# Vulnerability Assessment of Sensor Systems
## 4 Validation of the Sensor System Vulnerability Assessment Method
The evaluator reviews the TOE evaluation evidences to find different forms of areas of concern, which may include potential vulnerabilities. 2. The evaluator places the identified information in the _AreaOfConcern_AOC_ knowledge base. It will be used to orientate the analysis of evidences and, finally, to find potential vulnerabilities. EEP3-2 is focused on the identification of the second group of vulnerabilities, i.e., evidence-based vulnerabilities, and embraces two steps:  
1. The evaluator analyzes the TOE evidences, focusing on the areas of concerns, to identify the potential vulnerabilities and related attack scenarios. 2. The evaluator adds potential vulnerabilities to the _PotentialVulnerability_PV_ KB and related attack scenarios to the _AttackScenario_AS_ knowledge base. EEP3-3 analyzes both groups of identified potential vulnerabilities (based on public information searching and evidences analysis) to check whether they are relevant to the TOE's operational environment (note that for AVA_VAN.1, this work was performed in EEP2-2). Only these relevant, \"applicable\", vulnerabilities will be the subject of further analyses. EEP3-3 has three steps:  
Figure 6: Area of concern representation in the Protége tool. Considering the operational environment description (ASE_SPD and ASE_OBJ), the evaluator analyzes whether each potential vulnerability is applicable to the TOE's operational environment. 2. All applicable vulnerabilities are marked as candidates for analysis and testing. They are placed into the _ApplicableVulnerability_AV_ knowledge base and reported in the ETR. 3. The evaluator assigns the verdict (PASS/FAIL/INCONCLUSIVE) for AVA_VANx.3E (x = 2,3,4) and justifies it. The _ApplicableVulnerability_AV_ knowledge base supplements _PotentialVulnerability_PV_ with details (data properties) describing preselected candidates for further analysis and testing:  
* _VulCandidateRationale_--why it is considered a candidate for testing;
* _AssumedAP_--implied by the EAL (basic, enhanced basic, moderate, high);
* _CalculatedAP_--calculated attack potential (AP);
* _VulSeverity_--characterizing the vulnerability's occurrence and severity;
* _VulPriority_--prepares a prioritized list of vulnerabilities for testing;
* _TestReport_--test reports and results (SFRs not met, AP parameters, AP resistance, exploitable or not, etc. );
* _ExploitabilityVerdict_--verdict (not tested, exploitable, not-exploitable, inconclusive, residual). The contents of the _ApplicableVulnerability_AV_ knowledge base are supplemented during further activities. For example, the attack potential (AP) can be considered in the next EEP. The EAL claimed for the TOE implies the AP (assumed). The AP is calculated according to the CEM/Annex B methodology [29]. The calculation of the attack potential is focused on the identification of effort required to create the attack which is successfully applied to the TOE. The following factors are assessed in predefined scales and the AP is the sum of these values:  
* ET--elapsed time, i.e., time taken to identify and exploit the vulnerability;
* SE--specialist expertise, i.e., the level of generic knowledge of the attacker;
* KT--knowledge of the TOE, i.e., dealing with the TOE design, operation;
* WO--window of opportunity, i.e., considerable amount of access to the TOE or the number of samples of the TOE that the attacker can obtain (related to ET);
* EQ--equipment, i.e., IT hardware/software or other equipment required to identify or exploit the vulnerability. An example of the software tool calculating the attack potential is presented in a previous paper [57]. At the end of the AVA_VAN evaluation, the _ApplicableVulnerability_AV_ knowledge base includes a complete picture about the relevant TOE vulnerabilities which are summarized in the ETR. Figure 7 presents an example of applicable vulnerability description in the knowledge base. Let us consider that for the MEDIS sensor, EAL3 was claimed. This means that MEDIS should be resistant to basic attack (the corresponding AP range is: 10-13).