8ICCC Update for IEEE P2600 Brian Smithson Ricoh Americas Corporation Cupertino, California, US brian.smithson@ricoh-usa.com

Agenda General information Potential interest to P2600 Plugs for P2600 Most of the presentations are now available http://www.8iccc.com Potential interest to P2600 “Update on the US scheme” “Composite evaluation” (different from Composition) “Optional security requirements and functions” “CC3.1 release 2” Plugs for P2600 “How vendor involvement can improve CC” “P2600, breaking new ground…”

“Update on the US scheme” 2007 Program resources severely constrained Validation Oversight Reviews instead of continuous oversight Only accepted Medium or High Robustness PP-compliant products Initiated fee-for-service (legislation approved, fees posted for comment) 2008 Continue to maintain program with constrained resources Focus on PP-compliant and EAL4 evaluations Research / implement methods for increasing efficiency, consistency, value Common Criteria Testing Labs 8 accredited labs 3 candidate labs (BKP, BT, DIAL) Products (Aug 07) 149 products “in evaluation” 210 product certificates issued to date Protection Profiles (PPs) 42 Validated PPs 24 U.S. Government PPs being converted to CC V3.1 8 of the U.S. Government PPs are being sunsetted http://www.8iccc.com/media/doc/Update%20on%20US%20Scheme_Dale%20Audrey.ppt

“Composite evaluation” (different from Composition) Presented by T-Systems, uses refinement of EAL SARs http://www.8iccc.com/media/doc/Composite%20Evaluation%20for%20Smart%20Card%20and%20similar%20devices_Furgel%20Igor.pdf

“Optional security requirements and functions” Presented by SAIC Proposes a way to handle options at time of purchase, installation, or use Presence or absence of components (e.g. Solaris Trusted Extensions) Enabled or disabled functions (e.g. network services or licensed features) Supporting components in the operational environment (e.g. platform, LDAP or DBMS services, client browsers) Focuses on STs, but similar concepts could apply to PPs Acknowledges that there can be combinatorial issues http://www.8iccc.com/media/doc/Common%20Criteria%20Optional%20Security%20requirements%20and%20functions_Arnold%20Jr%20James%20L.%20.ppt

“CC3.1 release 2” Changes are coming from: Mostly editorial CCRA comments: 98 patches JTC/1 SC27 WG3: 121 patches Mostly editorial User data vs TSF data definitions: update User data and TSF data definition, to remove the source as discriminating criteria Some management recommendations changed One significant relevant change: FPT_AMT.1 (abstract machine testing) deleted, no longer dependency of FPT_TST.1 FPT_TEE.1 (testing of external entities) added, should be considered for P2600 in addition/replacement to FPT_TST.1 Will be published with and without change marks It will be ISO/IEC 15408-n:2006 (or 2007?) Not sure when drafts will be officially published http://www.8iccc.com/media/doc/CC%20v3.1%20release%202,%20what%20has%20changed_Banon.pdf

Plugs for P2600 “How vendor involvement can improve CC” Wesley Higaki of Symantec cited “smart card and copier vendors” as driving PP development for their industries “IEEE P2600, breaking new ground… Was generally well received