1. 8ICCC Update for IEEE P2600 Brian Smithson Ricoh Americas Corporation
Cupertino, California, US

2. Agenda General information Potential interest to P2600 Plugs for P2600
Most of the presentations are now available
Potential interest to P2600
“Update on the US scheme”
“Composite evaluation” (different from Composition)
“Optional security requirements and functions”
“CC3.1 release 2”
Plugs for P2600
“How vendor involvement can improve CC”
“P2600, breaking new ground…”

3. “Update on the US scheme”
2007
Program resources severely constrained
Validation Oversight Reviews instead of continuous oversight
Only accepted Medium or High Robustness PP-compliant products
Initiated fee-for-service (legislation approved, fees posted for comment)
2008
Continue to maintain program with constrained resources
Focus on PP-compliant and EAL4 evaluations
Research / implement methods for increasing efficiency, consistency, value
Common Criteria Testing Labs
8 accredited labs
3 candidate labs (BKP, BT, DIAL)
Products (Aug 07)
149 products “in evaluation”
210 product certificates issued to date
Protection Profiles (PPs)
42 Validated PPs
24 U.S. Government PPs being converted to CC V3.1
8 of the U.S. Government PPs are being sunsetted

4. “Composite evaluation” (different from Composition)
Presented by T-Systems, uses refinement of EAL SARs

5. “Optional security requirements and functions”
Presented by SAIC
Proposes a way to handle options at time of purchase, installation, or use
Presence or absence of components (e.g. Solaris Trusted Extensions)
Enabled or disabled functions (e.g. network services or licensed features)
Supporting components in the operational environment (e.g. platform, LDAP or DBMS services, client browsers)
Focuses on STs, but similar concepts could apply to PPs
Acknowledges that there can be combinatorial issues

6. “CC3.1 release 2” Changes are coming from: Mostly editorial
CCRA comments: 98 patches
JTC/1 SC27 WG3: 121 patches
Mostly editorial
User data vs TSF data definitions: update User data and TSF data definition, to remove the source as discriminating criteria
Some management recommendations changed
One significant relevant change:
FPT_AMT.1 (abstract machine testing) deleted, no longer dependency of FPT_TST.1
FPT_TEE.1 (testing of external entities) added, should be considered for P2600 in addition/replacement to FPT_TST.1
Will be published with and without change marks
It will be ISO/IEC n:2006 (or 2007?)
Not sure when drafts will be officially published

7. Plugs for P2600 “How vendor involvement can improve CC”
Wesley Higaki of Symantec cited “smart card and copier vendors” as driving PP development for their industries
“IEEE P2600, breaking new ground…
Was generally well received