JAPAN SECURITY
CONFERENCE
USING COMMON CRITERIAFOR SITE EVALUATIONTOKYO, 29-30 March 2001
Smart Card Application Center
J. LE BIHAN - 29-30/03/01

PLAN OF PRESENTATION
1- REASONS AND GOALS

2- DIFFICULTIES & SOLUTIONS

3- METHODS

4- SECURITY TARGET

5- RESULTS & CONCLUSIONS

Smart Card Application Center
J. LE BIHAN - 29-30/03/01

1- REASONS & GOALS
1.1- IMPLEMENT “ON-SITE SECURITY”.
- “Physical Environmental” Security.
-> Access control, Secure storage, ...
- “Information System” Security.
-> Configuration, Firewall, Access control, ...
- Security Policies, Procedures and Practices.
-> Security Management, Security Measures.
- Training & Education.
Smart Card Application Center
J. LE BIHAN - 29-30/03/01

1- REASONS & GOALS
1.2- OFFICIALLY RECOGNIZED SECURITY.
- Compliance to recognized Standards.
-> Common Criteria (CC).
- Compliance to “Recommendations” used by the Industry .
-> Protection Profile (PP/9806).
- Conducted under Official Certification Scheme.
- Possibly Certified Activity after Evaluation.

Smart Card Application Center
J. LE BIHAN - 29-30/03/01

1- REASONS & GOALS
1.3- KNOWLEDGE & EDUCATION ON COMMON
CRITERIA.
- Deploy the aim and scope of the CC Standard to employees.
- Training to the security requirements and measures.
- Learning processes during the evaluation phase.

Smart Card Application Center
J. LE BIHAN - 29-30/03/01

1- REASONS & GOALS
1.4- CHALLENGING THE SECURITY &CONTINUOUS IMPROVEMENT.
- Identification of what need to be secured & of the Threats.
- Implementation of a “Security System”.
- Maintenance Program.

Smart Card Application Center
J. LE BIHAN - 29-30/03/01

1- REASONS & GOALS
1.5- RECOGNITION OF EMPLOYEES WORK.
- Reporting during evaluation process.
- Audits.
- Certification.
- Recognition from Management.
- Recognition from CUSTOMERS.

Smart Card Application Center
J. LE BIHAN - 29-30/03/01

2- DIFFICULTIES & SOLUTIONS
2.1- TOE SELECTION & SECURITY TARGET- TOE is a “physical” feature: “Development Environment”.
- Common Criteria are applicable to Information Technology.
- Environment of the TOE is the Environment of the“Development Environment”.
SOLUTIONS:- TOE is the “Development Flow”: Production Flow,...
- “Development Flow” is using Information Technology.

Smart Card Application Center
J. LE BIHAN - 29-30/03/01

2- DIFFICULTIES & SOLUTIONS
2.1- TOE SELECTION & SECURITY TARGETSOLUTIONS (Ct’ d):- TOE Environment is the environment in which the“Development Flow” is taking place.

Smart Card Application Center
J. LE BIHAN - 29-30/03/01

2- DIFFICULTIES & SOLUTIONS
2.2- CC & INFORMATION TECHNOLOGY- Common Criteria are applicable to Information Technology.
- Security Requirements dependencies.
SOLUTIONS:- Keep focus on the evaluation goals: “DevelopmentEnvironment”.
- Clearly identify the IT of the TOE and its boundaries.
- Limit the list of selected Security Requirements only to thosemandatory for the security.
Smart Card Application Center
J. LE BIHAN - 29-30/03/01

2- DIFFICULTIES & SOLUTIONS
2.3- INFORMATION SYSTEM & NETWORKING- Usually, the “IS” of “Development Environment” is huge.
- Usually, links to other networks exist.
SOLUTIONS:- Clearly identify the IT of the TOE and its boundaries.
- Limit the application of CC to this part of the “IS”.
- Move other part of “IS” into the TOE Environment: Can becovered with Security Procedures.

Smart Card Application Center
J. LE BIHAN - 29-30/03/012- DIFFICULTIES & SOLUTIONS
2.4- CC & ASSURANCE MEASURES- Some Assurance Measures may be difficult to apply to a TOE
that is of a “System” type (“Development Environment”).
Ex: ACM_CAP.1 Version Numbers.
SOLUTIONS:- Partnership with Certification Body and with Evaluation
Laboratory.
- Use the “concept” and methodology of the CC and not the“basic requests” from the CC wording.

Smart Card Application Center
J. LE BIHAN - 29-30/03/01

2- DIFFICULTIES & SOLUTIONS
2.5- SUSTAINING A PRODUCT EVALUATION- Evaluation of a product issued from this “DevelopmentEnvironment” may be needed.
- Product Evaluation have security requirements to theEnvironment.
SOLUTIONS:- Use existing Protection Profile, that product evaluation mayclaim for: PP/9806,…
- Validate and introduce the requirements on the Environment
into the Security Target of the “Development Environment”.
Smart Card Application Center
J. LE BIHAN - 29-30/03/01

3- METHODS
3.1- Implement Working Groups.
3.2- Train Working Groups:- To Common Criteria.
- To Security.
3.3 Write Security Target and Documentation:- CC documentation.
- “Company Documentation”.

Smart Card Application CenterJ. LE BIHAN - 29-30/03/01

3- METHODS
3.4 Implement Procedures:- Policies.
- Specifications.
- Security Measures.
3.5 Evaluate as per CC.

Smart Card Application Center
J. LE BIHAN - 29-30/03/01

4- SECURITY TARGET
4.1- TOE & TOE ENVIRONMENT DESCRIPTION.
4.2- ASSETS:- From the TOE.
- Used by the TOE.
4.3- ASSUMPTIONS:+ Assumptions for conformance to “Product PP”.
4.4- THREATS:+ Threats for conformance to “Product PP”.

Smart Card Application Center
J. LE BIHAN - 29-30/03/01

4- SECURITY TARGET
4.5- ORGANIZATIONAL SECURITY POLICIES.
+ OSP’ s for conformance to “Product PP”.
4.6- SECURITY OBJECTIVES:- IT Security Objectives for the TOE.
- Non-IT Security Objectives for the TOE.
- Security Objectives for the TOE Environment.
+ Security Objectives for conformance to “ProductPP”.
4.7- SECURITY REQUIREMENTS:- TOE IT Security Functional Requirements.
Smart Card Application Center
J. LE BIHAN - 29-30/03/01

4- SECURITY TARGET
4.7- SECURITY REQUIREMENTS (Ct’ d):- TOE NON-IT Security Requirements.
- TOE Environment Security Requirements.
4.8- TOE IT ASSURANCE REQUIREMENTS:+ Augmentation (if claimed).
4.9- SUMMARY SPECIFICATION:- TOE Security Functions.
- TOE Assurance Measures.
- Non-IT Security Measures for the TOE.
- Security Measures for the TOE Environment.
Smart Card Application Center
J. LE BIHAN - 29-30/03/01

4- SECURITY TARGET
4.10- PP CLAIMS.
4.11- RATIONALE.

Smart Card Application Center
J. LE BIHAN - 29-30/03/01

5- RESULTS & CONCLUSIONS
5.1- IT IS POSSIBLE TO USE CC FOR SITE ORENVIRONMENT EVALUATION.
5.2- AT THE CONDITION THAT “IT” IS
AVAILABLE INSIDE THE TOE.
5.3- NEED TO CAREFULLY SELECT THE TOE.
5.4- KEEP FOCUS ON THE GOALS OF THE
PROCESS » SITE, ENVIRONMENT.
5.5- GOOD PROCESS FOR IMPLEMENTING &CHALLENGING SECURITY.
Smart Card Application Center
J. LE BIHAN - 29-30/03/01

5- RESULTS & CONCLUSIONS
5.6- IS BETTER IF MAINTENANCE PROGRAM ISFORESEEN.
5.7- LIGHTENING ANY FUTURE EVALUATION ON
PRODUCT.

Smart Card Application Center
J. LE BIHAN - 29-30/03/01

5- RESULTS & CONCLUSIONSSUCH PROJECT HAS BEEN PERFORMED FORTHE NEC SMARTCARD WAFER MANUFACTURING
SITE - YAMAGUCHI JAPAN, IN COLLABORATIONWITH FRENCH EVALUATION LABORATORY &FRENCH CERTIFICATION BODY!

Smart Card Application Center
J. LE BIHAN - 29-30/03/01