Common Criteria

Definition

Common Criteria is a framework used to evaluate the security and functionality of information technology products and systems. It provides a standardized approach for assessing the effectiveness of security features, ensuring that products meet specific security requirements and can be trusted in various environments. This framework is vital in international EMC standards as it helps organizations ensure compliance and interoperability across different technologies.

5 Must Know Facts For Your Next Test

1. Common Criteria is recognized internationally and adopted by many countries, making it an essential standard for assessing IT product security.
2. The evaluation process includes testing, documentation review, and security engineering analysis to verify that products meet specified security requirements.
3. Common Criteria enables organizations to compare different IT products based on their security assurances, promoting informed decision-making.
4. The framework supports various types of evaluations, including software applications, hardware devices, and firmware.
5. Products evaluated under Common Criteria can earn certifications that enhance their marketability and trustworthiness among users.

Review Questions

• How does Common Criteria contribute to ensuring the security of IT products in various environments?
  • Common Criteria provides a structured framework for evaluating the security features of IT products by establishing standardized assessment methods. This ensures that products meet specific security requirements, making them trustworthy for deployment in diverse environments. By following this framework, organizations can confidently choose technologies that have been rigorously evaluated and certified for their security effectiveness.
• What role do Protection Profiles play in the Common Criteria evaluation process?
  • Protection Profiles are critical components of the Common Criteria evaluation process as they define the specific security requirements for a particular category of products. They serve as a baseline for evaluations, ensuring that all assessed products meet the necessary criteria for their intended use. By providing clear expectations, Protection Profiles enhance consistency across evaluations and facilitate easier comparisons among different products.
• Assess the implications of Evaluation Assurance Levels (EAL) on product certification within the Common Criteria framework and its impact on market acceptance.
  • Evaluation Assurance Levels (EAL) significantly influence product certification by determining the depth and rigor of the evaluation process under Common Criteria. Higher EALs indicate a more thorough assessment, which can lead to greater trust and acceptance from consumers and organizations. As a result, products certified at higher EALs may gain a competitive advantage in the market, as they demonstrate stronger security assurances, ultimately impacting purchasing decisions and fostering greater reliance on these technologies.

Related terms

Protection Profile: A document that specifies the security requirements for a category of products or systems, used in the Common Criteria evaluation process.

Evaluation Assurance Level (EAL): A set of criteria that defines the depth and rigor of the evaluation process in the Common Criteria framework, ranging from EAL1 (least stringent) to EAL7 (most stringent).

ISO/IEC 15408: The international standard that defines the Common Criteria framework, outlining the evaluation methodology for IT security.