The Common Criteria (CC) is an international standard (International Organization for Standardization 15408) for computer security. Its purpose is to allow users to specify their security requirements, to allow developers to specify the security attributes of their products, and to allow evaluators to determine if products actually meet their claims.

= Usage =

The CC defines a common set of potential security requirements, divided into functional requirements and assurance requirements. The CC also defines two kinds of documents that can be built using this common set:

Often, users desire an independent evaluation of a product (termed the Target of Evaluation, or TOE) to show that the product does, in fact, meet the claims in an ST. The CC is specifically written to support this independent evaluation.

The CC also predefines sets of assurance requirements, termed Evaluation Assurance Levels (EALs). These EALs are numbered 1 to 7, with higher EALs requiring increasing levels of evaluation effort. The notion is that higher EAL levels gain more assurance, but cost more time and money to independently evaluate. Higher EAL levels do not necessarily imply better security , they only mean that the claimed security of the TOE has been more extensively validated.

So far, most PPs and most evaluated STs/certified products have been IT components (e.g., handbuch.

Details of cryptographic implementation within the TOE are outside the scope of the CC. Instead, national standards, like FIPS 140 have been developed for this.

= History =

The CC originated out of three standards -- ITSEC, a European standard, developed in the early 1990s by the UK, France, the Netherlands, Germany, and also used by some other countries, e.g. Australia; TCSEC (also called the Orange Book ), the US standard, and CTCPEC, the Canadian standard.

CC was produced by unifying these pre-existing standards, so that companies selling computer products for defence or intelligence use would only need to have them evaluated against one set of standards. The CC was developed by the governments of the UK, France, the Netherlands, Germany, the US, and Canada.

= Mutual Recognition Arrangement =

As well as the Common Criteria standard, there is also a sub-treaty level Common Criteria MRA (Mutual Recognition Agreement), whereby each party thereto recognizes evaluations against the Common Criteria standard done by other parties. Originally signed in 1998 by Canada, France, Germany, the United Kingdom and the United States, Australia and New Zealand joined 1999, followed by Finland, Greece, Israel, Italy, the Netherlands, Norway and Spain in 2000. The Arrangement has since been renamed Common Criteria Recognition Arrangement (CCRA) and [http://www.commoncriteriaportal.org/public/content/natscheme.html membership continues to expand]. Within the CCRA only evaluations up to EAL 4 are mutually recognized. The European countries within the former ITSEC agreement typically recognize higher EALs as well. Evaluations at EAL5+ tend to involve the security requirements of the host nation s government.

= Some Thoughts =

So, if a product is ISO 15408 (Common Criteria) certified, does that mean it is very secure Let s take an example of Microsoft Windows 2000. It is an ISO 15408 certified product but regular security patches for security vulnerabilities are still published by Microsoft for Windows 2000. This is possible because the process of getting an ISO 15408 certification allows a vendor to make certain assumptions about the operating environment and the strength of threats, if any, faced by the product in that environment. Based on these assumptions, the claimed security functions of the product are evaluated. Since Microsoft Windows 2000 has been ISO 15408 certified, it should only be considered secure in the assumed, specified circumstances, also known as the evaluated configuration, specified by Microsoft. Whether you not run Microsoft Windows 2000 in the precise evaluated configuration or not, you should apply Microsoft s security patches for the vulnerabilities in Windows 2000 as they continue to appear. If any of these security vulnerabilities are exploitable in the product s evaluated configuration, the product s ISO 15408 certification should be voluntarily withdrawn by the vendor. Alternatively, the vendor should re-evaluate the product to include application of the patches to fix the security vulnerabilities within the evaluated configuration. Failure by the vendor to take either of these steps would result in involuntary withdrawal of the product s ISO 15408 certification by the Certification Body of the country in which the product was evaluated. The fact that Microsoft Windows 2000 remains an ISO 15408 certified product, without including the application of any Microsoft security vulnerability patches in its evaluated configuration, shows both the limitation and strength of an evaluated configuration.

= External links =