1 Common Criteria Discussions CCSDS Security Working Group Fall 2007 Meeting 3-5 October 2007 ESA/ESOC, Darmstadt Germany (Hotel am Bruchsee, Heppenheim)

2 Background ISO – Common Criteria for Information Technology Security Evaluation – International standard – Security requirements – Common evaluation methodology – Mutual evaluation recognition (25 countries) Protection Profiles – Designed as an “acquisition” document » Desired security services Security Targets – Designed as a vendor “technical delivery” specification » Documents the security services provided in a product with respect to a Protection Profile

3 Type of PPs Already Written Access control devices Boundary protection devices/systems (aka firewalls) Databases Detection devices/systems (IDS) ICs, Smart Cards, devices and systems Key Management systems Network and Network-related devices/systems Operating systems Other devices/systems (e.g., ATM, biometric, certificate issuing) Digital Signature products

4 Space PPs What would a space PP consist of? – Profiles of mission security requirements? » Formalization, in CC terms, of security requirements, by mission type, a la security architecture? – PPs for space ‘unique’ systems, e.g., » C&DH/command & control » Solid state recorders » Shared bus » Others?

5 Example – Cash Machine 1 This Protection Profile has been developed to specify the requirements in terms of functionalities and levels of assurance applicable to ACDs/ATMs. Many transactions can be carried out via an ACD/ATM. The target has therefore been deliberately restricted to matters connected with the use of a card, the identification of the cardholder (the confidentiality of the PIN, etc) and the dispensing of cash (the integrity of the interfaces with the server, etc). The target of evaluation comprises: a central processing unit (the “brain” which conditions or coordinates its overall operation), a cash dispenser (a hardware device for taking banknotes from cash cassettes and delivering them to the cardholder), a card reader (for smart cards and possibly stripe cards), an input device for the cardholder to use (subsequently termed the “keypad”). The Protection Profile relates mainly to interchanges between these various components, which are normally grouped together within a single hardware enclosure (see the diagram above), but any other architecture may be considered. 1 Bull, Dassault, Diebold, NCR, Siemens Nixdorf, Wang Global

6 Discussion Does this make sense? Should we attempt to do this? Will anyone use it – or even care about it? Do the National Space Agencies use the Common Criteria – or should they? – US requires FISMA (Federal Information Security Management Act) » NIST Federal Information Processing standards » No mention of CC evaluated products – What about everyone else?