• Electronics and Telecommunications Trends
• /
• v.18 no.1 s.79
• /
• pp.17-24
• /
• 2003

본 고에서는 정보보호제품에 대한 국제공통평가기준인 CC(Common Criteria)의 적용방안에 대해 분석하였다. CC에서는 왜 보증등급에 대해 다루는지에 대한 물음에 대답하고, CC에 대해 개발자들이 알아야할 것은 무엇인지, 그리고 기존 평가기준과의 차이점은 무엇인지에 대해 살펴보았다. CC 평가를 염두에두고 정보보호시스템 개발을 할 경우 고려해야 할 개발자 입장에서의 이슈들에 대해 정리하고 처리방안에 대해 제시하였다. 마지막으로 제품 평가를 위한 평가과정, 평가를 위해 개발자가 준비해야 하는 개발증거물들을 제시하고, CC에 따른 제품 평가의 효과에 대해 살펴보았다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.14 no.1
• /
• pp.25-34
• /
• 2004

Common Criteria(CC, ISO/IEC 15408) is an international standard for evaluation of Information Suity Systems(ISS). There need a suitable evidence of estimation of evaluation cost in an evaluation facility under the CC-based evaluation and assurance scheme. In this paper, we propose an evaluation effort model, which is based not only on assurance-level but also on product-type of ISS, by means of real experience of real evaluators, use-ratio concept and the Function Point of security function. The model is based not on a real evaluation environment of evaluation facility, but on CC, public PPs and product specific STs. Our result might be used as a basic model for estimation of evaluation cost and time of ISS in an CC-based evaluation and assurance scheme.

• Convergence Security Journal
• /
• v.8 no.3
• /
• pp.19-24
• /
• 2008

Common Criteria is a standard to estimate safety of information protection product such as network-level firewall system and intrusion detection system. Recently, CC version is changed from CC v.2.3 to CC v.3.1. CC v.3.1 estimation methodology requires a secured dictionary accomodation preparation for information protection product. In this research, progressed CC v3 base composition product test and research about vulnerability analysis method. Further, this paper presents specific plan sorting composition style information protection product examination methodology to existing principle and detailed methodology.

• Review of KIISC
• /
• v.15 no.4
• /
• pp.80-96
• /
• 2005

ISO/IEC ISO/IEC 15408인 CC(Common Criteria)는 전세계 정보보호 학계와 산업 분야에서 정보보호 기능과 보증에 대한 표준적 개념, 평가 및 분류체계로 자리매김했다. 현재의 공식적인 버전은 CC 2.2이지만, 2004년 3월에 CC 2.4(초안)가 발표된 후, 공식버전이 되기도 전인 2005년 7월에 CC 3.0 (초안, 수정 2판)이 발표되었다. CC 3.0은$50\%$이상 대폭 변화되었으며 지난 10년간 경험했던 CC의 문제점을 해결하려한 흔적이 역역하다. 본 논문에서는 CC 3.0의 변화를 CC 2.4와 함께 조사 및 분석하였고 변화에 따른 문제점과 대책을 제시한다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.20 no.2
• /
• pp.131-144
• /
• 2010

IT developed countries since the late 1980s are used to develop IT security evaluation criteria to ensure safety and reliability of information protection products. Currently a variety of products used for the evaluation based on CC and it takes a long period of product evaluation is required to reduce the developers and users. In this paper refer to the published standard evaluation schedule for the EAL4 calculation model offers a trial period. In addition, based on this commitment by adjusting the number of evaluaters to evaluate the applicant in the evaluation period to minimize the position offers.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.13 no.5
• /
• pp.57-67
• /
• 2003

Security Policy Model is a structured representation using informal, semiformal or formal method of security policy to be enforced by TOE. It provides TOE to get an assurance to mitigate security flaws resulted from inconsistency between security functional requirements and functional specifications. Therefore, Security Policy Model has been required under an hish evaluation assurance level on an evaluation criteria such as ISO/IEC 15408(Common Criteria, CC). In this paper, we present an evaluation method for security policy model based on assurance requirements for security policy model in Common Criteria through an analysis of concepts, related researches and assurance requirements for security policy model.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2012.04a
• /
• pp.702-705
• /
• 2012

공통평가 기준(CC, Common Criteria)은 정보 보호 제품, 즉 IT제품에 대한 보안성을 평가하기 위한 국제 평가 기준이다. 그러나 개발자 측면에서는 CC 에서 정의된 보안 기능 사항 중 IT제품 개발에 있어서 어떤 보안기능을 요구하며, 적용 가능한 IT기술에는 무엇이 있는지 알기 어렵다. 이 때문에 평가를 받고자 할 때 제출물을 작성하거나 IT제품 개발에 있어서 많은 시간과 인력이 필요하게 된다. 본 논문은 IT제품 개발자를 위해 공통평가 기준에서 정의하여 서술된 보안기능항목을 이해하고 적용 가능한 IT기술에는 어떤 것 들이 있는지 제시하기 위한 도구를 개발하기 위해 CC(Ver3.1)2부 보안기능 요구사항 중 프라이버시 클래스만을 해결할 수 있는 S/W를 개발 및 프로토타이핑 하였다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.17 no.4
• /
• pp.61-74
• /
• 2007

In Common Criteria evaluation scheme, sponsor and evaluator should estimate evaluation cost and duration of IT security system evaluation in contracting the evaluation project. In this paper, We analyzed study result that achieve at 2003 and 2005, and utilized part of study result. And we empirically estimate relative evaluation effort ratios among evaluation assurance levels($EAL1{\sim}EAL7$) in CC v2.3 and CC v3.1. Also, we estimate the ratios from 'developer action elements', adjusted 'content and presentation of evidence elements', and 'evaluator action elements 'for each assurance component. We, especially, use ratio of amount of effort for each 'evaluator action elements', that was obtained from real evaluators in KISA in 2003. Our result will useful for TOE sponsor as well as evaluation project manager who should estimate evaluation cost and duration for a specific EAL and type of TOE, in a new CC v3.1 based evaluation schem.

• The Journal of Society for e-Business Studies
• /
• v.8 no.3
• /
• pp.69-86
• /
• 2003

A Protection Profile(PP) is a common security and assurance requirements for a specific class of Information Technology security products such as firewall and smart card. A PP should be included "TOE(Target of Evaluation) Security Environment", which is consisted of subsections: assumptions, treat, organizational security policies. This paper presents a new threats statement generation method for developing TOE security environment section of PP. Our survey guides the statement of threats in CC(Common Criteria) scheme through collected and analysed hundred of threat statements from certified and published real PPs and CC Tool Box/PKB that is included a class of pre-defined threat and attack statements. From the result of the survey, we present a new asset classification method and propose a threats statement generation model. The former is a new asset classification method, and the later is a production rule for a well formed statement of threats.

• Proceedings of the Korea Information Processing Society Conference
• /
• 2004.05a
• /
• pp.221-224
• /
• 2004

보안 S/W의 보안성 평가기준(CC; Common Criteria)은 국제 표준 ISO/IEC 15408로 제정되었고, 시제품에 대한 보안기능요구사항과 보증요구사항을 표준화된 방법으로 표현하고 있다. 보안 S/W의 보안성은 중요하나 그 품질 또한 간과되어서는 안 된다. 이에, 본 논문에서는 CC에서 기술하고 있는 보안기능에 대한 S/W 품질평가기준에 대해 연구하였다.