# Vulnerability Assessment of Sensor Systems
## 3 Sensor System Vulnerability Assessment Method (SVAM)  
### The Problem Origin  
The Common Criteria IT security evaluation process embraces the whole TOE evidence material according to the claimed EAL. The most important part of these evidences related to the vulnerability assessment is discussed herein. This assessment is closely related to the AVA_VAN subactivities [29], here from AVA_VAN.1 to AVA_VAN.4, because the guidance for AVA_VAN.5 is not available (\"There is no general guidance; the scheme should be consulted for guidance on this subactivity\" [29], pp. 346). The sensor system vulnerability assessment method (SVAM) was developed based on a detailed analysis of the AVA_VAN subactivities (components) to identify: operations performed by evaluators working in ITSEFs, information needed for these operations, and results of these operations used to compose final evaluation verdicts. The overview is focused on the issue of how to support evaluators in AVA_VAN works, i.e., how to facilitate their access to relevant information, how to work out evaluation decisions more easily, how to express this information more precisely (formally), and how to help the evaluators in analyses, calculations, and penetration testing. All evaluator actions (i.e., E-elements) can be grouped thematically, but their rigor and details expressed by their work units differ. There are four AVA_VAN evaluation issues (implied by E-elements) common to all subactivities:  
1. AVA_VAN.1.1E, AVA_VAN.2.1E, AVA_VAN.3.1E, AVA_VAN.4.1E elements concern the issue: how to check whether the delivered TOE (e.g., a sensor system) is well prepared for the analyses and penetration tests. The actions concern the TOE configuration, compliance of the operational and test environments, test equipment, installation, and initialization (e.g., reaching \"a known state after the power on\"). These actions are similar for all IT products and are based on general routines related to the evaluated product and its evidences--no specific research issues focused on supporting the evaluator have been identified by the author. 2. AVA_VAN.1.2E, AVA_VAN.2.2E, AVA_VAN.3.2E, AVA_VAN.4.2E elements concern how to examine publicly available information sources to identify potential vulnerabilities. There are many sources of publicly available, security-related information presenting an extremely broad range of issues, e.g., mailing lists, security forums, publications, etc. They have different features, contents, and quality. The search is time-consuming and the search results' quality is questionable because certain relevant vulnerabilities may be omitted. This process requires better orientation in terms of the TOE's specific features (here, sensor-specific) and better structure and organization. Currently no guidelines are available on this matter. The questions are: \"How to identify representative and plausible sources?\" and \"How to identify the potential vulnerability relevant to the evaluated TOE?\". The research problem is to develop an ontology-based method allowing one to:  
* identify security properties of the evaluated IT product relevant to the vulnerability assessment;
* identify a potential vulnerability process using these properties. 3. AVA_VAN.2.3E, AVA_VAN.3.3E, AVA_VAN.4.3E elements concern how to perform a less or more rigorous vulnerability analysis (AVA_VAN.2.3E--independent, AVA_VAN.3.3E--focused, AVA_VAN.4.3E--methodical). The vulnerability analysis is based on the search for evidence--security target (ASE), guidance documentation (AGD), functional specification (ADV_FSP), TOE design (ADV_TDS), security architecture (ADV_ARC), and implementation (ADV_IMP)--to identify other potential vulnerabilities. This process is iterative, complex, and has to control a lot of diversified information. First, the hypothesized vulnerabilities are identified. Next, they are prioritized on the basis of the estimated probability that a potential vulnerability exists. Then, the attack potential required to exploit a vulnerability is considered.