Effective Design of Trusted Information Systems Luděk Novák,

May 2001 CATE Security and Protection of Information 2 Content Brief Introduction into Security Design Five Steps of Security Design General Description Security Environment Security Objectives Security Requirements Rationale Conclusion

May 2001 CATE Security and Protection of Information 3 International Standards ISO/IEC PDTR 15446:2000 –Information technology – Security techniques – Guide for the production of protection profiles and security targets ISO/IEC 15408:1999 –Information technology – Security techniques – Evaluation criteria for IT security

May 2001 CATE Security and Protection of Information 4 Basic Term Target of Evaluation - TOE –IT product or system and its associated administrator and user guidance documentation that is the subject of an evaluation –A formal evaluation is not necessity

May 2001 CATE Security and Protection of Information 5 Structure of Design

May 2001 CATE Security and Protection of Information 6 General Description Background information on TOE and its purpose, usage, operation etc. –Document Identification –General TOE Functionality –TOE Boundary –TOE Operational Environment

May 2001 CATE Security and Protection of Information 7 Security Environment

May 2001 CATE Security and Protection of Information 8 Security Environment Asset –information or a resource, which needs to be protected by TOE countermeasures –Data Objects –Software –Hardware

May 2001 CATE Security and Protection of Information 9 Security Environment Threat –undesirable event characterised by: threat agent attack method vulnerability assets under the attack Threat Agent –source of event, which can be: human non-human

May 2001 CATE Security and Protection of Information 10 Security Environment Assumption –potential threat to assets not relevant to or not involved in TOE security Organisational Security Policy –rules, procedures, practices, etc. imposed by organisation or other authorities

May 2001 CATE Security and Protection of Information 11 Security Objectives Security Objectives for TOE –express what is the responsibility of the TOE and its security functions Security Objectives for Environment –address aspects of the security needs the TOE will not to do

May 2001 CATE Security and Protection of Information 12 Security Objectives

May 2001 CATE Security and Protection of Information 13 Security Objectives Preventative Objectives –measures prevent a threat from being carried out Detective Objectives –means detect/monitor events Corrective Objectives –actions take in response

May 2001 CATE Security and Protection of Information 14 Security Requirements

May 2001 CATE Security and Protection of Information 15 Functional Requirements Security Functional Requirements identify demands for the security functions which the TOE must provide to fulfil the security objectives for the TOE It can be based on: –ITSEC’s Generic Headings –ISO15408 – Common Criteria

May 2001 CATE Security and Protection of Information 16 Functional Requirements Identification and Authentication Access Control Audit Integrity Availability Privacy Data Exchange Security Audit Communication Cryptographic Support User Data Protection Identification and Authentication Security Management Privacy Protection of TOE Security Functions Resource Utilisation TOE Access Trusted Path/Channels

May 2001 CATE Security and Protection of Information 17 Assurance Requirements Security Assurance Requirements prescribes clear objective criteria which express quality of the TOE development Evaluation Assurance Level – EAL –EAL1 up to EAL4 – Commercial Security –EAL5 up to EAL7 – Special Security Tools

May 2001 CATE Security and Protection of Information 18 Requirements on Environment Security Requirements on Environment bring up the claims which would not be under a direct control of any IT security function within the TOE. –Personnel Security –Physical Security –Procedural Security

May 2001 CATE Security and Protection of Information 19 Rationale Security Objectives Rationale –demonstrates the identified security objectives are suitable to cover all aspects of the security needs Security Requirements Rationale –makes evident the identified security requirements are suitable to meet the security objectives

May 2001 CATE Security and Protection of Information 20 Rationale

May 2001 CATE Security and Protection of Information 21 Conclusions Advantages Clear, Transparent and Effective Way Simple Sharing of Know-How Based on Well- Known Common Criteria Project Disadvantages Not Officially Approved No Direct Connection to Special Security Tools