1. Stephen S. Yau CSE 465-591, Fall 2006 1 Evaluating Systems for Functionality and Assurance

2. Stephen S. Yau CSE 465-591, Fall 2006 2 Evaluation for Functionality and Assurance Evaluation is a process in which the evidence for assurance is gathered and analyzed against criteria for functionality and assurance. Evaluation can result in a measure of trust indicating how well a system meets selected criteria –A system is trusted if it has been shown to meet users’ security requirements under specific conditions –Trust is based on assurance evidence t1- ch18, t2-ch21

3. Stephen S. Yau CSE 465-591, Fall 2006 3 Evaluation for Functionality and Assurance (cont.) An evaluation methodology provides following features: –A set of requirements defining security functionality –A set of assurance requirements specifying required evidence of assurance –A methodology for determining whether the security requirements are satisfied based on the assurance evidence. –A measure of the evaluation result (called a level of trust) indicating how trustworthy the product or system is

4. Stephen S. Yau CSE 465-591, Fall 2006 4 Trusted Computer System Evaluation Criteria (TCSEC) Developed in 1983-1999, by U.S./DoD Also known as the Orange Book Emphasizing confidentiality, especially protection of government classified information Impact: –Create an approach to identifying how secure a product is Limitations: –Focus on security needs of U.S. government and military –Not address integrity, availability or other requirements critical to business applications t1- ch18.2, t2-ch21.2

5. Stephen S. Yau CSE 465-591, Fall 2006 5 Information Technology Security Evaluation Criteria (ITSEC) Developed in 1991-2001 by Europe Union Major distinction between TCSEC and ITSEC –ITSEC emphasizes on integrity and availability, while TCSEC emphasizes on confidentiality Impact: –Can be used to evaluate any kinds of products or systems Limitations: –Weak in developing functional requirements –Not used in Canada and the U.S. t2-ch21.3

6. Stephen S. Yau CSE 465-591, Fall 2006 6 Federal Criteria (FC) Developed in 1992, by U.S./NIST, NSA Attempt to address the shortcomings of TCSEC and of ITSEC by adding new criteria for both classified and unclassified information Impacts: –Established the concept of protection profile, which is an abstract specification of the security aspects of a IT product. –Developed a profile registry that makes FC-approved protection profiles available for general use Limitation: –The FC has not been finalized and published t2-ch21.6

7. Stephen S. Yau CSE 465-591, Fall 2006 7 Common Criteria (CC) Developed at 1998 – present, by Canada, France, Germany, The Netherlands, the United Kingdom and the United States It is an international standard, also known as ISO 15408 Impacts: –Combines the best features of preceding methodologies, such as TCSEC with the ITSEC and the FC –Provides a common language and structure to express both security functional requirements and security assurance requirements Limitation: –Continue being developed, still needs time to test and refine t1- ch18.4, t2-ch21.8

8. Stephen S. Yau CSE 465-591, Fall 2006 8 System Security Engineering Capability Maturity Model (SSE-CMM) Developed at 1997 – present, by U.S./International Systems Security Engineering Association (ISSEA) A process-oriented methodology for developing secure systems based on Software Engineering Capability Maturity Model (SE-CMM) Impact: –Can be used to assess the capabilities of security engineering processes of an organization and provide guidance in designing and improving them Limitation: –Analysis is complex t1- ch18.5, t2-ch21.9