Computer Security Assurance

Note: Supplemental materials are not guaranteed with Rental or Used book purchases.

ISBN: 9781401862657 | 1401862659
Cover: Paperback
Copyright: 6/1/2004

Sorry, this item is currently not available.

Written in a friendly and easy-to-understand tone, Computer Security Assurance Using the Common Criteria helps readers navigate through all the activities within the Common Criteria (CC) that have gained the attention of the security community and will revolutionize how people compare, select, purchase, and maintain security systems. Practical examples aimed at deciphering the contents and activities within the CC help build an understanding that places readers on a path to real-world security assurance applications. Up-to-date coverage explains IT security assurance methodologies and the activities within any of the CC-defined user roles that are necessary for high quality and proven secure IT software and hardware.

PART I Building Trust in Security Systems

Foundations of IT Security Assurance

(20)

Objectives

(1)

Chapter Outline

(1)

Introduction

(1)

It Products Security Controls are Woeful

(2)

Acceptance Testing is Not Enough

(1)

Principles of Security Assurance

(4)

Principle 1: There Is No Such Thing as Absolute Security!

(1)

Principle 2: Defense in Depth

(1)

Principle 3: Computer Security Depends on Two Types of Requirements--- Functional and Assurance

(1)

Principle 4: Security Goals are Confidentiality, Integrity, and Availability

(1)

The Evolutionary Path to the Common Criteria

(2)

Trusted Computer Security Evaluation Criteria (TCSEC)

(5)

Division D: Minimal Protection

(1)

Division C: Discretionary Protection

(1)

Division B: Mandatory Protection

(1)

Division A: Verified Protection

(1)

The Trusted Network Interpretation (TNI) of the TCSEC

(1)

Information Technology Security Evaluation Criteria (ITSEC)

(1)

Canadian Trusted Computer Product Evaluation Criteria (CTCPEC)

(1)

Federal Criteria for Information Technology Security (Federal Criteria, or Fc)

(1)

In Search of a Common Criteria for Security Requirements

(5)

Summary

(1)

Review Questions

(3)

The Common Criteria (CC)

(38)

Objectives

(1)

Chapter Outline

(1)

Introduction

(1)

Presidential Decision Directive 63

(2)

Government Agencies on Notice

(2)

Assembling the Common Criteria Puzzle

Development

(1)

Evaluation

(1)

Operation

(1)

Data-Link Layer (Layer 2)

(1)

Key Concepts of the Common Criteria

(1)

Protection Profile

(1)

Target of Evaluation (TOE)

(1)

Security Target (ST)

(1)

The Security Framework

(4)

The Common Criteria Approach

(2)

The Security Environment

(3)

Security Functional Requirements

(22)

Family Structure

(3)

Family Catalogue

(3)

Security Assurance Requirements

(1)

Assurance Class/Family/Component/Element Hierarchy

(2)

Assurance Components

(1)

Assurance Element

(1)

Evaluation Assurance Levels (EALS)

(4)

Assurance and Assurance Level Association

(1)

Packages

(1)

Summary

(1)

Review Questions

(3)

PART II The Pieces of the Common Criteria (CC) Puzzle

Participants and Activities within the Common Criteria

(10)

Objectives

(1)

Chapter Outline

(1)

Introduction

(1)

Assembling the Common Criteria Picture Puzzle

(2)

Toe Producer Activities

(1)

Evaluation Activities

(2)

The Role of CC Scheme Managers

(1)

Other Interested Parties and Their Roles

(1)

The Process Starts Anew

(2)

Summary

(1)

Review Questions

(2)

Developing a Protection Profile (PP)

(16)

Objectives

(1)

Chapter Outline

(1)

Introduction

(1)

A View of an Application-Level Firewall Protection File

(3)

The Protection Profile (PP) Overview

(1)

Describing the Target of Evaluation

(1)

Describing the Security Environment

(3)

Security Usage Assumptions

(1)

Security Threats

(1)

Threats Addressed by the Target of Evaluation (TOE)

(1)

Threats Addressed by the Operating Environment

(1)

Organization Security Policies

(1)

Security Objectives

(1)

TOE Security Objectives

(1)

It Security Requirements

(1)

Security Functional Requirements

(1)

Security Assurance Requirements

(2)

Rationale

(3)

Rationale for Security Objectives

(1)

Rationale for Functional Requirements

(1)

Rationale for Assurance Requirements

(1)

Summary

(1)

Review Questions

(2)

Developing a Security Target (ST)

(12)

Objectives

(1)

Chapter Outline

(1)

Introduction

(1)

A View of an Application-Level Firewall Protection File

(2)

The Security Target (ST) Overview

(1)

Describing the Target of Evaluation

(1)

Toe Security Environment

(1)

Organization Security Policies

(1)

Security Objectives

(1)

It Security Requirements

(1)

Security Functional Requirements

(1)

Toe Security Assurance Requirements

(1)

Toe Summary Specification

(1)

PP Claims

(1)

Rationale

(3)

Rationale for Internal Consistency and Mutually Supportive

(1)

Summary

(1)

Review Questions

(1)

The CCToolBox

(18)

Objectives

(1)

Chapter Outline

(1)

Introduction

(1)

Inside the CCtoolbox

100

(10)

Environment Interview

103

(1)

Context Section

104

(2)

Component Interview

106

(1)

Allocation Section

107

(1)

Elaboration Section

108

(1)

EAL Section

109

(1)

Report Section

110

(1)

The Security Target

110

(1)

Types of Evaluation

111

(2)

Certification

113

(4)

Summary

115

(1)

Review Questions

115

(2)

CC Interpretations and Issue Resolution

117

(22)

Objectives

117

(1)

Chapter Outline

117

(1)

Introduction

118

(1)

CC Interpretations Management Board (CCIMB)

119

(2)

Common Evaluation Methodology Editorial Board (CEMEB)

121

(1)

Executive Subcommittee (ES)

121

(1)

Requesting Assistance from the CCIMB

121

(1)

Sources and Types of Request for Information (RIS)

122

(3)

CC Project Insiders

123

(1)

Evaluation Laboratories

123

(1)

Evaluation Schemes

123

(1)

Providers of IT Security

124

(1)

Consumers of IT Security

124

(1)

Other Interested Party

124

(1)

Other Members of Mutual Recognition

124

(1)

Organizations Considering Joining the CC Project or CCRA

124

(1)

Organizations with Special Liaison Status

124

(1)

Reasons for Submitting RIS

125

(1)

Impact of TOE Evaluation

125

(1)

Impact on Development of IT Security Support Material

125

(1)

Impact on PP Development

125

(1)

Academic Interest

126

(1)

Categorizing RIS

126

(1)

How The CCIMB Responds to RIS

126

(3)

Error to be Fixed

127

(1)

New Criteria

127

(1)

Clarification

127

(1)

Explanation without Text Changes

127

(1)

Incorporated

127

(1)

Superseded

127

(1)

Closed Request

128

(1)

RI Detailed Processing Steps

129

(3)

Step 1: RI Coordinator

129

(1)

Step 2: RI Received

129

(1)

Step 3: Requests are Assigned

130

(1)

Step 4: RI Champion Begins Processing

130

(1)

Step 5: RI is Prioritized

130

(1)

Step 6: RI is Discussed in Order to Reach Consensus

131

(1)

Step 7: Interpretation Drafted

131

(1)

Step 8: Interpretation Finalized

132

(1)

Step 9: Interpretation Incorporated in Subsequent Version

132

(1)

Complexities in RI Processing

132

(2)

Status of the CCIMB

134

(1)

Future CCIMB Plans

135

(4)

Summary

135

(1)

Review Questions

135

(4)

PART III Evaluation Phase

Evaluating Target of Evaluations

139

(18)

Objectives

139

(1)

Chapter Outline

139

(1)

Introduction

140

(1)

CC Interpretations Management Board (CCIMB)

140

(1)

An Overview of the Evaluation Process

141

(5)

The Methodology Intent and the Role of the CEM

143

(1)

Principles of Evaluation

144

(1)

Assumptions of the Methodology

145

(1)

The General Model of the Methodology

146

(2)

Role Responsibilities

146

(2)

Evaluator Verdicts

148

(1)

The Evaluation Technical Report (ETR)

149

(3)

The Minimum Content of an ETR

149

(3)

Roles of the Testing Laboratories

152

(5)

Pre-Evaluation Preparation

152

(1)

Pre-Validation Process

153

(1)

Assigning Resources and Kick-Off

154

(1)

CCTL Evaluation Activities

154

(1)

Record Keeping

155

(1)

CCTL Post-Evaluation Responsibilities

155

(1)

Summary

156

(1)

Review Questions

156

(1)

Certification Process

157

(12)

Objectives

157

(1)

Chapter Outline

157

(1)

Introduction

158

(1)

The Formation of the Common Criteria Recognition Agreement

158

(3)

The Articles of the Common Criteria Recognition Agreement

161

(6)

Preamble

161

(1)

Spirit of the Arrangement

161

(1)

Membership (Article I)

162

(1)

Scope (Article 2)

162

(1)

Exceptions (Article 3)

162

(2)

Definitions (Article 4)

164

Conditions of Recognition (Article 5)

163

(1)

Voluntary Periodic Assessments (Article 6)

164

(1)

Publications (Article 7)

164

(1)

Sharing of Information (Article 8)

164

(1)

New Participants (Article 9)

165

(1)

Administration of this Arrangement (Article 10)

165

(1)

Disagreement (Article 11)

165

(1)

Use of Contractors (Article 12)

165

(1)

Costs of this Arrangement (Article 13)

166

(1)

Revision (Article 14)

166

(1)

Duration (Article 15)

166

(1)

Voluntary Termination of Participation (Article 16)

166

(1)

Commencement (Article 17)

166

(1)

Effect of this Arrangement (Article 18)

166

(1)

Annexes of the Arrangement

167

(2)

Summary

168

(1)

Review Questions

168

(1)

Maintenance of Assurance

169

(12)

Objectives

169

(1)

Chapter Outline

169

(1)

Introduction

170

(1)

Keeping Issued CC Certificates Current

170

(1)

Inside CC Assurance Class AMA: Maintenance of Assurance

170

(1)

Family: Assurance Maintenance Plan (AMA_AMP)

171

(1)

Family: TOE Component Categorization Report (AMA_CAT)

171

(1)

Family: Evidence of Assurance Maintenance (AMA_EVD)

171

(1)

Family: Security Impact Analysis (AMA_SIA)

171

(1)

Assurance Maintenance Paradigm

171

(1)

Assurance Maintenance Cycle

172

(4)

TOE Acceptance

174

(1)

TOE Monitoring

175

(1)

Re-Evaluation

176

(1)

NIAP and Certificate Maintenance Activities

176

(5)

Status of CMP Proposal

178

(1)

Summary

178

(1)

Review Questions

178

(3)

Common Criteria ``On the Job''

181

(92)

Objectives

181

(1)

Chapter Outline

181

(1)

Introduction

181

(1)

U.S.-Based Government Sponsors

182

(2)

U.S.-Based Commercial Sponsors

184

(4)

Sun Microsystems

184

(1)

Oracle Corporation

185

(1)

Apple Computers

186

(1)

Microsoft

186

(2)

Symantec

188

(1)

Multi-National Commercial Sponsors

188

(4)

Smart Card Security Users Group (SCSUG)

188

(1)

Eurosmart

189

(1)

eEurope

189

(1)

Electronic Commerce Security Technology Research Association (ECSEC)

190

(1)

BITS/Financial Services Roundtable

191

(1)

A Peek into the Direction of the Common Criteria

192

(2)

Protection Profile Development

193

(1)

System Evaluation

193

(1)

Composite Evaluations

194

(1)

Composite Protection Profiles

194

(1)

Common Criteria Conferences

194

(1)

Common Criteria Solves Common Problems Once and for all

195

(4)

Summary

195

(1)

Review Questions

196

(3)

PART IV Appendixes

Appendix A Sample Protection Profile (PP)

199

(20)

Appendix B Sample Security Target

219

(32)

Appendix C Common Criteria Certificate Example

251

(2)

Appendix D Common Criteria Accredited Laboratories

253

(10)

Appendix E Guidance Documentation

263

(4)

Appendix F Common Criteria Terms and Definitions

267

(6)

Index

273

Please wait while the item is added to your bag...

FREE SHIPPING

Amazon no longer offers textbook rentals. We do!

Computer Security Assurance

Summary

Author Biography

Table of Contents

Supplemental Materials