Common Criteria V3 Overview Presented to P2600 October Brian Smithson

What have they done!?  Summary  Conceptual model  Structural changes

Summary of changes  Part 1 More consistent terminology introduced Changes in the ASE (Security Target Evaluation) and APE (Protection Profile Evaluation) assurance classes  Part 2 Complicated terms simplified or removed Concepts simplified and clarified Underlying model developed Reduced 11 classes to 6, 67 families to 45, 354 pages to 130

Summary (2)  Part 3 ASE and APE reorganized and rewritten to give a higher assurance-to-work ratio ACM/ADO/AGD/ALC classes rearranged with clearer purpose into ALC and AGD ADV also gives more assurance for less work ATE updated to reflect the new ADV ABA merged Strength of Function (SOF) with Vulnerability Analysis (VLA), and merged Misuse (MSU) into AGD A new class, ACO, deals with composition

Summary (3)  CEM New CEM is presented according to class, not EAL, and methodology is provided for all components up to EAL5  EAL1 is now easier You can do a “low assurance level” PP and ST Just do SFRs, SARs, no Security Problem Definition

Conceptual model 1.Security in the operational environment 2.Security in the development environment 3.Evaluation

Security in the operational environment  Assets in the operational environment are defined in terms of value to the owners  Key factors: Risk Countermeasures

How are these countermeasures evaluated?  Countermeasures must be: Sufficient (in conjunction with countermeasures in the operational environment) to counter the threats Correct in that they don’t contain vulnerabilities which could prevent it from working

Sufficiency of the TOE  Starts with a Security Problem Definition: Assets and threats to those assets Relevant Organizational Security Policies Relevant Assumptions about the operational environment  Describe a partwise solution Solution provided by the TOE Solution provided by the operational environment  The parts provided by the TOE are Security Functional Requirements (SFRs)  The collection of SFRs is the TOE Security Policy (TSP)  A TOE which fulfills the TSP is sufficient, as long as the TOE has been correctly designed and implemented

Security in the development environment  Correctness of implementation depends on the development environment  Assets in the development environment are defined in terms of value to the developers

Correctness of the TOE implementation  Starts with a Security Problem Definition Assets (in the development environment) and threats to those assets Relevant Organizational Security Policies that apply to the development environment  Solutions to the problem are Security Assurance Requirements (SARs)  If all SARs are met, then there is assurance that the TOE is implemented correctly

Evaluation model  Key concepts: Risk Countermeasures Assurance

Structural changes