# Vulnerability Assessment of Sensor Systems
## 4 Validation of the Sensor System Vulnerability Assessment Method  
A complex validation process requires a complete set of evaluation evidences at the evaluators' disposal and is beyond the scope of this paper. Due to the information, cost, and time restrictions, the validation should be focused on the selected but representative operations performed by the evaluators. The validation is based on the CEM requirements and on the documentation of the MEDIS sensor project--one of two sensors developed by the author's organization which were used in the CCMODE validation. The validation is focused on:  
* meeting the CC/CEM requirements related to the content and presentation of evidence and compliance with the work-units defined in CEM,
* the use of preselected information on attacks, vulnerabilities, information sources, penetration tests related to well-known, certified groups of IT products, such as firewalls, security boxes, etc., and information, which can be also applied to emerging groups of certified IT products, such as sensors,
* the use of sensor-relevant data included in the literature, security targets, and certification reports. The aims of the validation are:
* to check the modelled AVA_VAN process with respect to the actions and data models of any IT product;
* the validation conclusions will be used to develop the software tool supporting the evaluators;
* expected result: confirm, reject, or modify the validated model before the software is developed on their basis;
* consider the automation of the vulnerability assessment process by developing the software tool;
* to show how an IT product, such as a sensor system, is evaluated according to the Common Criteria with respect to vulnerabilities;
* presentation of SVAM (sensor system vulnerability assessment method);
* expected result: provide the method and knowledge for sensor developers and evaluators;
* support the evaluators and developers of sensor systems in vulnerability assessment and removal. The validation comprises different evaluation cases related to all evaluator action elements, as exemplified by ontological models. The following cases embrace all steps of the SVAM. Case 1: Checking If the Information Provided by the Sensor Developer Meets All Requirements For Content and Presentation of Evidence (AVA_VANx.1E, x = 1,2,3,4)  
Let us consider a hypothetical (i.e., not CC-certified) but representative sensor example, developed by the author's organization [37], i.e., the methane early detection intelligent sensor (MEDIS), working within the broader mine monitoring system (MMS) controlling different safety and production parameters, e.g., physical parameters, chemical composition of air, as well as the condition and working parameters of ventilation equipment, machines, and process-line equipment. MMS is designed for mines with methane and coal-dust explosion hazards. Case 1 concerns the straightforward execution of \"EEP1 Checking the TOE configuration and installation\":  
1. Examination of whether the TOE test configuration is consistent with the configuration under evaluation as specified in the Security Target (ST) [29]. The evaluator checks whether the provided MEDIS sensor has the same configuration as specified in the TOE identifier of ST (here: MEDIS--methane early detection intelligent sensor, ver. 0.9 [37]) and in the ALC_CMC (configuration management) and ALC_CMS (configuration lists) evaluation evidences. Examination of whether the TOE has been installed properly and is in a known state after the power on [29]. The evaluator performs the installation and preparation procedure of the MEDIS sensor specified in the AGD_PRE (preparative procedures) evidence document and checks the result. 3. The evaluator assigns the verdict (PASS/FAIL/INCONCLUSIVE) for AVA_VANx.1E and justifies it.