Topic 7

Lesson 7. Software Certification by Security Criteria: Methodology of the "Common Criteria" Standard (ISO/IEC 15408), Protection Profiles, and EAL Security Assurance Levels

Objective: formation of a holistic system of knowledge, methodological culture and practical engineering skills in the field of information technology security assessment and certification in accordance with the requirements of the international standard ISO/IEC 15408 (“Common Criteria”) and the national regulatory framework of Ukraine. The student must master the philosophical and engineering basis of security assessment (assessment of the active actions of the attacker instead of analyzing random errors), study the historical retrospective of the evolution of regulatory requirements (from TCSEC and ITSEC to the CCRA agreement) and understand the role of an independent third party in conformity assessment. In the learning process, special attention is paid to mastering the two-dimensional engineering framework of requirements - distinguishing and end-to-end tracing of Functional Security Requirements (SFR classes: FAU, FCS, FDP, FIA, etc.) and Security Assurance Requirements (SAR classes: ADV, ALC, ATE, AVA, etc.). Students should learn to design key regulatory artifacts: define the boundaries and perimeter of the Object of Evaluation (TOE), analyze industry Protection Profiles (PP) and develop Security Tasks (ST) with the acquisition of skills in building trace chains "threat - target - SFR - SAR". In addition, students should master the 7-level scale of assurance assessment levels (EAL 1 - EAL 7), understanding the volume of the evidence base and the stringency of the code coverage criteria for each of them. An important practical result is mastering the structure of the national system of TZI, the functions of the regulator (DSSZZI) and the procedure for passing the 5-stage procedural regulations of the state examination to obtain an official Expert Opinion and enter the software into the State Register of Permitted Protection Means.