C

M

Y

K

Achievements of ITSC

Security Support for IT Society• Provision of services by IT system developers with extensive expertise• Personnel with experience in a broad range of specialized fields, from IT products to IT systems

Pioneering Activities for Security Evaluation in Japan• First trial of security evaluation in Japan using Common Criteria V1.0

1987-

Established a "Computer Security Expert Committee," and then began a survey related tosecurity evaluation standards.

1992

Published The Basic Requirements of Computer Security (Security function and Assurance
Versions)

1998

First trial evaluation in Japan using Common Criteria V1.0 (the basis for ISO/IEC15408)

1999

Participated in creation of the JIS standard for security from the International Standard

2000

Participated in establishment of the security evaluation/certification scheme in Japan
Developed the "System Protection Profile for e-government"

2001

Participated in production of the JIS-TR for CEM (Common Methodology for Information
Technology Security Evaluation)

2002

Acquired authorization as an EAL3 security evaluation facility

2003

Acquired authorization as an EAL4 security evaluation facility

2007

Became independent organization from JEITA

2009

Testing laboratorie of CMVP accredited by the National Institute of Standards and Technology,
National Voluntary Laboratory Accreditation Program (NVLAP)

2010

Testing laboratory of JCMVP accredited by the National Institute of Technology and
Evaluation(NITE), and approved by the Information Tecnology Promotion Agency,Japan(IPA)• Participated in establishment of the security evaluation/certification scheme in Japan

Security Evaluation (EAL1 to EAL4 and PP)
The purpose of a security evaluation is to acquire ISO/IEC15408 certification.
We conduct security evaluations for IT products and systems (TOE) based on theevaluation documents provided by the customer.
During a security evaluation, the Security Targets (ST) is verified first. The IT productor system is then inspected to verify that it has been developed as specified in theST.

Security Evaluation
Security evaluation of
IT products/systems

Verification of ST
The security functions of IT products
and systems are verified according to the ST.

TOE(Target of Evaluation)• Hardware/software products• From IT products to information processing systems

ExamplesIT products: firewalls, accounting tools, IC
card products, etc.
Information processing systems: accounting
systems, electronic commerce systems, etc.

Development Consulting
Support Service for Design of Security Functions

Robust security functions cannot be created by just spending money. Systematic threatsanalysis and effective plans for countermeasures are necessary to establish costeffective, leak-proof security functions. We look at security from our customers’
perspective and offer them optimal security function designs.

Introduction to the IT Security Center

http://www.itsc.or.jp

Support Service for Security Evaluation and Acquisition of Certification

For security evaluation of IT products and systems, documents must be prepared inaccordance with the ST, such as design documents, test specifications, and various
types of analysis documents. We provide counseling in regard to such things as the typeof evaluation documents necessary to satisfy the required evaluation assurance level
and the appropriate method of writing these documents.
Additionally, we review evaluation documents and create Protection Profiles (PP) and
Security Targets (ST) on behalf of our customers.

Training
The IT Security Center provides numerous training programs aimed at acquiring the security technology related skills that are
required at different stages of development for IT products and systems, including such things as security basics, system design,
production control, inspection, and evaluation.

IT Security Center Training Seminars

Training Program System
Introduction to ISO/IEC15408

ST creation practiceST creation method

Development method
Inspection/
Evaluation method

ISO/IEC15408 Engineer Training
1. Introductory lecture
2. Lecture on ST creation techniques
3. ST creation practice (using tools)
4. Lecture on development/
inspection/evaluation techniques

Information Technology Security Center(IT Security Center)
1-1-3 Ohtemachi, Chiyoda-ku, Tokyo 100-0004
Tel: +81-3-5218-2231 Fax:+81-3-5218-2232
E-mail: contact@itsc.or.jp
http://www.itsc.or.jp

Information Technology Security Center

C

M

Y

K

An IT Society with unlimited potential
Reliable security produces success
In April 2001, JEITA established the JEITA IT Security Center, building on JEITA’s
extensive track record of achievement in IT security.
As early as 1987, ITSC had already begun research and surveys for the Common
Criteria, which became the basis of ISO/IEC 15408.
In 2007 ITSC became independent of JEITA.
The IT Security Center conducts security evaluations of IT products/systems toinspect the reliability of their security, security evaluation consultations, andsecurity training for security engineers.

Materials Necessary for Security Evaluation
In order for IT product/system developers to receive evaluation andcertification of their product’s security, they must submit their IT
product/system (TOE: Target of Evaluation) and its development related
documentations to an evaluation facility approved by this scheme ( ITSecurity Center, etc.) Development related documentations are largely
documents that are normally created during IT product/systemdevelopment, such as functional specification, test specification, andsource code. However, developers may not create some documentation inusual development of IT product/system. For example, one of those is
Security Target (ST).

Security Target
Development related documentations
Target of Evaluation (TOE)

Development through Maintenance of IT Products (Generally the same for IT Systems)
ADV class
ALC classRequired
specifications

Basic
designFunctional, high-level, or
low-level design

APE class

Evaluation
Preparation

Application for
Evaluation andCertification

Scheme of
Evaluation andCertification

Together with the evaluation
facility, evaluation applicantsconsider such things as the
EAL, schedule, system, andwhether consultation will benecessary.

Applicants submit an ST to theevaluation facility, and thenwork with them to produce anagreeable evaluation
procedure.

Contract with the evaluation
facility.
Submit an application forcertification to the certification
body, and request evaluation andcertification.

The evaluation facility begins theevaluation under the supervisionof the certification body.

Development/test method

ASE class
Security targets

Ministry of Economy, Trade and Industry
Evaluation facility

Evaluation facility(IT Security Center)

Evaluation

Evaluation results

Certificate

Certification

AC

1. ST introduction

TOE functionality(assets)

4. IT Security requirements

Threats

Security objectives
for the TOE
Selection of functional
requirements

5. TOE summary specifications

Assumptions

Security objectives
for the environment
Product manuals, etc.

Implementation of security functions

Accepted in CCRA signatory
countries (Japan, USA, UK, etc.)
CCRA: Common Criteria Recognition Arrangement

Pass
Security International Standard ISO/IEC15408(Common Criteria)
Security target

Functional requirements
User identification and certification
Access control

Assurance requirements
Development environment
Specifications
Source code

Guidance documents

In order to effectively improve the quality of security for global IT
products/systems, efforts were made to standardize IT security
internationally for at least 20 years. IT security was standardized
through the ISO/IEC15408 standard, which was established in 1999.
ISO/IEC 15408 is a set of regulations for implementing valid security
functions for all types of IT products/systems and for verifying theircompliance in both hardware and software. This verification isconducted according to the security evaluation and certification
scheme designated by each country, which is based on
ISO/IEC15408.
In Japan, the Ministry of Economy, Trade and Industry establishedthis scheme in April 2001. It operates based on “Evaluation,” which
verifies the security functions of IT products/systems, and“Certification,” which confirms the evaluation results. IT Securit
Center is an official EAL4 Evaluation Facility.

ass

ALC class
Methods of managing materials related to development and operation

ISO/IEC15408

3. Security objectives
Informationtechnology
Promotion
Agency, Japan(IPA)

Evaluation facility

Security evaluation criteria

ADG class

Description of
guidance documents

AVA class

Structure of Security Target

2. Security problem definition• The Security Evaluation and Certification Scheme of JapanIT product/system

Installation

DeliveryAnalysis of strength against attacks on security, etc.

IT Product/
System Development

Evaluation applicant

Inspection

ATE classProtection profile

Evaluation Request Procedure

Manufacturer/Vendor

Creation ofmanuals

Programming

The ST is the basic design for TOE security functions and is more than just a set of specifications. It logically proves why the implemented
security functions are valid. ST describes the methods of preventing assets from threats, such as modification and leaks by attackers. If
these methods prove to be valid, the security functions described in the ST are considered valid.

TOE security functions are evaluated to verify whether they have been developed and implemented as described in the ST. ISO/IEC15408 defines the requirements(assurance requirements) for the development and implementation methods that are specified in the ST. The TOE assurance requirements do not require a special
development method. The following types of documents are required depending on the security functions specified in the ST: development documents, such asfunctional specifications that describe external interfaces and those implemented interfaces that divide the TOE into subsystems (high-level specifications), anddocuments, such as manuals (guidance documents), test specifications, and development environment regulations (configuration management).

• Evaluation Assurance Level (EAL)
Assurance
requirements

ST
EAL1
Functional specification
TOE suitable for testing(Test materials)〜 EAL7

EAL1 EAL2 EAL3 EAL4

FamilyEvidence

AGD_OPE

Operational user guidance

●

●

●

●

Vulnerability analysis Development security Low-level design

AGD_PRE

Preparative procedure

●

●

●

●

Development tools

ADV_ARC

Architecture description

●

●

●

ADV_FSP

Functional specification

●

●

●

ADV_IMP

Implementation representation

ADV_TDS

Design of TOE

●

●

●

ALC_CMCCM documentation

●

●

●

●

ALC_CMS

Configuration list

●

●

●

●

ALC_DEL

Delivery procedure

●

●

●

ALC_DVS

Development documentation●●

ALC_LCD

Life-cycle definition●●

ALC_TATDevelopment tool and options

ATE_COV

Test coverage

ATE_DPT

Depth of testing

ATE_FUN

Test documentation

ATE_IND

TOE for testing

AVA_VANTOE for testing

EAL2

EAL3

EAL4

High-level specifications Life cycle definition
Functional tests

Source code

Clarification of the Remaining Risk

Assurance requirements are categorized into 7 levels, EAL1 to 7 (EAL: Evaluation
Assurance Level). The EAL represents how detailed the development documentation
will be verified. For example, TOEs that deal with national secrets may require EAL7,
which is the highest level. Normally, EAL4 is considered the highest level for business.

●

●

●
●

●

●

●

●

●

●

●

●

●

●

●

●

●

●

●

C

M

Y

K

An IT Society with unlimited potential
Reliable security produces success
In April 2001, JEITA established the JEITA IT Security Center, building on JEITA’s
extensive track record of achievement in IT security.
As early as 1987, ITSC had already begun research and surveys for the Common
Criteria, which became the basis of ISO/IEC 15408.
In 2007 ITSC became independent of JEITA.
The IT Security Center conducts security evaluations of IT products/systems toinspect the reliability of their security, security evaluation consultations, andsecurity training for security engineers.

Materials Necessary for Security Evaluation
In order for IT product/system developers to receive evaluation andcertification of their product’s security, they must submit their IT
product/system (TOE: Target of Evaluation) and its development related
documentations to an evaluation facility approved by this scheme ( ITSecurity Center, etc.) Development related documentations are largely
documents that are normally created during IT product/systemdevelopment, such as functional specification, test specification, andsource code. However, developers may not create some documentation inusual development of IT product/system. For example, one of those is
Security Target (ST).

Security Target
Development related documentations
Target of Evaluation (TOE)

Development through Maintenance of IT Products (Generally the same for IT Systems)
ADV class
ALC classRequired
specifications

Basic
designFunctional, high-level, or
low-level design

APE class

Evaluation
Preparation

Application for
Evaluation andCertification

Scheme of
Evaluation andCertification

Together with the evaluation
facility, evaluation applicantsconsider such things as the
EAL, schedule, system, andwhether consultation will benecessary.

Applicants submit an ST to theevaluation facility, and thenwork with them to produce anagreeable evaluation
procedure.

Contract with the evaluation
facility.
Submit an application forcertification to the certification
body, and request evaluation andcertification.

The evaluation facility begins theevaluation under the supervisionof the certification body.

Development/test method

ASE class
Security targets

Ministry of Economy, Trade and Industry
Evaluation facility

Evaluation facility(IT Security Center)

Evaluation

Evaluation results

Certificate

Certification

AC

1. ST introduction

TOE functionality(assets)

4. IT Security requirements

Threats

Security objectives
for the TOE
Selection of functional
requirements

5. TOE summary specifications

Assumptions

Security objectives
for the environment
Product manuals, etc.

Implementation of security functions

Accepted in CCRA signatory
countries (Japan, USA, UK, etc.)
CCRA: Common Criteria Recognition Arrangement

Pass
Security International Standard ISO/IEC15408(Common Criteria)
Security target

Functional requirements
User identification and certification
Access control

Assurance requirements
Development environment
Specifications
Source code

Guidance documents

In order to effectively improve the quality of security for global IT
products/systems, efforts were made to standardize IT security
internationally for at least 20 years. IT security was standardized
through the ISO/IEC15408 standard, which was established in 1999.
ISO/IEC 15408 is a set of regulations for implementing valid security
functions for all types of IT products/systems and for verifying theircompliance in both hardware and software. This verification isconducted according to the security evaluation and certification
scheme designated by each country, which is based on
ISO/IEC15408.
In Japan, the Ministry of Economy, Trade and Industry establishedthis scheme in April 2001. It operates based on “Evaluation,” which
verifies the security functions of IT products/systems, and“Certification,” which confirms the evaluation results. IT Securit
Center is an official EAL4 Evaluation Facility.

ass

ALC class
Methods of managing materials related to development and operation

ISO/IEC15408

3. Security objectives
Informationtechnology
Promotion
Agency, Japan(IPA)

Evaluation facility

Security evaluation criteria

ADG class

Description of
guidance documents

AVA class

Structure of Security Target

2. Security problem definition• The Security Evaluation and Certification Scheme of JapanIT product/system

Installation

DeliveryAnalysis of strength against attacks on security, etc.

IT Product/
System Development

Evaluation applicant

Inspection

ATE classProtection profile

Evaluation Request Procedure

Manufacturer/Vendor

Creation ofmanuals

Programming

The ST is the basic design for TOE security functions and is more than just a set of specifications. It logically proves why the implemented
security functions are valid. ST describes the methods of preventing assets from threats, such as modification and leaks by attackers. If
these methods prove to be valid, the security functions described in the ST are considered valid.

TOE security functions are evaluated to verify whether they have been developed and implemented as described in the ST. ISO/IEC15408 defines the requirements(assurance requirements) for the development and implementation methods that are specified in the ST. The TOE assurance requirements do not require a special
development method. The following types of documents are required depending on the security functions specified in the ST: development documents, such asfunctional specifications that describe external interfaces and those implemented interfaces that divide the TOE into subsystems (high-level specifications), anddocuments, such as manuals (guidance documents), test specifications, and development environment regulations (configuration management).

• Evaluation Assurance Level (EAL)
Assurance
requirements

ST
EAL1
Functional specification
TOE suitable for testing(Test materials)〜 EAL7

EAL1 EAL2 EAL3 EAL4

FamilyEvidence

AGD_OPE

Operational user guidance

●

●

●

●

Vulnerability analysis Development security Low-level design

AGD_PRE

Preparative procedure

●

●

●

●

Development tools

ADV_ARC

Architecture description

●

●

●

ADV_FSP

Functional specification

●

●

●

ADV_IMP

Implementation representation

ADV_TDS

Design of TOE

●

●

●

ALC_CMCCM documentation

●

●

●

●

ALC_CMS

Configuration list

●

●

●

●

ALC_DEL

Delivery procedure

●

●

●

ALC_DVS

Development documentation●●

ALC_LCD

Life-cycle definition●●

ALC_TATDevelopment tool and options

ATE_COV

Test coverage

ATE_DPT

Depth of testing

ATE_FUN

Test documentation

ATE_IND

TOE for testing

AVA_VANTOE for testing

EAL2

EAL3

EAL4

High-level specifications Life cycle definition
Functional tests

Source code

Clarification of the Remaining Risk

Assurance requirements are categorized into 7 levels, EAL1 to 7 (EAL: Evaluation
Assurance Level). The EAL represents how detailed the development documentation
will be verified. For example, TOEs that deal with national secrets may require EAL7,
which is the highest level. Normally, EAL4 is considered the highest level for business.

●

●

●
●

●

●

●

●

●

●

●

●

●

●

●

●

●

●

●

C

M

Y

K

An IT Society with unlimited potential
Reliable security produces success
In April 2001, JEITA established the JEITA IT Security Center, building on JEITA’s
extensive track record of achievement in IT security.
As early as 1987, ITSC had already begun research and surveys for the Common
Criteria, which became the basis of ISO/IEC 15408.
In 2007 ITSC became independent of JEITA.
The IT Security Center conducts security evaluations of IT products/systems toinspect the reliability of their security, security evaluation consultations, andsecurity training for security engineers.

Materials Necessary for Security Evaluation
In order for IT product/system developers to receive evaluation andcertification of their product’s security, they must submit their IT
product/system (TOE: Target of Evaluation) and its development related
documentations to an evaluation facility approved by this scheme ( ITSecurity Center, etc.) Development related documentations are largely
documents that are normally created during IT product/systemdevelopment, such as functional specification, test specification, andsource code. However, developers may not create some documentation inusual development of IT product/system. For example, one of those is
Security Target (ST).

Security Target
Development related documentations
Target of Evaluation (TOE)

Development through Maintenance of IT Products (Generally the same for IT Systems)
ADV class
ALC classRequired
specifications

Basic
designFunctional, high-level, or
low-level design

APE class

Evaluation
Preparation

Application for
Evaluation andCertification

Scheme of
Evaluation andCertification

Together with the evaluation
facility, evaluation applicantsconsider such things as the
EAL, schedule, system, andwhether consultation will benecessary.

Applicants submit an ST to theevaluation facility, and thenwork with them to produce anagreeable evaluation
procedure.

Contract with the evaluation
facility.
Submit an application forcertification to the certification
body, and request evaluation andcertification.

The evaluation facility begins theevaluation under the supervisionof the certification body.

Development/test method

ASE class
Security targets

Ministry of Economy, Trade and Industry
Evaluation facility

Evaluation facility(IT Security Center)

Evaluation

Evaluation results

Certificate

Certification

AC

1. ST introduction

TOE functionality(assets)

4. IT Security requirements

Threats

Security objectives
for the TOE
Selection of functional
requirements

5. TOE summary specifications

Assumptions

Security objectives
for the environment
Product manuals, etc.

Implementation of security functions

Accepted in CCRA signatory
countries (Japan, USA, UK, etc.)
CCRA: Common Criteria Recognition Arrangement

Pass
Security International Standard ISO/IEC15408(Common Criteria)
Security target

Functional requirements
User identification and certification
Access control

Assurance requirements
Development environment
Specifications
Source code

Guidance documents

In order to effectively improve the quality of security for global IT
products/systems, efforts were made to standardize IT security
internationally for at least 20 years. IT security was standardized
through the ISO/IEC15408 standard, which was established in 1999.
ISO/IEC 15408 is a set of regulations for implementing valid security
functions for all types of IT products/systems and for verifying theircompliance in both hardware and software. This verification isconducted according to the security evaluation and certification
scheme designated by each country, which is based on
ISO/IEC15408.
In Japan, the Ministry of Economy, Trade and Industry establishedthis scheme in April 2001. It operates based on “Evaluation,” which
verifies the security functions of IT products/systems, and“Certification,” which confirms the evaluation results. IT Securit
Center is an official EAL4 Evaluation Facility.

ass

ALC class
Methods of managing materials related to development and operation

ISO/IEC15408

3. Security objectives
Informationtechnology
Promotion
Agency, Japan(IPA)

Evaluation facility

Security evaluation criteria

ADG class

Description of
guidance documents

AVA class

Structure of Security Target

2. Security problem definition• The Security Evaluation and Certification Scheme of JapanIT product/system

Installation

DeliveryAnalysis of strength against attacks on security, etc.

IT Product/
System Development

Evaluation applicant

Inspection

ATE classProtection profile

Evaluation Request Procedure

Manufacturer/Vendor

Creation ofmanuals

Programming

The ST is the basic design for TOE security functions and is more than just a set of specifications. It logically proves why the implemented
security functions are valid. ST describes the methods of preventing assets from threats, such as modification and leaks by attackers. If
these methods prove to be valid, the security functions described in the ST are considered valid.

TOE security functions are evaluated to verify whether they have been developed and implemented as described in the ST. ISO/IEC15408 defines the requirements(assurance requirements) for the development and implementation methods that are specified in the ST. The TOE assurance requirements do not require a special
development method. The following types of documents are required depending on the security functions specified in the ST: development documents, such asfunctional specifications that describe external interfaces and those implemented interfaces that divide the TOE into subsystems (high-level specifications), anddocuments, such as manuals (guidance documents), test specifications, and development environment regulations (configuration management).

• Evaluation Assurance Level (EAL)
Assurance
requirements

ST
EAL1
Functional specification
TOE suitable for testing(Test materials)〜 EAL7

EAL1 EAL2 EAL3 EAL4

FamilyEvidence

AGD_OPE

Operational user guidance

●

●

●

●

Vulnerability analysis Development security Low-level design

AGD_PRE

Preparative procedure

●

●

●

●

Development tools

ADV_ARC

Architecture description

●

●

●

ADV_FSP

Functional specification

●

●

●

ADV_IMP

Implementation representation

ADV_TDS

Design of TOE

●

●

●

ALC_CMCCM documentation

●

●

●

●

ALC_CMS

Configuration list

●

●

●

●

ALC_DEL

Delivery procedure

●

●

●

ALC_DVS

Development documentation●●

ALC_LCD

Life-cycle definition●●

ALC_TATDevelopment tool and options

ATE_COV

Test coverage

ATE_DPT

Depth of testing

ATE_FUN

Test documentation

ATE_IND

TOE for testing

AVA_VANTOE for testing

EAL2

EAL3

EAL4

High-level specifications Life cycle definition
Functional tests

Source code

Clarification of the Remaining Risk

Assurance requirements are categorized into 7 levels, EAL1 to 7 (EAL: Evaluation
Assurance Level). The EAL represents how detailed the development documentation
will be verified. For example, TOEs that deal with national secrets may require EAL7,
which is the highest level. Normally, EAL4 is considered the highest level for business.

●

●

●
●

●

●

●

●

●

●

●

●

●

●

●

●

●

●

●

C

M

Y

K

Achievements of ITSC

Security Support for IT Society• Provision of services by IT system developers with extensive expertise• Personnel with experience in a broad range of specialized fields, from IT products to IT systems

Pioneering Activities for Security Evaluation in Japan• First trial of security evaluation in Japan using Common Criteria V1.0

1987-

Established a "Computer Security Expert Committee," and then began a survey related tosecurity evaluation standards.

1992

Published The Basic Requirements of Computer Security (Security function and Assurance
Versions)

1998

First trial evaluation in Japan using Common Criteria V1.0 (the basis for ISO/IEC15408)

1999

Participated in creation of the JIS standard for security from the International Standard

2000

Participated in establishment of the security evaluation/certification scheme in Japan
Developed the "System Protection Profile for e-government"

2001

Participated in production of the JIS-TR for CEM (Common Methodology for Information
Technology Security Evaluation)

2002

Acquired authorization as an EAL3 security evaluation facility

2003

Acquired authorization as an EAL4 security evaluation facility

2007

Became independent organization from JEITA

2009

Testing laboratorie of CMVP accredited by the National Institute of Standards and Technology,
National Voluntary Laboratory Accreditation Program (NVLAP)

2010

Testing laboratory of JCMVP accredited by the National Institute of Technology and
Evaluation(NITE), and approved by the Information Tecnology Promotion Agency,Japan(IPA)• Participated in establishment of the security evaluation/certification scheme in Japan

Security Evaluation (EAL1 to EAL4 and PP)
The purpose of a security evaluation is to acquire ISO/IEC15408 certification.
We conduct security evaluations for IT products and systems (TOE) based on theevaluation documents provided by the customer.
During a security evaluation, the Security Targets (ST) is verified first. The IT productor system is then inspected to verify that it has been developed as specified in theST.

Security Evaluation
Security evaluation of
IT products/systems

Verification of ST
The security functions of IT products
and systems are verified according to the ST.

TOE(Target of Evaluation)• Hardware/software products• From IT products to information processing systems

ExamplesIT products: firewalls, accounting tools, IC
card products, etc.
Information processing systems: accounting
systems, electronic commerce systems, etc.

Development Consulting
Support Service for Design of Security Functions

Robust security functions cannot be created by just spending money. Systematic threatsanalysis and effective plans for countermeasures are necessary to establish costeffective, leak-proof security functions. We look at security from our customers’
perspective and offer them optimal security function designs.

Introduction to the IT Security Center

http://www.itsc.or.jp

Support Service for Security Evaluation and Acquisition of Certification

For security evaluation of IT products and systems, documents must be prepared inaccordance with the ST, such as design documents, test specifications, and various
types of analysis documents. We provide counseling in regard to such things as the typeof evaluation documents necessary to satisfy the required evaluation assurance level
and the appropriate method of writing these documents.
Additionally, we review evaluation documents and create Protection Profiles (PP) and
Security Targets (ST) on behalf of our customers.

Training
The IT Security Center provides numerous training programs aimed at acquiring the security technology related skills that are
required at different stages of development for IT products and systems, including such things as security basics, system design,
production control, inspection, and evaluation.

IT Security Center Training Seminars

Training Program System
Introduction to ISO/IEC15408

ST creation practiceST creation method

Development method
Inspection/
Evaluation method

ISO/IEC15408 Engineer Training
1. Introductory lecture
2. Lecture on ST creation techniques
3. ST creation practice (using tools)
4. Lecture on development/
inspection/evaluation techniques

Information Technology Security Center(IT Security Center)
1-1-3 Ohtemachi, Chiyoda-ku, Tokyo 100-0004
Tel: +81-3-5218-2231 Fax:+81-3-5218-2232
E-mail: contact@itsc.or.jp
http://www.itsc.or.jp

Information Technology Security Center

C

M

Y

K

Achievements of ITSC

Security Support for IT Society• Provision of services by IT system developers with extensive expertise• Personnel with experience in a broad range of specialized fields, from IT products to IT systems

Pioneering Activities for Security Evaluation in Japan• First trial of security evaluation in Japan using Common Criteria V1.0

1987-

Established a "Computer Security Expert Committee," and then began a survey related tosecurity evaluation standards.

1992

Published The Basic Requirements of Computer Security (Security function and Assurance
Versions)

1998

First trial evaluation in Japan using Common Criteria V1.0 (the basis for ISO/IEC15408)

1999

Participated in creation of the JIS standard for security from the International Standard

2000

Participated in establishment of the security evaluation/certification scheme in Japan
Developed the "System Protection Profile for e-government"

2001

Participated in production of the JIS-TR for CEM (Common Methodology for Information
Technology Security Evaluation)

2002

Acquired authorization as an EAL3 security evaluation facility

2003

Acquired authorization as an EAL4 security evaluation facility

2007

Became independent organization from JEITA

2009

Testing laboratorie of CMVP accredited by the National Institute of Standards and Technology,
National Voluntary Laboratory Accreditation Program (NVLAP) (LAB CODE: 200822-0)

2010

Testing laboratory of JCMVP accredited by the National Institute of Technology and
Evaluation(NITE), and approved by the Information Tecnology Promotion Agency,Japan(IPA)• Participated in establishment of the security evaluation/certification scheme in Japan

Security Evaluation (EAL1 to EAL4 and PP)
The purpose of a security evaluation is to acquire ISO/IEC15408 certification.
We conduct security evaluations for IT products and systems (TOE) based on theevaluation documents provided by the customer.
During a security evaluation, the Security Targets (ST) is verified first. The IT productor system is then inspected to verify that it has been developed as specified in theST.

Security Evaluation
Security evaluation of
IT products/systems

Verification of ST
The security functions of IT products
and systems are verified according to the ST.

TOE(Target of Evaluation)• Hardware/software products• From IT products to information processing systems

ExamplesIT products: firewalls, accounting tools, IC
card products, etc.
Information processing systems: accounting
systems, electronic commerce systems, etc.

Development Consulting
Support Service for Design of Security Functions

Robust security functions cannot be created by just spending money. Systematic threatsanalysis and effective plans for countermeasures are necessary to establish costeffective, leak-proof security functions. We look at security from our customers’
perspective and offer them optimal security function designs.

Introduction to the IT Security Center

http://www.itsc.or.jp

Support Service for Security Evaluation and Acquisition of Certification

For security evaluation of IT products and systems, documents must be prepared inaccordance with the ST, such as design documents, test specifications, and various
types of analysis documents. We provide counseling in regard to such things as the typeof evaluation documents necessary to satisfy the required evaluation assurance level
and the appropriate method of writing these documents.
Additionally, we review evaluation documents and create Protection Profiles (PP) and
Security Targets (ST) on behalf of our customers.

Training
The IT Security Center provides numerous training programs aimed at acquiring the security technology related skills that are
required at different stages of development for IT products and systems, including such things as security basics, system design,
production control, inspection, and evaluation.

IT Security Center Training Seminars

Training Program System
Introduction to ISO/IEC15408

ST creation practiceST creation method

Development method
Inspection/
Evaluation method

ISO/IEC15408 Engineer Training
1. Introductory lecture
2. Lecture on ST creation techniques
3. ST creation practice (using tools)
4. Lecture on development/
inspection/evaluation techniques

Information Technology Security Center(IT Security Center)
1-1-3 Ohtemachi, Chiyoda-ku, Tokyo 100-0004
Tel: +81-3-5218-2231 Fax:+81-3-5218-2232
E-mail: contact@itsc.or.jp
http://www.itsc.or.jp

Information Technology Security Center