Source: http://mhavila.com.br/link/security/sec-standard.html
Timestamp: 2018-03-22 21:29:33
Document Index: 123373420

Matched Legal Cases: ['art 1', 'art 1', 'art 2', 'art 3', 'art 1', 'art 2', 'art 2', 'art 1', 'art 15']

Hyperlink: Security: Standards
HOME : Security : Standards | Go to contents | Selecionar Idioma | Esta em Português |
· Centers
· PKI
· Malware...
· E-Mail, Spam
· IDS
· Internet Protocols
ISO/IEC 15408 - Common Criteria (CC)
Common Criteria - The Common Criteria Portal
The Common Criteria for Information Technology Security Evaluation (CC), and the companion Common Methodology for Information Technology Security Evaluation (CEM) are the technical basis for an international agreement, the Common Criteria Recognition Agreement (CCRA).
For Consumers, Developers, Experts.
From Wikipedia, the free encyclopedia. Common Criteria (CC): Key Concepts, History, Mutual Recognition Arrangement, Some Thoughts, External links.
Evaluation Assurance Level (EAL).
Information technology -- Security techniques -- Evaluation criteria for IT security -- Part 1: Introduction and general model. Revision of withdrawn standards ISO/IEC 15408-1:2005, ISO/IEC 15408-1:1999.
ISO/IEC Freely Available Standards - ISO/IEC 15408
ISO/IEC 15408: Information technology -- Security techniques -- Evaluation criteria for IT security.
ISO/IEC 15408-1:2009 (ZIP) Part 1: Introduction and general model. 3rd edition.
ISO/IEC 15408-2:2008 (ZIP) Part 2: Security functional requirements. 3rd edition.
ISO/IEC 15408-3:2008 (ZIP) Part 3: Security assurance requirements. 3rd edition.
The Common Criteria Evaluation and Validation Scheme (CCEVS)
The National Information Assurance Partnership (NIAP) is a U.S. Government initiative originated to meet the security testing needs of both information technology (IT) consumers and producers. NIAP is operated by the National Security Agency (NSA).
International Standard ISO/IEC 17799:2000 Code of Practice for Information Security Management - Frequently Asked Questions (FAQ) (PDF), nov-2002.
The Common Criteria (CC) project was formerly maintained by NIST Computer Security Division.
The Common Criteria ISO/IEC 15408 - The Insight, Some Thoughts, Questions and Issues (PDF)
SANS Institute whitepaper. By Ariffuddin Aizuddin, 2001.
Common Criteria Evaluation and Validation Scheme (CCEVS) & Rainbow Series
By National Information Assurance Partnership (NIAP), a U.S. Government initiative.
The Rainbow Series (sometimes known as the Rainbow Books) is a series of computer security standards and guidelines published by the United States government in the 1980s and 1990s. They were originally published by the U.S. Department of Defense (DoD) Computer Security Center, and then by the National Computer Security Center.
The Rainbow Series is six-foot tall stack of books on evaluating "Trusted Computer Systems" according to the National Security Agency (NSA). The term "Rainbow Series" comes from the fact that each book is a different color. The main book, upon which all other expound, was the Orange Book.
Note (2003): Portions of the Rainbow Series (e.g. the Orange book and the Red Book) have been superseded by the Common Criteria Evaluation and Validation Scheme (CCEVS).
Format: ASCII Text. Available at Federation of American Scientists (FAS), Intelligence Resource Program. Alternative: csrc.nist.gov.
The Orange Book Site - Dynamoo.com
First published in 1983, the US Department of Defense Trusted Computer System Evaluation Criteria, (DOD-5200.28-STD) known as the Orange Book was a de facto standard for computer security, now superseded by the Common Criteria Evaluation and Validation Scheme (CCEVS). Orange Book was part of NSA/DoD Rainbow Series.
Orange Book Summary.
USA Department of Defense Standard: Trusted Computer System Evaluation Criteria (DoD 5200.28-STD).
ISO/IEC 27000 series (formerly 17799, BS 7799) - Information Security Management
The British Standard 7799 (BS7799) was originally a code of practice issued by the UK Government (Department of Trade and Industry - DTI) in 1993, then published as standard in 1995 by the British Standards Institution (BSi) and revised in 1999. When initially published as an ISO international standard in December 2000, BS7799 part 1 (BS7799-1) became ISO 17799, because a standard called ISO 7799 already existed.
In October 2005, British Standard BS 7799 part 2 (BS7799-2) was adopted by ISO, re-badged beggining the new 27000 international information security standard series, released as ISO/IEC 27001:2005 standard.
From 2001 to 2004, the ISO 17799 (BS7799-1) international standard went throught a major revision, culminating in the new version ISO/IEC 17799:2005 published in June 2005. In July 2007, the 17799:2005 standard was renumbered to 27002:2005 (by ISO/IEC 17799:2005/Cor.1:2007), integrating the new 27000 series.
ISO 27001 [BS7799-2]: information security management systems (ISMS) requirements. ISO/IEC 27001:2005 = BS 7799-2:2005. Requirements (shall) to implement an information security management system.
ISO 27002 [BS7799-1]: code of practice for information security management. ISO/IEC 27002:2005 = ISO 17799:2005 = BS7799-1:2005. Recommendations (should) of information security controls.
ISO/IEC 27000 series - Information technology -- Security techniques:
ISO/IEC 27000:2014 - Information security management systems (ISMS) -- Overview and vocabulary.
ISO/IEC 27001:2013 [BS7799-2] - information security management systems (ISMS) - Requirements.
ISO Guide 72:2001 similar to ISO 9000 & ISO 14000. Based on revised 17799 and 13335, British Standard 7799 Part 2.
ISO/IEC 27002:2013 [BS7799-1] - Code of practice for information security controls.
ISO/IEC 27002:2005 = ISO 17799:2005 = BS7799-1:2005. Recomendações (should/convém) de controles para segurança da informação.
ISO/IEC 27003:2010 - Information security management system implementation guidance.
ISO/IEC 27004:2009 - Information security management -- Measurement.
ISO/IEC 27005:2011 - Information security risk management [BS 7799-3].
ISO/IEC 27014:2013 - Governance of information security.
ISO/IEC 27006:2011 - Requirements for bodies providing audit and certification of information security management systems.
ISO/IEC 27007:2011 - Guidelines for information security management systems auditing.
ISO/IEC TR 27008:2011 - Guidelines for auditors on information security controls.
ISO/IEC 27010:2012 - Information security management for inter-sector and inter-organizational communications.
ISO/IEC 27011:2008 - Information security management guidelines for telecommunications organizations based on ISO/IEC 27002.
ISO/IEC 27013:2012 - Guidance on the integrated implementation of ISO/IEC 27001 and ISO/IEC 20000-1.
ISO/IEC TR 27015:2012 - Information security management guidelines for financial services.
ISO/IEC TR 27016:2014 - Information security management -- Organizational economics.
ISO/IEC CD 27017 (Under development) - Code of practice for information security controls for cloud computing services based on ISO/IEC 27002.
ISO/IEC TR 27019:2013 - Information security management guidelines based on ISO/IEC 27002 for process control systems specific to the energy utility industry.
ISO/IEC Online collection: Information Security Management Systems
ISO/IEC 27002:2005 - Information technology -- Security techniques -- Code of practice for information security management. Standardization of the British Standard BS 7799 Part 1.
ISO/IEC 17799:2005/Cor. 1:2007, published at 2007-07-06, changes the reference number of the standard from 17799 to 27002. ISO/IEC 17799:2005, published at 2005-06-10, is an updated revision of ISO/IEC 17799:2000. By International Organization for Standardization (ISO).
ISO JTC 1/SC 27 - IT Security techniques.
From Wikipedia, the free encyclopedia. Wikipedia: ISO/IEC 27000.
Wikipedia: ISO/IEC 27001:2005 - Information technology -- Security techniques -- Information security management systems (ISMS) -- Requirements. Wikipedia: ISO/IEC 27002:2005 (formerly 17799:2005) - Code of practice for information security management. Good practice advice on ISMS.
Wikipedia: ISO/IEC 27003.
Wikipedia: ISO/IEC 27004.
Wikipedia: ISO/IEC 27005.
Wikipedia: ISO/IEC 27006 - Requirements for bodies providing audit and certification of information security management systems. A guide to the certification/registration process.
This website is dedicated to the latest international standards for information security management. ISO 27000 series, Other standards, FAQ, Books, Links.
ISO 27000 Directory
Information Portal for ISO 27000 series: 27001, 27002, 27004, 27005. A Short History of the ISO 27000 Standards.
ISO 27001 and ISO 27002 (17799) User Group
International ISO 27001 and ISO 27002 (ISO 17799) Information Security Community Portal and Forum. User forums, news, articles and other information related to the ISO 27000 and BS7799 information security standards series.
ISO 17799 Implementation Portal
Iso 17799 Information and Resource Portal. What is ISO 17799 (the ISO Security Standard): Presentation on ISO 17999 general information.
Old location: iso17799software.com, The Information Portal for ISO17799, The ISO 17799 Service & Software Directory.
ISO 17799 Central
The A-Z guide for BS7799, ISO 27001 and ISO17799 information.
Old location: iso-17799.com, The ISO 17799 Directory.
Standards Direct - ISO 17799/27001
ISO 17799 and ISO 27001 Purchase and Download.
ISO 17799 Made Easy
ISO/IEC 17799 Security Resources.
ISO 17799 Standard: ISO17799 Compliance & Positioning
By Risk Associates.
Callio Technologies: BS7799 ISO 17799 Information security policies software
Callio Technologies offers ISO17799 / BS7799-2 compliancy tools as well as expertise in: risk and gap analysis; developing codes of practice and information security management systems; drafting security policies based on the ISO 17799 / BS7799 standard; security audits; contingency plans; consultation and training in computer risk management.
Open Web Application Security Standards
Web Application Security Scanner Evaluation Criteria (WASSEC)
By Web Application Security Consortium (WASC).
See also Software Assurance Maturity Model (SAMM) and Comprehensive, Lightweight Application Security Process (CLASP).
By Open Web Application Security Project (OWASP).
Public-Key Cryptography and Digital Signature Standards
The Public-Key Cryptography Standards are specifications produced by RSA Laboratories in cooperation with secure systems developers worldwide for the purpose of accelerating the deployment of public-key cryptography. First published in 1991 as a result of meetings with a small group of early adopters of public-key technology, the PKCS documents have become widely referenced and implemented. Contributions from the PKCS series have become part of many formal and de facto standards, including ANSI X9 documents, PKIX, SET, S/MIME, and SSL.
RSA Laboratories, EMC Corporation.
RFC 3447 - Public-Key Cryptography Standards (PKCS) #1: RSA Cryptography Specifications Version 2.1
By J. Jonsson, B. Kaliski, RSA Laboratories, February 2003. This document obsoletes RFC 2437, PKCS #1 v2.0 (October 1998), RFC 2313, v1.5 (March 1998).
Cryptographic Message Syntax (CMS) & PKCS #7
By RSA Laboratories, EMC Corporation.
RFC 2315 - PKCS #7: Cryptographic Message Syntax, Version 1.5
By B. Kaliski, RSA Laboratories, March 1998. PKCS #7 version 1.5 was developed outside of the IETF and further documented in this Informational RFC; it was originally published as an RSA Laboratories Technical Note in November 1993. Since that time, the IETF has taken responsibility for the development and maintenance of the Cryptographic Message Syntax (CMS) standard, which is derived from PKCS #7 version 1.5.
RFC 3852 - Cryptographic Message Syntax (CMS)
By R. Housley, Vigil Security (formerly at RSA Laboratories), July 2004. This document describes the new Cryptographic Message Syntax (CMS). This syntax is used to digitally sign, digest, authenticate, or encrypt arbitrary message content. This document obsoletes RFC 3369 (August 2002) and RFC 2630 (June 1999).
RFC 4853 - Cryptographic Message Syntax (CMS) - Multiple Signer Clarification
By R. Housley, Vigil Security, April 2007.
RFC 5083 - Cryptographic Message Syntax (CMS) - Authenticated-Enveloped-Data Content Type
By R. Housley, Vigil Security, November 2007.
RFC 3370 - Cryptographic Message Syntax (CMS) Algorithms
By R. Housley, RSA Laboratories, August 2002. This document describes the conventions for using several cryptographic algorithms with the Cryptographic Message Syntax (CMS).
RFC 3274 - Compressed Data Content Type for Cryptographic Message Syntax (CMS)
By P. Gutmann, University of Auckland, June 2002.
Cryptographic Tokens and Smart Cards - PKCS #11 and #15
RSA Laboratories Public-Key Cryptography Standards (PKCS).
This standard specifies an API, called Cryptoki, to devices which hold cryptographic information and perform cryptographic functions. Cryptoki, pronounced crypto-key and short for cryptographic token interface, follows a simple object-based approach, addressing the goals of technology independence (any kind of device) and resource sharing (multiple applications accessing multiple devices), presenting to applications a common, logical view of the device called a cryptographic token.
PKCS #15 establishes a standard that enables users in to use cryptographic tokens to identify themselves to multiple, standards-aware applications, regardless of the application's cryptoki (or other token interface) provider.
Identification cards -- Integrated circuit cards -- Part 15: Cryptographic information application.
Wikipedia: PKCS #11
PKCS#11 Explorer
PKCS#11 Explorer is a tool for examining the contents of PKCS#11 tokens (e.g. USB tokens and smartcards), and for carrying out various operations on them, including: show all objects stored and all mechanisms supported and their properties; monitor token insert/removal; initialize tokens; set and change PINs; create test keys; seed and generate random data. Free download, including executable and full Delphi source code.
FreeOTFE Explorer - Appendix E: PKCS#11 Driver Libraries (PDF)
FreeOTFE Explorer manual, p 145-150. Not exhaustive list of token manufacturers, devices and their PKCS#11 driver libraries.
FreeOTFE at Sourceforge.
PKCS#11 Task Force - Found Drivers
Wikipedia: Smart card
A smart card, chip card, or integrated circuit card (ICC) is any pocket-sized card with embedded integrated circuits. Smart cards can provide strong security identification, authentication, data storage (including digital certificates) and application processing.
Smart Card Alliance mission is to accelerate the widespread adoption, usage, and application of smart card technology in North America by bringing together users and technology providers in an open forum to address opportunities and challenges for our industry.
OpenSC provides a set of libraries and utilities to work with smart cards. Its main focus is on cards that support cryptographic operations, and facilitate their use in security applications such as authentication, mail encryption and digital signatures. OpenSC implements the PKCS#11 API so applications supporting this API (such as Mozilla Firefox and Thunderbird) can use it. On the card OpenSC implements the PKCS#15 standard and aims to be compatible with every software/card that does so, too.
M.U.S.C.L.E. - Movement for the Use of Smart Cards in a Linux Environment
MUSCLE is a project to coordinate the development of smart cards and applications under Linux. The purpose is to develop a set of compliant drivers, API's, and a resource manager for various smart cards and readers for the GNU environment. Source code is now distributed by this site that supports the Schlumbeger Reflex 60 line of reader and all ISO-7816-4 compliant smart cards. I would like to see a Linux resource manager for smart cards and other cryptographic tokens such as Ibuttons or SecureId. A good standpoint for this is the PC/SC specifications written for Microsoft OS.
PCSC-Lite projects on Alioth
PC/SC-Lite: Middleware to access a smart card using SCard API (PC/SC). CCID driver: This package provides the source code for a generic USB CCID (Chip/Smart Card Interface Devices) driver and ICCD (Integrated Circuit(s) Card Devices).
Advanced Electronic Signatures Standards (CAdES, XAdES, PAdES)
European Telecommunications Standards Institute (ETSI) on Electronic Signature
CMS Advanced Electronic Signatures (CAdES) - ETSI standards
XML Advanced Electronic Signatures (XAdES) - ETSI standards
PDF Advanced Electronic Signatures (PAdES) - ETSI standards
W3C Note, 20 February 2003.
CAdES (CMS Advanced Electronic Signatures)
XAdES (XML Advanced Electronic Signatures)
PAdES (PDF Advanced Electronic Signatures)
RFC-5126: CMS Advanced Electronic Signatures (CAdES)
By D. Pinkas, Bull SAS; N. Pope, Thales eSecurity; J. Ross. Informational Security and Standards, February 2008, IETF. This memo provides information for the Internet community. It does not specify an Internet standard of any kind. This document defines the format of an electronic signature that can remain valid over long periods. This includes evidence as to its validity even if the signer or verifying party later attempts to deny (i.e., repudiates) the validity of the signature. The format can be considered as an extension to RFC 3852 and RFC 2634, where, when appropriate, additional signed and unsigned attributes have been defined.
· URL: www.mhavila.com.br/link/security/sec-standard.html