# Vulnerability Assessment of Sensor Systems
## 2 Background and Related Work
### Current State of the Research Field
#### 2.3.2 Security Evaluation and Vulnerability Assessment, Especially in the Common Criteria Domain  
The Common Evaluation Methodology (CEM) [29] is complex, but still provides some general solutions that should be suitable to any kind of IT product (integrated circuits, firmware, software, hardware devices, complex systems). For these reasons, different product-specific guidelines have been developed. Some of them concern vulnerability assessment, which is a significant part of CEM and a very important activity of the CC evaluators. The standard [22] provides an extension of the basic CEM methodology to evaluate software products. It shows how to use public databases of vulnerabilities and attacks, but only for software products. The guide [23] supplements and refines the CEM methodology from the developer's point of view. The presentations delivered at the International Common Criteria Conferences (ICCC) concern different aspects of the vulnerability assessment raised during IT security evaluations in labs. For example:  
* [24] proposes to mitigate CEM drawbacks, i.e., \"a very generic vulnerability classification and poorly defined methodology\" by applying the attack patterns from CAPEC [25], better aligning to SAR classes/families, such as AGD--misuse, ALC--delivered vulnerabilities, ATE--malfunction, ADV_ARC, ADV_TDS, ASE_SPD--attack path;
* [26] concerns a new approach to the patch management after certification in the context of vulnerability and risk management;
* [27] concerns test automation; penetration tests are part of the vulnerability assessment. Another report [28] specifies methods and tools for vulnerability analyses designed for specific IT products or systems, such as network scanners, host scanners, web application scanners, multilevel scanners, penetration test tools, vulnerability scan consolidators, etc. Some methods and tools can be used in penetration testing, as proposed below. The CEM methodology can be refined with respect to the given group of \(\Pi\) products. 3.3 Knowledge Engineering Applications in the Common Criteria Domain and Cybersecurity Knowledge Bases  
A thorough literature survey on \"security assessment ontologies\" made the following conclusions [30]:  
* \"Most works on security ontologies aim to describe the Information Security domain (more generic), or other specific subdomains of security, but not specifically the Security Assessment domain\";
* there is \"a lack of ontologies that consider the relation of Information Security and Software Assessment fields of research\";
* there is \"a lack of works that address the research issues: Reusing Knowledge; Automating Processes; Increasing Coverage of Assessment; Identifying Vulnerabilities; Measuring Security; Assessing, Verifying or Testing the Security\". Another paper [31] conducted a broad survey (more than 200 papers) of scientific publications devoted to ontologies for privacy requirements engineering. Only two papers concerning Common Criteria were found. One of them [32] is focused on the ontological representation of the Common Criteria components. On this basis, a tool was developed to support the evaluator during the certification process, i.e., to plan the evaluation process, review relevant documents, or make reports. The aim of this work is to decrease the time and costs of security evaluation. This ontology is general and embraces all CC assurance components but it does not express details required for work units, especially for the vulnerability assessment, e.g., public sources of information about vulnerabilities, attacks, areas of concerns, and attack potential. Another paper [39] considered the development of CC ontology and an ontology-based tool supporting CC knowledge query, mark-up, review, and report functions to better understand CC and enhance the effectiveness of CC certification. This ontology does not embrace CEM activities, especially of the AVA assurance class. Another paper [40] presented core ontology concepts for security assessment.