• Source: Security Target

Common Criteria for Information Technology target="_blank">Security Evaluation, version 3.1 Part 1 (called CC 3.1 or CC) defines the target="_blank">Security Target (ST) as an "implementation-dependent statement of target="_blank">security needs for a specific identified Target of Evaluation (TOE)". In other words, the ST defines boundary and specifies the details of the TOE. In a product evaluation process according to the CC the ST document is provided by the vendor of the product.
An ST defines information assurance target="_blank">security and functional requirements for the given information system product, which is called the Target of Evaluation (TOE).
An ST is a complete and rigorous description of a target="_blank">security problem in terms of TOE description, threats, assumptions, target="_blank">security objectives, target="_blank">security functional requirements (SFRs), target="_blank">security assurance requirements (SARs), and rationales. The SARs are typically given as a number 1 through 7 called Evaluation Assurance Level (EAL), indicating the depth and rigor of the target="_blank">security evaluation, usually in the form of supporting documentation and testing, that the product meets the SFRs.
An ST contains some (but not very detailed) implementation-specific information that demonstrates how the product addresses the target="_blank">security requirements.
It may refer to one or more Protection Profiles (PPs). In such a case, the ST must fulfill the generic target="_blank">security requirements given in each of these PPs, and may define further requirements.




target="_blank">Security Target outline


Introduction – an overview of what the TOE does, including key features and purpose.
ST Reference
TOE Reference
TOE Overview
TOE Description
Conformance Claims – identifies conformance claims for the TOE evaluation.
CC version conformance claims
CC Part 2 conformance claims
CC Part 3 conformance claims
PP conformance claims – strict conformance or demonstrable conformance
target="_blank">Security Problem Definition – describes the threats and assumptions about the operational environment. Objective is to demonstrate the target="_blank">security problem intended to be addressed by the TOE and its operational environment.
Threats – an adverse action performed by a threat agent on an asset. Threat agents are described by aspects such as expertise, resources, opportunity, and motivation.
Organizational target="_blank">Security Policies (OSP) – OSP is a set of target="_blank">security rules, procedures, or guidelines imposed by an organization in TOEs operational environment.
Assumptions – made only about the operational environment of the TOE behavior.
target="_blank">Security Objectives – a concise and abstract statement of the intended solution to the problem specified by the target="_blank">security problem definition. Each target="_blank">security objective must trace back to at least one threat or OSP.
aspect of target="_blank">security which to achieve is the purpose and objective of using certain mitigation measures, such as confidentiality, integrity, availability, user authenticity, access authorisation, accountability.
confidentiality, integrity or availability required to support the applicable foundational requirements.-[1]
target="_blank">Security Objectives for the TOE
target="_blank">Security Objectives for the Operational Environment
target="_blank">Security Objectives Rationale – a set of justifications that shows that all threats and assumptions are effectively addressed by the target="_blank">security objectives.
Extended Components Definition – the extended components must consist of measurable and objective elements where conformance can be demonstrated.
target="_blank">Security Requirements – defines and describes the SFRs from CC Part 2 and SARs from CC Part 3.
target="_blank">Security Functional Requirements – the SFRs form a clear, unambiguous and well-defined description of the expected target="_blank">security behavior of the TOE.
target="_blank">Security Assurance Requirements – the SARs form a clear, unambiguous and established description of the expected activities that will be undertaken to gain assurance in the TOE.
target="_blank">Security Requirements Rationale – the justification for a target="_blank">security objective for the TOE demonstrates that the SFRs are sufficient and necessary.
TOE Summary Specifications – enables evaluators and potential consumers to gain a general understanding of how the TOE is implemented.
target="_blank">Security Functions – function of a zone or conduit to prevent unauthorised electronic intervention that can impact or influence the normal functioning of devices and systems within the zone or conduit. TOE summary specification must describe how the TOE meets each SFR.
TOE target="_blank">Security Specifications – a high-level view of how the developer intends to satisfy each SFR.




See also


Common Criteria
Protection Profile
Evaluation Assurance Level (EAL)
Common Criteria Testing Laboratory




References

Kata Kunci Pencarian:

• Keamanan komputer
• Doksing
• Composite Engineering BQM-167 Skeeter
• Trojan horse (komputer)
• Makan Bergizi Gratis
• Keamanan jaringan
• Constellis
• Perangkat pembahaya
• X (media sosial)
• Israel
• Security Target
• History of Target Corporation
• Target Corporation
• Target hardening
• Common Criteria
• Security level
• United States Department of Homeland Security
• Evaluation Assurance Level
• Hard target
• Exploit (computer security)