crypto4c-ch21a-安全評(píng)估-文庫(kù)吧
2025-02-03 16:21 本頁(yè)面
【正文】 rt II of this document describes a number of additional security services (., munications integrity, denial of service, transmission security) that arise in conjunction with works. Those services available in specific work offerings, while inappropriate for the rigorous evaluation applied to TCSEC related feature and assurance requirements, may receive qualitative ratings. В Γ ITSEC ? ITSEC by European Union – Information Technology Security Evaluation Criteria ? Goto “” – Ex遞增 ? E0 – 無安全保證 ? E1 – 有安全目標(biāo)和關(guān)于體系結(jié)構(gòu)設(shè)計(jì)的非形式化描述 ? E2 – 對(duì)詳細(xì)設(shè)計(jì)有非形式化的描述 В Γ ? E3 – 評(píng)估源代碼或硬件設(shè)計(jì)圖 ? E4 – 有對(duì)安全目標(biāo) /策略的基本形式模型 ? E5 – 設(shè)計(jì)和源代碼 /硬件有緊密的對(duì)應(yīng)關(guān)系 ? E6 – 安全功能 /體系結(jié)構(gòu)設(shè)計(jì)與安全目標(biāo) /策略模型一致 В Γ CSSC’CTCPEC ? CSSC: CTCPEC 187。Goto “” – Canadian System Security Centre: Canadian Trusted Computer Product Evaluation Criteria – It is a puter security standard parable to the American TCSEC (Orange Book) but somewhat more advanced. It has been superseded by the international Common Criteria standard. – 可和 TCSEC相比，但更進(jìn)步 – 已被國(guó)際標(biāo)準(zhǔn) CC替代 В Γ NIST/FIPS В Γ CC В Γ CC 3Parts ? Part 1 Introduction and General Model ? Part 2 Security Functional Requirements Annexes ? Part 3 Security Assurance Requirements ? В Γ CC / EAL Evaluation Assurance Levels ? EAL1：功能測(cè)試 ? EAL2：結(jié)構(gòu)測(cè)試 ? EAL3：系統(tǒng)測(cè)試和檢查 ? EAL4：系統(tǒng)設(shè)計(jì)、測(cè)試和復(fù)查 ? EAL5：半形式化設(shè)計(jì)和測(cè)試 ? EAL6：半形式化驗(yàn)證的設(shè)計(jì)和測(cè)試 ? EAL7：形式化驗(yàn)證的設(shè)計(jì)和測(cè)試 В Γ EAL1: Functional Test ? Confidence in current operation is required ? No assistance from TOE developer ? Applicable where threat to security is not serious ? Independent testing against specification and guidance documentation В Γ EAL2: Structural Test ? Requires some cooperation of the developer ? Adds requirements for configuration list, delivery, highlevel design documentation, developer functional testing, vulnerability analysis, and more extensive independent testing В Γ EAL3: Methodical Test and Check ? Requires some positive security engineering at the design stage, with minimal changes to existing practices ? Added assurance through investigation of product and development
教學(xué)課件相關(guān)推薦
鄂ICP備17016276號(hào)-1