Common Criteria (CC) constitutes an internationally recognized framework of guidelines and specifications crafted to assess information security products. Its primary objective is ascertaining compliance with a standardized security benchmark suitable for government implementations. Common Criteria, formally termed “Common Criteria for Information Technology Security Evaluation,” encompasses two principal elements: Protection Profiles and Evaluation Assurance Levels.
The Concept of Target of Evaluation (TOE)
The Target of Evaluation (TOE) refers to the specific product or system undergoing the Common Criteria evaluation. Through this process, the claims regarding the TOE are substantiated, ensuring the validation of its security features for practical application. This could encompass diverse entities, from entire information systems to individual components. Central to defining the TOE is establishing its boundary and delineating the scope of the evaluation.
All pertinent documentation is subsumed within the TOE, ensuring a comprehensive assessment. The TOE also includes all associated documentation. The TOE is evaluated against the Security Functional Requirements (SFRs) established in its Security Target (ST). The evaluation serves to validate claims made about the target. This allows vendors to tailor the evaluation to match the intended capabilities of their product accurately.
Significance of TOE
The TOE (Target of Evaluation) plays a pivotal role within the Common Criteria evaluation process, serving as the central point for validating claims regarding the security posture of a product or system. It is the focal point where security functionalities are scrutinized and tested against established criteria.
Through a meticulous examination against Security Functional Requirements (SFRs), evaluators rigorously assess the TOE’s compliance with predetermined security standards and protocols. This comprehensive evaluation process not only verifies the robustness of the TOE’s security features but also instills trust and confidence among stakeholders regarding the reliability and integrity of the product or system.
Furthermore, the TOE offers vendors a unique opportunity to tailor the evaluation process to match their product’s intended capabilities and functionalities precisely. By defining the Security Target (ST) in alignment with the specific requirements and objectives of their offering, vendors can ensure that the evaluation accurately reflects the security measures relevant to their product’s context. This customization allows for a more nuanced and targeted assessment, wherein different products, such as network firewalls and database management systems, can be evaluated based on their respective security needs and priorities.
As a result, vendors can focus on addressing the pertinent security aspects of their products, thereby enhancing the effectiveness and relevance of the evaluation process. Ultimately, this adaptability not only streamlines the evaluation process but also enables vendors to demonstrate the robustness and suitability of their products in addressing unique security challenges and requirements.
Evaluation Process
The evaluation process unfolds through a meticulously orchestrated series of steps, commencing with delineating the TOE and associated documentation. Subsequent phases encompass exhaustive testing, encompassing installation, functionality, and vulnerability.
Evaluation facilities look at the TOE from arrival through installation to vulnerability testing. If it arrives in a box, colleagues will dismantle it to ensure it is packed and shipped safely. They also check the related developer documentation, including the user guide for instance to see if the product is installable and secure as described in the user guide. If all the documentation has been evaluated, and the TOE is in operation, then functional and penetration testing begins. Documentation and the device are thoroughly tested through the evaluation classes (ASE, AGD, ADV, ALC, ATE, AVA).
Certified Common Criteria evaluation facilities conduct these evaluations independently, ensuring impartiality and reliability. A key outcome of this process is the attribution of an Evaluation Assurance Level (EAL), signifying the degree of confidence in the TOE’s security features.
The process yields an Evaluation Assurance Level (EAL), indicating confidence in the TOE’s security features’ reliable implementation. Security Functional Requirements (SFRs) outline the TOE’s security behavior and specify its security functions. The Security Target (ST) identifies the TOE’s security properties and includes the SFRs for evaluation. Vendors can use the ST to customize the Common Criteria evaluation to align with their product’s capabilities. SFRs and ST are vital benchmarks in the evaluation process.
Summary
The amalgamation of Common Criteria and the Target of Evaluation constitutes a linchpin in cybersecurity evaluation. The integrity and reliability of products and systems are upheld through rigorous testing against established Security Functional Requirements (SFRs) and delineated Security Targets (ST). As cybersecurity evolves, a robust understanding of these principles remains imperative in safeguarding digital ecosystems.
Independent cybersecurity labs, like CCLab, provide comprehensive support to businesses, offering services such as CC consultation for ISO 15408 compliance and Common Criteria evaluation. These services empower manufacturers to navigate the complexities of cybersecurity assessments, fostering a safer digital environment. As technology advances, obtaining CC certification for their products remains essential for manufacturers, ensuring product security and enhancing their competitiveness in the global market.
