## 5 Common Criteria IT Security Development Process--Intelligent Sensor Specific Issues
### Defining Common Criteria related security design patterns--general rules
#### 5.2.3 Threats related to the intelligent sensor with respect to the full life cycle  
The predefined enhanced generics allow to specify varied threats. Most generics have parameters expressing active entities, e.g., legal subjects, intruders (Sparam), and passive entities, e.g., attacked assets (Dparam). Thanks to these parameterization- and refinement abilities, the iteration can be applied while the threats specification has been elaborated. As it was mentioned earlier, the iteration allows to place a given threat into the specification with different parameter values assigned, or with different refinements added. Different kinds of threats are distinguished. For any group of threats representing elementary security problems, two groups of related items are proposed:  
* representative examples of passive and active entities that can be considered as threat parameter value,
* security objectives for the TOE and/or for its environment (lines indented) countering these threats and being the typical solutions of these elementary problems. Sometimes one threat can be solved by one security objective, but usually some objectives are specified for the TOE and some, of supporting character, for the TOE environment. Below, one or more objectives are added for any group of threats (intended lines). Basic threat items express security issues related with the operational environment, especially attacks focused on the data sampled, stored, processed and transmitted by the intelligent sensor. These items will be supplemented later by threats related to the development-, manufacturing- and maintenance-processes. First, a threat example concerns a direct attack against data sampled (measured) by the sensor. This generic can be refined depending on the kind of sensor and measured data. The important issue is that input data cannot be disrupted or counterfeited by any reason. The proposed security objectives (countermeasures) concern tamper-resistance, reliable solutions and sensors inspections. For some operational environments, some of these measures can be impossible or hard to implement. Instead, the network redundancy mechanisms can be applied. For sensors provided with actuators, a very similar elementary security problem can be defined and solved with respect to the output data of the actuator. TDA.DisruptSampling. Users or intruders [Sparam <= SAU.IntellSensorUser, SNA.HighPotIntrud] could try to manipulate the sensor input [Dparam <= DTO.SensorData] causing wrong input data. OINT.TamperResistance. The TOE guarantees its own physical/logical integrity. The means of detecting physical tampering must be provided (e.g., seals, tampering detection, special reinforced cases, intrinsically safe solutions). OAVB.Reliability. The sensor must provide reliable service. Applying fault tolerance methods and techniques. OSMN.RegularInpections. The sensor must be periodically inspected and calibrated (if necessary). OAVB.RedundNodes. Apply redundant sensor nodes, allowing to lose nodes without any impact on the network (or network application) behaviour as a whole. The data properly sampled by the sensor are stored, processed and prepared for sending through the network to the central database or to any process control or monitoring unit. The second group of threats concerns direct attacks against the data stored or processed within the sensor node. The data can be eavesdropped, modified or even fabricated. It is possible due to simple or complex network attacks finalized by illegal data access. Depending on the node and threat character, different aspects should be emphasized in the threat item definition. The first example describes complex attack on the node from the network, three others--more specific attacks. To counter these threats, the access control, fault tolerance and authentication mechanisms are generally recommended. To protect confidentiality, cryptographic methods should be applied. All of them can be supported by audit facilities.