Missing, July 31, 2001.
54. CCIMB Final Interpretation-095, ACM_CAP Dependency on ACM_SCP, February 16, 2001.
55. CCIMB Final Interpretation-116, Indistinguishable Work Units for ADO_DEL, July 31, 2001.
56. CCIMB Final Interpretation-120, Indistinguishable Work Units for ADO_DEL, July 31, 2001.
57. CCIMB Final Interpretation-127, Work Unit Not at the Right Place, October 29, 2001.
58. CCIMB Final Interpretation-128, Coverage of the Delivery Procedures, October 29, 2001.
59. CCIMB Final Interpretation-133, Consistency Analysis in AVA_MSU.2, February 16, 2001.
60. EN 45001, General Criteria for the Operation of Testing Laboratories, CEN/CENELEC, 1989.
61. EN 45011, General Criteria for Certification Bodies Operating Product Certification Systems, CEN/CENELEC, 1989.
62. ISO/IEC 13335-1(1996-12), Information Technology — Guidelines for the Management of IT Security — Part 1: Concepts and Models for IT Security.
63. ISO/IEC 13335-2(1997-12), Information Technology — Guidelines for the Management of IT Security — Part 2: Managing and Planning IT Security.
64. ISO/IEC 13335-3(1998-06), Information Technology — Guidelines for the Management of IT Security — Part 3: Techniques for the Management of IT Security.
65. ISO/IEC 13335-4(2000-03), Information Technology — Guidelines for the Management of IT Security — Part 4: Selection of Safeguards.
66. ISO/IEC 13335-5(2001-11), Information Technology — Guidelines for the Management of IT Security — Part 5: Management Guidance on Network Security.
67. ISO/IEC 17025(1999), General Requirements for the Competence of Calibration and Testing Laboratories; superseded ISO/IEC Guide 25 (1990).
68. ISO/IEC Guide 65(1996), General Requirements for Bodies Operating Product Certification Systems.
69. ISO/IEC 17799(2000-12), Information Technology — Code of Practice for Information Security Management.
70. ISO/IEC 15292(2001-12), Information Technology — Security Techniques — Protection Profile registration procedures.
71. ISO 2382-8(1998-11), 2.0, Information Technology — Vocabulary — Part 8: Security.
72. ISO 9000(2000) Compendium, International Standards for Quality Management.
73. NSTISSP #11: National Information Assurance Acquisition Policy, National Security Telecommunications and Information System Security Committee, January 2000.
74. NSTISSAM INFOSEC/2-00, Advisory Memorandum for the Strategy for Using the National Information Assurance Partnership (NIAP®) for the Evaluation of Commercial Off-the-Shelf (COTS) Security Enabled Information Technology Products, February 8, 2000.
75. NSTISSAM COMPUSEC/1-99, Advisory Memorandum on the Transition from the Trusted Computer System Evaluation Criteria (TCSEC) to the International Common Criteria for Information Technology Security Evaluation, March 11, 1999.
76. NSTISSI #1000: National Information Assurance Certification and Accreditation Process (NIACAP), National Security Telecommunications and Information System Security Committee, April 2000.
77. NSTISSI #4009: National Information System Security (INFOSEC) Glossary, National Security Telecommunications and Information System Security Committee, January 1999.
78. FIPS PUB 140-2, Security Requirements for Cryptographic Modules, National Institute of Standards and Technology, U.S. Department of Commerce, May 25, 2001.
79. FIPS PUB 197, Advanced Encryption Standard (AES), National Institute of Standards and Technology, U.S. Department of Commerce, November 26, 2001.
80. NIST Special Publication 800-21, Guidelines for Implementing Cryptography in the Federal Government, National Institute of Standards and Technology, U.S. Department of Commerce, November 1999.
81. NIST Special Publication 800-23, Guidelines to Federal Organizations on Security Assurance and Acquisition: Use of Tested/Evaluated Products, National Institute of Standards and Technology, U.S. Department of Commerce, August 2000.
82. Public Law 100-235, Computer Security Act of 1987, January 8, 1988.
83. Public Law 104-106, Information Technology Management Reform Act 1996.
84. OMB Circular A-130, Appendix III: Security of Federal Automated Infor mation Resources, February 8, 1996.
85. PDD-63, Critical Infrastructure Protection, Presidential Decision Directive, May 13, 1998.
86. Information Assurance Technical Framework (IATF), version 3.0, September 2000.
87. System Security Engineering Capability Maturity Model (SSE-CMM), version 2.0, April 1999.
88. Systems Security Engineering Capability Maturity Model (SSE-CMM) Appraisal Method, version 2.0, April 1999.
89. Common Criteria ToolboxTM, version 6.0f, June 2001.
90. Abrams, M., Parraga, F., and Veoni, J., Application of the Protection Profile to Define Requirements for a Telecommunications Services Contract, Paper presented at the 1st Symposium on Requirements Engineering for Information Security, CERIAS, Purdue University, West Lafayette, IN, March 2001.
91. Belvin, F., Introduction to the CEM, paper presented at the 23rd National Information Systems Security Conference, October 2000.
92. Caplan, K. and Sanders, J., Building an international security standard, IT Professional, 1(2), 29–34, 1999.
93. Common Criteria: An Introduction, Common Criteria Project Sponsoring Organizations, October 1999.
94. Common Criteria for Information Technology Security Evaluation: User Guide, Common Criteria Project Sponsoring Organizations, October 1999.
95. Gertz, B., CIA: Russia, China working on infor mation warfare, The Washington Times, June 22, 2001, p. A3.
96. Herrmann, D. and Keith, S., Application of Common Criteria to telecomm services, Computer Security Journal, 17(2), 21–28, 2001.
97. Herrmann, D., A Practical Guide to Security Engineering and Information Assurance, Auerbach, Boca Raton, FL, 2001.
98. Kekicheff, M., Kashef, F., and Brewer, D., The Open Platform Protection Profile (OP3): Taking the Common Criteria to the Outer Limits, paper pr esented at the 23rd National Information Systems Security Conference, October 2000.
99. McEvilley, M., Introduction to the Common Criteria, paper presented at the 23rd National Information Systems Security Conference, October 2000.
100. NIAP, Organization, Management, and Concept of Operations, version 2.0, Common Criteria Evaluation and Validation Scheme (CCEVS) for IT Security, Scheme Publication 1, National Information Assurance Partnership, May 1999.
101. NIAP, Validation Body Standard Operating Procedures, draft 1.5, Common Criteria Evaluation and Validation Scheme (CCEVS) for IT Security, Scheme Publication 2
102. National Information Assurance Partnership, May 2000.
103. NIAP, Guidance to Validators of IT Security Evaluations, Common Criteria Evaluation and Validation Scheme (CCEVS) for IT Security, Scheme Publication 3, National Information Assurance Partnership, February 2002.
104. NIAP, Guidance to Common Criteria Testing Laboratories (CCTLs), version 1.0, Common Criteria Evaluation and Validation Scheme (CCEVS) for IT Security, Scheme Publication 4, National Information Assurance Partnership, March 20, 2001.
105. NIAP, Guidance to Sponsors of IT Security Evaluations, draft 1.0, Common Criteria Evaluation and Validation Scheme (CCEVS) for IT Security, Scheme Publication 5, National Information Assurance Partnership, August 31, 2000.
106. NIAP, Certificate Maintenance Program, Common Criteria Evaluation and Validation Scheme (CCEVS) for IT Security, Scheme Publication 6, National Information Assurance Partnership, December 2002.
107. NVLAP Directory 2002, NIST Special Publication 810, National Institute of Standards and Technology (note: this document is updated annually).
108. Neumann, P., Computer Related Risks, Addison-Wesley, Reading, MA, 1995.
109. NVLAP Handbook 150, National Institute of Standards and Technology and U.S. Department of Commerce, July 2001.
110. Cryptographic Module Testing, NVLAP Handbook 150-17, National Institute of Standards and Technology and U.S. Department of Commerce, June 2000.
111. Information Security Testing: Common Criteria, version 1.1, NVLAP (draft) Handbook 150-20, National Institute of Standards and Technology and U.S. Department of Commerce, April 1999.
112. Written Procedures for NVLAP® Handbook 150-20, NVLAP Lab Bulletin LB-5-2001, October 2001.
113. Olthoff, K., Thoughts and Questions on Common Criteria Evaluations, paper presented at the 23rd National Information Systems Security Conference, October 2000.
114. Smith, R., Trends in Government Endorsed Security Product Evaluations, paper presented at the 23rd National Information Systems Security Conference, October 2000.
115. TM, paper presented at the 23rd National Information Systems Security Conference, October 2000.
116. www.commoncriteria.org; centralized resource for current information about the Common Criteria standards, members, and events.
117. www.iatf.net; Information Assurance Technical Framework standard and forum.
118. www.nstissc.gov/Assets/pdf/nstissi_1000.pdf; National Information Assurance Certification and Accreditation Process (NIACAP).
119. Http://niap.nist.gov; National Information Assurance Partnership (NIAP®).
120. http://csrc.nist.gov; National Institute of Standards and Technology (NIST), Computer Security Resource Clearinghouse.
121. http://csrc.nist.gov/crptval; information about NIST cryptographic validation program.
122. www.nist.gov/nvlap; National Voluntary Laboratory Accr editation Program (NVLAP®) publications, including current listing of accredited laboratories.
123. http://secinf.net/info/policy/hk_polic.html; Computer and information security policy.
124. www.psycom.net/war.1.html; Institute for the Advanced Study of Information Warfare.
125. www.iec.ch.org; International Electrotechnical Commission.
126. www.sse-cmm.org/librarie.htm; Latest information about SSE–CMM.
127. www.issea.org; Latest information about SSE–CMM.