|
URL: http://www.iso.ch
URL: http://www.csa-intl.org/onlinestore/GetCatalogItemDetails.asp?mat=2414892&Parent=3053
From
http://www.csa-intl.org:
Security
functional components, as defined in this part of ISO/IEC 15408, are the basis
for the TOE IT security functional requirements expressed in a Protection
Profile (PP) or a Security Target (ST). These requirements describe the desired
security behavior expected of a Target of Evaluation (TOE) and are intended to
meet the security objectives as stated in a PP or an ST. These requirements
describe security properties that users can detect by direct interaction with
the TOE (i.e. inputs, outputs) or by the TOEs response to stimulus.
Security
functional components express security requirements intended to counter threats
in the assumed operating environment of the TOE and/or cover any identified
organizational security policies and assumptions.
The
audience for this part of ISO/IEC 15408 includes consumers, developers, and
evaluators of secure IT systems and products. ISO/IEC 15408-1 clause 3 provides
additional information on the target audience of ISO/IEC 15408, and on the use
of the standard by the groups that comprise the target audience. These groups
may use this part of ISO/IEC 15408 as follows:
-
Consumers who use ISO/IEC 15408-2 when selecting components to express
functional requirements to satisfy the security objectives expressed in a PP or
ST. ISO/IEC 15408-1 sub clause 4.3 provides more detailed information on the
relationship between security objectives and security requirements.
-
Developers, who respond to actual or perceived consumer security requirements
in constructing a TOE, may find a standardized method to understand those
requirements in this part of ISO/IEC 15408. They can also use the contents of
this part of ISO/IEC 15408 as a basis for further defining the TOE security
functions and mechanisms that comply with those requirements.
-
Evaluators, who use the functional requirements defined in this part of ISO/IEC
15408 in verifying that the TOE functional requirements expressed in the PP or
ST satisfy the IT security objectives and that all dependencies are accounted
for and shown to be satisfied. Evaluators also should use this part of ISO/IEC
15408 to assist in determining whether a given TOE satisfies stated
requirements.
Keywords:
|
