## 3 Common Criteria Methodology--Primer  
The Common Criteria standard (ISO/IEC 15408) is the leading assurance methodology which provides dependable IT solutions for applications when the assessed risk is high or the appreciated asset value is significant. As it was mentioned above, assurance is the confidence that an IT product or system, called TOE (target of evaluation), meets the security objectives specified for it. This means that the built-in security functions related to these objectives and representing measures will work effectively whenever a threat occurs. Assurance is measured by evaluation assurance levels (in the range EAL1 to EAL7) and depends on the rigour applied to the security development. The first part of the standard [1] presents a general model and structures of basic security requirements specifications, called security target (ST) and protection profile (PP). The second part includes functional components used to express security functional requirements (SFRs) for TOE security functions representing TOE built-in countermeasures. The third part contains assurance components used to express security assurance requirements (SARs) for these security functions. Both sets of components constitute a semiformal -language\" to uniformly express security requirements. The EALs are well balanced packages (sets of components) of SARs. Both kinds of CC components are grouped by families which, in turn, are grouped by classes. They are used as specification means of security requirements. The assurance level is claimed by developers who provide evidences that the given EAL is met. An IT product or system (TOE), its security target (ST) and the related evidences are evaluated to get the certificate [24]. The ST is considered as a complete, implementation-dependent security specification of the TOE. The main parts of the ST are: security problem definition, security objectives, security requirements and security functions. The second kind of the security specification is the implementation-independent protection profile (PP) which does not contain these functions. Security targets can be elaborated directly on the basis of the users' requirements or with the use of previously evaluated protection profiles. The CC methodology encompasses the following processes:  
* IT security development process, identified with the security target (ST) work-out, specifying the TOE security functions;
* TOE development process with the use of the assumed technology (elaboration of the TOE evaluation evidences, expressing the implementation of these functions on the EAL declared for the TOE);
* IT security evaluation and certification process (not discussed here), providing independent analyses, verifications if the claimed EAL is met. The IT security development process [1]/Part 1 has the following stages:  
1. Work-out of the -ST introduction\", containing different identifiers, informal TOE overview and TOE description;
2. Conformance claims with the Common Criteria version, protection profiles and packages, including EAL;
3. Security problem definition (SPD); SPD specified threats, OSPs (organizational security policies) and assumptions for the TOE and its environment;
4. Solution of this problem by specifying security objectives (SO)--for the TOE and its environment;
5. Extended components definition, when needed (_i.e._, when the developer should define his/her own component due to its lack in the standard);6. Work-out of the security functional requirements (SFRs) specification on the security objectives basis, and the set of security assurance requirements (SARs) which are derived mainly from the declared EAL;
7. Creating the TOE summary specification, including the TOE security functions derived from the SFRs; they are implemented in the TOE on the claimed EAL during the TOE development process. The TOE development is the second CC key process.