A survey on common criteria (CC) evaluating schemes for security assessment of IT products

Abstract

Over the last few years, private and public organizations have suffered an increasing number of cyber-attacks owing to excessive exploitation of technological vulnerabilities. The major objective of these attacks is to gain illegal profits by extorting organizations which adversely impact their normal operations and reputation. To mitigate the proliferation of attacks, it is significant for manufacturers to evaluate their IT products through a set of security-related functional and assurance requirements. Common Criteria (CC) is a well-recognized international standard, focusing on ensuring security functionalities of an IT product along with the special emphasis on IS design and life-cycle. Apart from this, it provides a list of assurance classes, families, component, and elements based on which security EALs can be assigned to IT products. In this survey, we have provided a quick overview of the CC followed by the analysis of country-specific implementation of CC schemes to develop an understanding of critical factors. These factors play a significant role by providing assistance in IT products evaluation in accordance with CC. To serve this purpose, a comprehensive comparative analysis of four schemes belonging to countries including US, UK, Netherlands, and Singapore has been conducted. This comparison has aided to propose best practices for realizing an efficient and new CC scheme for the countries which have not designed it yet and for improving the existing CC schemes. Finally, we conclude the paper by providing some future directions regarding automation of the CC evaluation process.

How Do Organizations Seek Cyber Assurance? Investigations on the Adoption of the Common Criteria and Beyond

“…Since Common Criteria covers a comprehensive range of categories and technologies for ICT products and services, it promotes the mutual recognition of secure ICT products among a broad range of security standards and certifications [19]. For example, Matheu et al [5] stated that Common Criteria is the most widely used cybersecurity certification in the IoT field.…”

“…As of 2021, there are 17 certificate authorizing schemes under the Common Criteria [41]. Country-specific implementation of Common Criteria schemes are different in the flow of evaluation and certification of ICT products [19]. The fragmented landscape of Common Criteria schemes generates the disharmonized perspective for security evaluation.…”

How Do Organizations Seek Cyber Assurance? Investigations on the Adoption of the Common Criteria and Beyond

“…Since Common Criteria covers a comprehensive range of categories and technologies for ICT products and services, it promotes the mutual recognition of secure ICT products among a broad range of security standards and certifications [35]. For example, Matheu et al [49] stated that Common Criteria is the most widely used cybersecurity certification in the IoT field.…”

“…As of 2021, there are 17 certificate authorizing schemes under the Common Criteria [25]. Country-specific implementation of Common Criteria schemes are different in the flow of evaluation and certification of ICT products [35]. The fragmented landscape of Common Criteria schemes generates the disharmonized perspective for security evaluation.…”

“…In response, many product vendors engage consultants to prepare specific evaluation material at the pre-evaluation stage. The current efforts on major review work are underway by international experts through the International Organization of Standardization (ISO) [35]. This should see an improvement of the Common Criteria for wider adoption from the perspective of usability and readability of the documentation.…”