Guideline for Developer Documentation Christian Krause 8th ICCC / September 26th, 2007 Federal Office for Information Security

Christian KrauseSeptember 26th, 2007 Folie 2  CEM contains detailed requirements regarding the developer evidence  Therefore developers who intend to get involved in a CC evaluation has to consult the CEM What makes the use of the CC/CEM for developer difficult?

Christian KrauseSeptember 26th, 2007 Folie 3  Structure and content of the CEM has been optimised to serve as an evaluation directive for evaluators  That makes the use of the CEM for developers in particular with less CC experience difficult What makes the use of the CC/CEM for developer difficult?

Christian KrauseSeptember 26th, 2007 Folie 4 A lot of information is only relevant for the evaluation, but not for the preparation of the developer evidence  ADV: Evaluator analyses regarding accuracy  Requirements regarding site visits  ATE_IND  AVA_VAN  Guidance on sampling strategies ... What makes the use of the CC/CEM for developer difficult?

Christian KrauseSeptember 26th, 2007 Folie 5 The motivation of the requirements is not obvious in any case  What’s the use of so much paper work? The navigation is circumstantially for developers  e. g. developers has to consult the CC for the assurance component corresponding to the chosen EAL and then search in the CEM for the right requirements What makes the use of the CC/CEM for developer difficult?

Christian KrauseSeptember 26th, 2007 Folie 6 To ease the adoption of the CC for developers with less CC experiences, BSI has issued a Guideline for Developer Documentation  Covering all assurance components up to EAL5 (without classes ASE/APE which are considered in a separate ST/PP Guide) Developer Guideline

Christian KrauseSeptember 26th, 2007 Folie 7 Assurance Components addressed in the Guideline

Christian KrauseSeptember 26th, 2007 Folie 8 The Guideline offers assistance to developers by  extracting the information regarding the developer evidence from the CC/CEM,  structuring the information customised for the developer needs,  explanation of the context and background,  examples and  a sample document structure with explanations for the use as template for the developer documentation Content and Structure of the Developer Guideline

Christian KrauseSeptember 26th, 2007 Folie 9  Short Introduction to CC/CEM with overview of assurance classes  Explanation of the differences between the EALs  What does a higher EAL mean for  developer  evaluator  customer  Description of the additional requirements from an EAL to the next higher EAL Introduction to CC and CEM

Christian KrauseSeptember 26th, 2007 Folie 10 Introduction to CC and CEM Example:

Christian KrauseSeptember 26th, 2007 Folie 11 Extracted Requirements for developer evidence  Requirements for developer evidence  labelled with colours for simple navigation  extract of requirements that have to be fulfilled by the developer  prepared in an order suitable from a developer’s view  explanation of related evaluator actions

Christian KrauseSeptember 26th, 2007 Folie 12 Extracted Requirements for developer evidence Example:

Christian KrauseSeptember 26th, 2007 Folie 13 Explanation of the context If reasonable additional information is given in a structured form  Background  Elucidation of the background  Note  Hint for developer  Role in the evaluation process  Explanation of the role in the evaluation process (What is the goal of the requirement?)  Examples  Depict how a requirement could be fulfilled

Christian KrauseSeptember 26th, 2007 Folie 14 Explanation of the context Example:

Christian KrauseSeptember 26th, 2007 Folie 15 Explanation of the context Example:

Christian KrauseSeptember 26th, 2007 Folie 16 Sample Document Structure with explanations  Can be used by developers as template for the preparation of developer documentation  Is a possibility to simplify evaluations by providing a standard structure for developer documentation Sample Document Structure

Christian KrauseSeptember 26th, 2007 Folie 17 Sample Document Structure Example (1):

Christian KrauseSeptember 26th, 2007 Folie 18 Sample Document Structure Example (2):

Christian KrauseSeptember 26th, 2007 Folie 19 Guideline for Developer Documentation  Download

Christian KrauseSeptember 26th, 2007 Folie 20 Contact Bundesamt für Sicherheit in der Informationstechnik (BSI) Christian Krause Godesberger Allee Bonn Tel: +49 (0) Fax: +49 (0)