The Importance of Security Features Evaluation

B.

Evaluation as a general term is described as the process of independently assessing a system against a standard of comparison, such as evaluation criteria.

Evaluation criterias are defined as a benchmark, standard, or yardstick against which accomplishment, conformance, performance, and suitability of an individual, hardware, software, product, or plan, as well as of risk-reward ratio is measured.

What is computer security evaluation? Computer security evaluation is the detailed examination and testing of the security features of an IT system or product to ensure that they work correctly and effectively and do not show any logical vulnerabilities.

The Security Target determines the scope of the evaluation.

It includes a claimed level of Assurance that determines how rigorous the evaluation is.

Criteria - Criteria are the "standards" against which security evaluation is carried out.

They define several degrees of rigour for the testing and the levels of assurance that each confers.

They also define the formal requirements needed for a product (or system) to meet each Assurance level.

TCSEC - The US Department of Defense published the first criteria in 1983 as the Trusted Computer Security Evaluation Criteria (TCSEC), more popularly known as the "Orange Book"

The current issue is dated 1985

The US Federal Criteria were drafted in the early 1990s as a possible replacement but were never formally adopted.

ITSEC - During the 1980s, the United Kingdom, Germany, France and the Netherlands produced versions of their own national criteria.

These were harmonised and published as the Information Technology Security Evaluation Criteria (ITSEC)

The current issue, Version 1.2, was published by the European Commission in June 1991

In September 1993, it was followed by the IT Security Evaluation Manual (ITSEM) which specifies the methodology to be followed when carrying out ITSEC evaluations.

Common Criteria - The Common Criteria represents the outcome of international efforts to align and develop the existing European and North American criteria.

The Common Criteria project harmonises ITSEC, CTCPEC (Canadian Criteria) and US Federal Criteria (FC) into the Common Criteria for Information Technology Security Evaluation (CC) for use in evaluating products and systems and for stating security requirements in a standardised way.

Increasingly it is replacing national and regional criteria with a worldwide set accepted by the International Standards Organisation (ISO15408)

The following answer were not applicable: Certification is the process of performing a comprehensive analysis of the security features and safeguards of a system to establish the extent to which the security requirements are satisfied.Shon Harris states in her book that Certification is the comprehensive technical evaluation of the security components and their compliance for the purpose of accreditation.

Wikipedia describes it as:Certification is a comprehensive evaluation of the technical and non-technical security controls (safeguards) of an information system to support the accreditation process that establishes the extent to which a particular design and implementation meets a set of specified security requirements Accreditation is the official management decision to operate a system.Accreditation is the formal declaration by a senior agency official (Designated Accrediting Authority (DAA) or Principal Accrediting Authority (PAA)) that an information system is approved to operate at an acceptable level of risk, based on the implementation of an approved set of technical, managerial, and procedural security controls (safeguards)

Acceptance testing refers to user testing of a system before accepting delivery.

Reference(s) used for this question: HARE, Chris, Security Architecture and Models, Area 6 CISSP Open Study Guide, January 2002

and https://en.wikipedia.org/wiki/Certification_and_Accreditation and http://www.businessdictionary.com/definition/evaluation-criteria.html and http://www.cesg.gov.uk/products_services/iacs/cc_and_itsec/secevalcriteria.shtml.

The process described in the question is best defined as "Evaluation." Evaluation is the process of conducting a detailed examination and testing of the security features of an IT system or product to ensure that they work correctly and effectively and do not show any logical vulnerabilities. It is a comprehensive process that involves analyzing the system or product's technical design and implementation, evaluating its compliance with security standards and best practices, and assessing its overall security posture.

The primary objective of evaluation is to identify any security weaknesses or vulnerabilities in the system or product and to provide recommendations for improving its security. The evaluation process typically involves a team of security professionals who use a variety of tools and techniques to perform testing and analysis. The results of the evaluation are documented in a detailed report, which includes a summary of the findings, recommendations for improvement, and a final evaluation rating.

Evaluation is often used as a basis for other security-related activities, such as certification and accreditation. Certification is the process of formally recognizing that a system or product meets specific security requirements or standards, while accreditation is the formal authorization for the system or product to operate within a specific environment or context. Both certification and accreditation often require the results of an evaluation as a basis for their decision-making processes.

Acceptance testing, on the other hand, is a type of testing that is typically performed to determine whether a system or product meets its functional requirements and whether it is suitable for deployment. It is not specifically focused on security, although security testing may be included as part of the acceptance testing process.