Source: http://docplayer.net/2031888-C033-certification-report.html
Timestamp: 2017-01-21 02:42:27
Document Index: 147505704

Matched Legal Cases: ['art 1', 'art 2', 'art 3', 'art 2', 'art 2', 'art 3', 'art 3', 'art 1', 'art 1', 'art 1', 'art 3']

⭐C033 Certification Report
Download "C033 Certification Report"
1 C033 Certification Report Mobile Billing System File name: Version: v1a Date of document: 15 June 2011 Document classification: For general inquiry about us or our services, please2 3 C033 Certification Report - Mobile Billing System C033 Certification Report Mobile Billing System 15 June 2011 ISCB Department CyberSecurity Malaysia Level 8, Block A, Mines Waterfront Business Park, No 3 Jalan Tasik, The Mines Resort City Seri Kembangan, Selangor, Malaysia Tel: Fax: Page i of x4 C033 Certification Report - Mobile Billing System Document Authorisation DOCUMENT TITLE: DOCUMENT REFERENCE: ISSUE: version 1.4 v1a DATE: 15 June 2011 DISTRIBUTION: UNCONTROLLED COPY - FOR UNLIMITED USE AND DISTRIBUTION Page ii of x5 C033 Certification Report - Mobile Billing System Copyright Statement The copyright of this document, which may contain proprietary information, is the property of CyberSecurity Malaysia. The document shall be held in safe custody. CYBERSECURITY MALAYSIA, 2011 Registered office: Level 8, Block A, Mines Waterfront Business Park, No 3 JalanTasik, The Mines Resort City, Seri Kembangan Selangor Malaysia Registered in Malaysia Company Limited by Guarantee Company No U Printed in Malaysia Page iii of x6 C033 Certification Report - Mobile Billing System Foreword The Malaysian Common Criteria Evaluation and Certification (MyCC) Scheme has been established under the 9 th Malaysian Plan to increase Malaysia s competitiveness in quality assurance of information security based on the Common Criteria (CC) standard and to build consumers confidence towards Malaysian information security products. The MyCC Scheme is operated by CyberSecurity Malaysia and provides a model for licensed Malaysian Security Evaluation Facilities (MySEFs) to conduct security evaluations of ICT products, systems and protection profiles against internationally recognised standards. The results of these evaluations are certified by the Malaysian Common Criteria Certification Body (MyCB) Unit, a unit established within Information Security Certification Body (ISCB) Department CyberSecurity Malaysia. By awarding a Common Criteria certificate, the MyCB asserts that the product complies with the security requirements specified in the associated Security Target. A Security Target is a requirements specification document that defines the scope of the evaluation activities. The consumer of certified IT products should review the Security Target, in addition to this certification report, in order to gain an understanding of any assumptions made during the evaluation, the IT product's intended environment, its security requirements, and the level of confidence (i.e., the evaluation assurance level) that the product satisfies the security requirements. This certification report is associated with the certificate of product evaluation dated 15 June 2011, and the Security Target (Ref [6]). The certification report, Certificate of product evaluation and security target are posted on the MyCC Scheme Certified Product Register (MyCPR) at Reproduction of this report is authorized provided the report is reproduced in its entirety. Page iv of x7 C033 Certification Report - Mobile Billing System Disclaimer The Information Technology (IT) product identified in this certification report and its associate certificate has been evaluated at an accredited and licensed evaluation facility established under the Malaysian Common Criteria Evaluation and Certification (MyCC) Scheme (Ref [4]) using the Common Methodology for IT Security Evaluation, version 3.1 revision 3 (Ref [3]), for conformance to the Common Criteria for IT Security Evaluation, version 3.1 revision 3 (Ref [2]). This certification report and its associated certificate apply only to the specific version and release of the product in its evaluated configuration. The evaluation has been conducted in accordance with the provisions of the MyCC Scheme and the conclusions of the evaluation facility in the evaluation technical report are consistent with the evidence adduced. This certification report and its associated certificate is not an endorsement of the IT product by CyberSecurity Malaysia or by any other organisation that recognises or gives effect to this certification report and its associated certificate, and no warranty of the IT product by CyberSecurity Malaysia or by any other organisation that recognises or gives effect to this certificate, is either expressed or implied. Page v of x8 C033 Certification Report - Mobile Billing System Document Change Log RELEASE DATE PAGES AFFECTED REMARKS/CHANGE REFERENCE v1 2 June 2011 All Final released. v1a 15 June 2011 Page iv Add the date of the certificate. Page vi of x9 C033 Certification Report - Mobile Billing System Executive Summary IDOTTV Mobile Billing System Version 1.4 (hereafter referred as Mobile Billing System) from IDOTTV Sdn Bhd is the Target of Evaluation (TOE) for this Evaluation Assurance Level (EAL) 1 evaluation. The Mobile Billing System is software that facilitates secure, confidential, and paperless billing services between service provider and the customers which is installed on a user s mobile device. It comprises of three components: Mobile Billing Applet. A java-based mobile application developed specifically for the Blackberry mobility platform. The application provides a subscriber with the basis for integrating with the mobile billing server. Mobile Billing Server. An application that provides connectivity to the billing systems of telecommunication providers, and the mobile billing applet application for subscribers. It also provides storing data for the TOE. Mobile Billing Webtool. A web-based interface for both subscribers and administrators to login and manage their accounts or the system. The part of the Mobile Billing System that covered under scope of evaluation is identification and authentication (user login), secure communication between Mobile Billing server with the Mobile Application, user data protection which is user access based on the user level, and security management of the TOE which focusing on account management activities such as create user account, reset the password and change the access level for telecommunication company. The scope of the evaluation is defined by the Security Target (Ref [6]), which identifies assumptions made during the evaluation, the intended environment for Mobile Billing System, the security requirements, and the evaluation assurance level at which the product is intended to satisfy the security requirements. Consumers are advised to verify that their operating environment is consistent with that specified in the security target, and to give due consideration to the comments, observations and recommendations in this certification report. This report confirms the findings of the security evaluation of Mobile Billing System, to the Common Criteria (CC) evaluation assurance level EAL1. The report confirms that the product has met the target assurance level of EAL1 and the evaluation was conducted in accordance with the relevant criteria and the requirements of the Malaysian Common Criteria Evaluation and Certification (MyCC) Scheme (Ref [4]). The evaluation was performed by the stratsec Security Evaluation Facility (STRATSEF) and was completed on 30 May Malaysian Common Criteria Certification Body (MyCB), as the MyCC Scheme Certification Body, declares that the Mobile Billing System evaluation meets all the conditions of the Arrangement on the Recognition of Common Criteria Certificates and that the product will be listed on the MyCC Scheme Certified Products Register (MyCPR) at Page vii of x10 C033 Certification Report - Mobile Billing System It is the responsibility of the user to ensure that the Mobile Billing System meets their requirement and security needs. It is recommended that prospective users of the Mobile Billing System refer to the ST (Ref [6]), and read this Certification Report prior to deciding whether to purchase and deploy the product. Page viii of x11 C033 Certification Report - Mobile Billing System Table of Contents 1 Target of Evaluation TOE Description TOE Identification Security Policy TOE Architecture Logical Boundaries Physical Boundaries Clarification of Scope Assumptions Evaluated Configuration Delivery Procedures Documentation Evaluation Evaluation Analysis Activities Life-cycle support Development Guidance documents IT Product Testing Result of the Evaluation Assurance Level Information Recommendation Annex A References...13 A.1 References A.2 Terminology A.2.1 Acronyms A.2.2 Glossary of Terms Page ix of x12 C033 Certification Report - Mobile Billing System Index of Tables Table 1: TOE identification... 1 Table 2: Independent Functional Testing... 9 Table 3: List of Acronyms Table 4: Glossary of Terms Index of Figures Figure 1: The components of Mobile Billing System... 4 Page x of x13 1 Target of Evaluation 1.1 TOE Description 1 The TOE is IDOTTV Mobile Billing System (hereafter referred as Mobile Billing System) that provides a central point for managing customer billing information for telecommunications providers, in order to facilitate secured, confidential and paperless billing. This system provides interfaces to the telecommunications provider s billing system, administrator, and to the users where the mobile application installed on a user s device. It also features a mobile payment function that enables customers to make bill payment via mobile device. 2 The TOE is comprised of three key components: a) Mobile Billing Applet - A java-based mobile application developed specifically for the Blackberry mobility platform. The application provides a subscriber with the basis for integrating with the mobile billing server. b) Mobile Billing Server An application that provides: i- Connectivity to the mobile billing systems of telecommunications providers. ii- iii- A connection to the mobile billing applet that provides subscribers with system connectivity. Storing data for the TOE c) Mobile Billing Webtool - A web-based interface for both subscriber and administrators to login and manage their accounts or the system. 3 The evaluated security functionalities for the TOE includes: a) Identification and Authentication - provides identification and authentication of the TOE users. b) User data protection - The TOE will permit a user to access the billing information only if a userid or role of the user has permission to perform the requested action on the information. c) Security Management managing user management functions through the use of the Web Administration as well as through the applet installed on mobile devices to ensure that the functions are restricted to only those users that need to have access to privileged functions. d) Secure Communication - protection of the billing information from disclosure and modification when the scanned data is sent from Mobile Billing server to the applet application. 1.2 TOE Identification 4 The details of the TOE are identified in Table 1 below. Table 1: TOE identification Page 1 of 1514 Evaluation Scheme Project Identifier Malaysian Common Criteria Evaluation and Certification (MyCC) Scheme C033 Mobile Billing System TOE Name (consist of Mobile Billing Webtool, Mobile Billing Applet version 1.0 and Mobile Billing Server version 1.0) TOE Version 1.4 Security Target Title IDOTTV Mobile Billing System Security Target Security Target Version 1.2 Security Target Date 25 May 2011 Assurance Level EAL 1 Criteria Methodology Protection Conformance Common Conformance Profile Criteria Common Criteria Part 1, Common Criteria Part 2, Common Criteria Part 3 Revision 3 (Ref [2]) Common Methodology for IT Security Evaluation, version 3.1 revision 3 (Ref [3]) No conformance to any PP. - Part 2 conformant. Conformant with Common Criteria for Information Technology Security Evaluation Part 2: Security functional requirements, version 3.1, Revision 3, July Part 3 conformant, Conformant with Common Criteria for Information Technology Security Evaluation Part 3: Security assurance requirements, version 3.1, Revision 3, July Package conformant to EAL1. IDOTTV Sdn Bhd, Level 10. Kelana Jaya Parkview Tower, Sponsor and Developer Evaluation Facility Jalan SS6/2, Petaling Jaya, Phone: Fax: stratsec.net SDN BHD known as STRATSEF Page 2 of 1515 1.3 Security Policy 5 Mobile Billing System does implement Access Control Security Function Policy (SFP) to restrict the access level of the user based on their role stored in the Access Control Lists. The roles maintained by the TOE are: a) Telecommunication Administrator can see all the billing information. b) Mobile Subscriber can only see their billing information. c) Super Administrator can see all the billing information. d) Telecommunication Employee - will be up to the Telecommunication Administrator or Super Administrator to configure the access. 6 The details of the access control security function policy are described in Section 4.3 of the Security Target (Ref [6]). 1.4 TOE Architecture 7 Mobile Billing System includes both logical and physical boundaries Logical Boundaries 8 The logical boundary consists of the security functionality of TOE is summarized below: a) Identification and Authentication - The TOE requires the user to identify and authenticate themselves before accessing any information and performing any actions. The TOE will check the credentials presented by the user upon the login page against the authentication information in the database. b) Security Management - The TOE provides various user management functions to ensure efficient and secure management of the TOE. c) User Data Protection - The TOE provides its own access control between subjects and objects covered by the User Access Control Security Function Policy. d) Secure Communication - The TOE is able to protect the billing information from disclosure and modification when the scanned data is sent from Mobile Billing Server to the applet application Physical Boundaries 9 Physically, the TOE is an application that consists of the applet installed on Java enabled mobile devices as well as Mobile Billing Server which runs Apache HTTP Server version 2.0 on a Linux Operating System (CentOS 5) as described in Section of the Security Target (Ref [6]). 10 Administrator can access the TOE through a Web Admin interface using Mobile Billing Webtool and user will access the TOE via application installed on their Blackberry phone using Mobile Billing Applet version 1.0. Page 3 of 1516 1.5 Clarification of Scope Figure 1: The components of Mobile Billing System 11 The scope of the evaluation was limited to those claims made in the Security Target (Ref [6]) and includes only the following evaluated security functionalities: a) Identification & Authentication - When a user issues a request to the TOE to access the user s billing information, the TOE requires that the user identify and authenticate themselves before performing any actions on behalf of the user. The TOE checks the credentials presented by the user upon the login page against the authentication information in the database. Mobile Subscriber will login through the interface provided by the Mobile Billing applet on their mobile device. For the Telecommunication Administrator, Telecommunication Employee and the Super Administrator, they will login through the Mobile Billing Webtool (web portal). Mobile Billing Server is responsible to hash users password before being used to authenticate the user or when users change their passwords, and is being written to the database. b) User Data Protection The TOE maintained four types of user: Mobile Subscriber, Telecommunication Administrator, Telecommunication Employee and the Super Administrator. Each type of user will have different access rights to billing information. For mobile subscriber, they can only access their own billing information whereas administrator can access all information. All users will have a unique user ID. The access control function permits a user to access the billing information, via Mobile Billing Applet, only if a userid or role of the user has permission to access the information. Each Access Control List (ACL) maps users and roles to the operations that they are permitted to perform on the object. For the mobile subscriber, their userid, IMEI (International Mobile Equipment Identity is a unique 17 or 15 digit code used to identify an individual mobile station to a GSM or UMTS network), IMSI (International Mobile Subscriber Identity is a unique 15-digit code used to identify an individual user on a GSM network and a TAC code which is issued to the user during registration will be used to identify the user when they are accessing the billing information. This is to ensure that Page 4 of 1517 only the user with the registered SIM card and phone can access the information. c) Security Management The TOE provides various management functions to ensure efficient and secure management of the TOE based on the type of TOE users as follows: i- Mobile Subscriber Checking their account statement only. ii- Administrator (Telecommunication) Authenticate to the Mobile Billing Server and as well as performing management functions according to their roles through the Mobile Billing Webtool. Only administrator and super administrators can change passwords, reset passwords and change the access levels of the telecommunication employees. Reset Password for user that forgot its password. iii- Super Administrator Authenticate to the Mobile Billing Server and as well as performing management functions according to their roles through the Mobile Billing Webtool. Only administrator and super administrators can change passwords, reset passwords and change the access levels of the telecommunication employees. Create administrator users for the telecommunication company. iv- Telecommunication Employees Authenticate to the Mobile Billing Server and as well as performing management functions according to their level that is allocated to them by the administrators or super administrator through the Mobile Billing Webtool. The TOE allows no one to change the default values of the TOE security function (TSF) data and security attributes of the TOE as well as the access control list (ACL). d) Secure Communication - The TOE provides a secure communication channel between the applet application and the Mobile Billing server when the billing information is transferred to and from the server. The initiation of the secure SSL channel is done by the Mobile Billing Applet on the Mobile Subscriber s mobile device. Whenever user launches the applet and proceeds to authenticate themselves, the Mobile Billing Applet will do a handshake protocol with the Mobile Billing Server and after this, a session key will be generated and will be used to encrypt the user data sent/retrieved to and from the Mobile Billing Server. 12 Potential consumers of the TOE are advised that some functions and services may not have been evaluated as part of the evaluation. Potential consumers of the TOE Page 5 of 1518 should carefully consider their requirements for using functions and services outside of the evaluated configuration. 13 Functions and services which are not included as part of the evaluated configuration are as follows: a) Apache HTTP Server version 2.0; b) An Operating System (Linux CentOS 5); c) A Database Management System Software; d) Other supporting gadgets; i. Web Browser (Mozilla Firefox and Internet Explorer) ii. BlackBerry phone; regardless the phone model. 1.6 Assumptions 14 This evaluation was performed at EAL1. Therefore, no assumptions for the TOE were defined in the ST (Ref [6]). 1.7 Evaluated Configuration 15 In principal, the TOE is to be configured according to the secure installation guidance (Ref 21). 16 The TOE is configured based on secure installation guidance (Ref 21) as following: a) MySQL Installation. b) SSL Setup. c) Server Setup. d) Subscriber Subscription and Installation. e) Subscriber Application Guide. 1.8 Delivery Procedures 17 Subscriber for the Mobile Billing System will need to download and install the Mobile Billing Applet for their Blackberry mobile devices. They will be provided a link to download the applet once they subscribed with any respected Telco. 18 However, for this EAL1 evaluation, TOE Delivery (ALC_DEL) is not included in the scope of the evaluation. Thus, developer did not provide any documentation on TOE delivery and the evaluators did not verify any TOE delivery process. 1.9 Documentation 19 To ensure continued secure usage of the product, it is important that the Mobile Billing System is used in accordance with the guidance documentation. 20 The following documentation is provided by the developer to the end user as guidance to ensure secure operation of the product: Page 6 of 1519 a) MobileBilling Subscriber Application Guide (Ref [12]). b) MobileBilling Web Portal User Guide (Ref [13]). 21 The following documentation is used by the developer s authorised personnel as guidance to ensure secure installation of the product: a) MobileBilling MYSQL Installation Guide (Ref [9]). b) MobileBilling Server Setup Guide (Ref [14]). c) MobileBilling Subscriber Subscription and Installation Guide (Ref [10]). d) MobileBilling SSL Setup (Linux) Guide (Ref [15]). e) MobileBilling Subscriber Application Guide (Ref [12]). Page 7 of 1520 2 Evaluation 22 The evaluation was conducted in accordance with the requirements of the Common Criteria, Version 3.1 Revision 3 (Ref [2]) and the Common Methodology for IT Security Evaluation (CEM), Version 3.1 Revision 3 (Ref [3]). The evaluation was conducted at Evaluation Assurance Level 1 (EAL1). The evaluation was performed conformant to the MyCC Scheme Policy (MyCC_P1) (Ref [4]) and MyCC Scheme Evaluation Facility Manual (MyCC_P3) (Ref [5]). 2.1 Evaluation Analysis Activities 23 The evaluation activities involved a structured evaluation of Mobile Billing System, including the following components: Life-cycle support 24 An analysis of the Mobile Billing System configuration management system and associated documentation was performed. The evaluators confirmed that the configuration list which includes the TOE and the evaluation evidence were clearly and uniquely labelled Development 25 The evaluators analysed the Mobile Billing System functional specification; they determined that the design completely and accurately describes the TOE security functionality (TSF) interfaces (TSFIs), and how the TSF implements the security functional requirements (SFRs) Guidance documents 26 The evaluators examined the Mobile Billing System preparative user guidance and operational user guidance, and determined that it sufficiently and unambiguously described how to securely transform the TOE into its evaluated configuration, and how to use and administer the product in order to fulfil the security objectives for the operational environment. The evaluators examined and tested the preparative and operational guidance, and determined that they were complete and sufficiently detailed to result in a secure configuration IT Product Testing 27 Testing at EAL1 consists of performing independent function test, and performing penetration tests. Mobile Billing System testing was conducted by tester from stratsec at IDOTTV Office, MTDC UPM, Selangor where it was subjected to an independent functional and penetration tests. The detailed testing activities, including configurations, procedures, test cases, expected results and actual results are documented in a separate Test Plan Reports. Page 8 of 1521 Independent Functional Testing 28 At EAL1, independent functional testing is the evaluation conducted by evaluator based on the information gathered by examining functional and guidance documentation, and creating test cases to verify the behaviour of the TOE. 29 All testing was planned and documented to a sufficient level of detail to allow repeatability of the testing procedures and results. The result of the independent tests developed and performed by the evaluators to verify the TOE functionality are as follows: Table 2: Independent Functional Testing Description Security Function TSFI Results To test that the password of the user is protected using the MD5 algorithm method and is stored in the user database. Identification and Authentication Authentication Database Passed. To test that normal user and administrator have specific security attribute in accessing the billing information and also controlling the data in the system User protection data Web User Information Database Portal Passed. To test that the access controls policy is implemented correctly within the TOE. User protection data Web User Information Database Portal Passed. To test that user have to login before they can perform any action on that account Identification and Authentication Mobile Device Authentication Database Passed. To test that the TOE able to identified the login user as registered in database Identification and Authentication Mobile Device Authentication Database Passed. To test that only administrator have the control over write and delete security function. Security Management Web User Information Portal Passed. Page 9 of 1522 Database To test that there is restrictive default values for security attribute during the initialization process and TOE shall allow specifying alternative initial values to override the default values when an object or information is created. Security Management Mobile Device User Information Database Passed. Run test to ensure that only the owner of password is able to modify or change Identification and Authentication Web User Information Database Portal Passed. To test the TOE capabilities to perform the required management functions. Security Management Web User Information Database Portal Passed. To test that the roles of normal user and administrator is maintained in the TOE and able to associate users with roles User protection data Web Portal Passed. To test that the data connection from mobile to server is secured and reliable. Secure Communication Mobile Web Device Portal Passed. 30 All tests performed by the evaluators produced the expected results and as such the TOE behaved as expected Penetration Testing 31 The evaluators performed a vulnerability analysis of the TOE in order to identify potential vulnerabilities in the TOE. This vulnerability analysis considered public domain sources and an analysis of guidance documentation, and functional specification. 32 From the vulnerability analysis, the evaluators conducted penetration testing to determine that the TOE is resistant to attacks performed by an attacker possessing Basic attack potential. The following factors have been taken into consideration during the penetration tests: Page 10 of 1523 a) Time taken to identify and exploit (elapsed time); b) Specialist technical expertise required (specialist expertise); c) Knowledge of the TOE design and operation (knowledge of the TOE); d) Window of opportunity; and e) IT hardware/software or other equipment required for exploitation. 33 The penetration tests focused on: a) Web Based Exploit and Penetration Testing. b) Mobile Penetration Testing. 34 The results of the penetration testing note that there is no exploitable and/or residual vulnerability found. However, it is important to ensure that the TOE is use only in its evaluated configuration and in secure environment Testing Results 35 Tests conducted for the Mobile Billing System produced the expected results and demonstrated that the product behaved as specified in its Security Target and functional specification. 36 Based on the results of penetration testing, the evaluators determined that the TOE is resistant to an attacker possessing a basic attack potential. Page 11 of 1524 3 Result of the Evaluation 37 After due consideration during the oversight of the execution of the evaluation by the certifiers and of the Evaluation Technical Report (Ref [7]), the Malaysian Common Criteria Certification Body certifies the evaluation of Mobile Billing System performed by the STRATSEC Security Evaluation Facility (SEF) which known as STRATSEF. 38 The STRATSEF found that Mobile Billing System upholds the claims made in the Security Target (Ref [6]) and supporting documentation, and has met the requirements of the Common Criteria (CC) assurance level EAL1. 39 Certification is not a guarantee that a TOE is completely free of exploitable vulnerabilities. There will remain a small level of risk that exploitable vulnerabilities remain undiscovered in its claimed security functionality. This risk is reduced as the certified level of assurance increases for the TOE. 3.1 Assurance Level Information 40 EAL1 provides a basic level of assurance by a limited Security Target and an analysis of the security functions in that Security Target, using a functional and interface specification and guidance documentation, to understand the security behaviour. 41 The analysis is supported by a search for potential vulnerabilities in the public domain and independent testing (functional and penetration) of the TOE security functions. 42 EAL1 also provides assurance through unique identification of the TOE and of the relevant evaluation documents. 3.2 Recommendation 43 In addition to ensure secure usage of the product, below are additional recommendations for Mobile Billing System consumers: a) Password strength, such as length and level of complexity for the user and administrator accounts should be enforced. b) The user must ensure that they will only use the TOE in secure manner according to the secure operational user guidance. c) Use it only in its evaluated configuration. Page 12 of 15 View more
C038 Certification Report TAXSAYA Online File name: Version: v1a Date of document: 15 August 2013 Document classification: For general inquiry about us or our services, please email: mycc@cybersecurity.my More information C013 Certification Report
C013 Certification Report VirtualEye v5.0 File name: Version: v1a Date of document: 8 March 2011 Document classification: For general inquiry about us or our services, please email: mycc@cybersecurity.my More information Mobile Billing System Security Target
Mobile Billing System Security Target Common Criteria: EAL1 Version 1.2 25 MAY 11 Document management Document identification Document ID Document title Product version IDV_EAL1_ASE IDOTTV Mobile Billing More information C060 Certification Report
Certification Report HP Network Automation Ultimate Edition 10.10 Issued by: Communications Security Establishment Certification Body Canadian Common Criteria Evaluation and Certification Scheme Government More information MyCC Scheme Overview SECURITY ASSURANCE. Creating Trust & Confidence. Norhazimah Abdul Malek MyCC Scheme Manager zie@cybersecurity.
An Agency Under MOSTI MyCC Scheme Overview SECURITY ASSURANCE Creating Trust & Confidence Norhazimah Abdul Malek MyCC Scheme Manager zie@cybersecurity.my Copyright 2007 CyberSecurity Malaysia Slide no: More information Certification Report
Certification Report Trustwave Network Access Control (NAC) Version 4.1 and Central Manager Software Version 4.1 Issued by: Communications Security Establishment Certification Body Canadian Common Criteria More information Experience In Achieving MS ISO/IEC 17025 Accreditation Under Laboratory Accreditation Scheme Of Malaysia (SAMM)
Certification Report EAL 2+ Evaluation of McAfee Email and Web Security Appliance Version 5.5 Patch 2 Issued by: Communications Security Establishment Canada Certification Body Canadian Common Criteria More information Oracle Business Intelligence Enterprise Edition (OBIEE) Version 10.1.3.3.2 with Quick Fix 090406 running on Oracle Enterprise Linux 4 update 5 x86_64
Australasian Information Security Evaluation Program Certification Report Certificate Number: 2010/66 10 Mar 2010 Version 1.0 Commonwealth of Australia 2010. Reproduction is authorised provided that the More information Certification Report
Certification Report McAfee Network Security Platform M-Series and NS- Series Sensors Issued by: Communications Security Establishment Certification Body Canadian Common Criteria Evaluation and Certification More information Oracle Identity and Access Management 10g Release 10.1.4.0.1 running on Red Hat Enterprise Linux AS Release 4 Update 5
Australasian Information Security Evaluation Program Juniper Networks, Inc. JUNOS 12.1 X46 D20.6 for SRX-Series Platforms Certification Report 2015/90 3 July 2015 Version 1.0 Commonwealth of Australia More information Citrix NetScaler Platinum Edition Load Balancer Version 10.5 running on MPX 9700-FIPS, MPX 10500-FIPS, MPX 12500-FIPS, MPX 15500-FIPS appliances
Australasian Information Security Evaluation Program Certification Report Certificate Number: 2009/54 2 June 2009 Version 1.0 Commonwealth of Australia 2009. Reproduction is authorised provided that the More information Malaysian Common Criteria Evaluation & Certification (MyCC) Scheme Activities and Updates. Copyright 2010 CyberSecurity Malaysia
Malaysian Common Criteria Evaluation & Certification (MyCC) Scheme Activities and Updates Copyright 2010 CyberSecurity Malaysia Agenda 1. Understand Why we need product evaluation and certification ICT More information Citrix Password Manager, Enterprise Edition Version 4.5
122-B COMMON CRITERIA CERTIFICATION REPORT No. CRP235 Citrix Password Manager, Enterprise Edition Version 4.5 running on Microsoft Windows and Citrix Presentation Server Issue 1.0 June 2007 Crown Copyright More information Certification Report - Firewall Protection Profile and Firewall Protection Profile Extended Package: NAT
Template: CSEC_mall_doc.dot, 7.0 Ärendetyp: 6 Diarienummer: 14FMV10188-21:1 Dokument ID CB-015 HEMLIG/ enligt Offentlighets- och sekretesslagen (2009:400) 2015-06-12 Country of origin: Sweden Försvarets More information Australasian Information Security Evaluation Program
Australasian Information Security Evaluation Program Certification Report Certificate Number: 2009/58 17 September 2009 Version 1.0 Commonwealth of Australia 2009. Reproduction is authorised provided that More information Learn from the Expert Observation during Shadow Certification Assessment
Certification Report EAL 4+ Evaluation of Solaris 10 Release 11/06 Trusted Extensions Issued by: Communications Security Establishment Canada Certification Body Canadian Common Criteria Evaluation and More information SAMSUNG SDS FIDO Server Solution V1.1 Certification Report
KECS-CR-15-73 SAMSUNG SDS FIDO Server Solution V1.1 Certification Report Certification No.: KECS-ISIS-0645-2015 2015. 9. 10 IT Security Certification Center History of Creation and Revision No. Date Revised More information Korean National Protection Profile for Voice over IP Firewall V1.0 Certification Report
KECS-CR-16-36 Korean National Protection Profile for Voice over IP Firewall V1.0 Certification Report Certification No.: KECS-PP-0717-2016 2016. 6. 10 IT Security Certification Center History of Creation More information Australasian Information Security Evaluation Program
Australasian Information Security Evaluation Program Certification Report Certificate Number: 2008/50 16 Dec 2008 Version 1.0 Commonwealth of Australia 2008. Reproduction is authorised provided that the More information National Information Assurance Partnership
National Information Assurance Partnership TM Common Criteria Evaluation and Validation Scheme Validation Report IBM UK Ltd IBM WebSphere Business Integration Message Broker Version 5.0, Fix Pack 4 Report More information National Information Assurance Partnership. Common Criteria Evaluation and Validation Scheme. Validation Report
National Information Assurance Partnership Common Criteria Evaluation and Validation Scheme TM Validation Report Secure Computing IronMail Email Security Gateway v6.7 HF2 Report Number: CCEVS-VR-VID10211-2008 More information How do you ensure evaluators are competent?
How do you ensure evaluators are competent? [ICCC 2010 Paper Submission] Zarina Musa Evaluator CyberSecurity Malaysia MySEF, Kuala Lumpur, Malaysia Abstract Ensuring the evaluators in a security evaluation More information TIBCO ActiveMatrix BusinessWorks TM. Release 5.8
National Information Assurance Partnership TM Common Criteria Evaluation and Validation Scheme Validation Report TIBCO ActiveMatrix BusinessWorks TM Release 5.8 Report Number: CCEVS-VR-VID10230-2010 Dated: More information Certification Report
Certification Report EAL 4 Evaluation of Desktop: Enterprise Whole Disk Encryption Only Edition, Version 9.10.0 Issued by: Communications Security Establishment Certification Body Canadian Common Criteria More information CERTIFICATION REPORT No. CRP271
122 CERTIFICATION REPORT No. CRP271 Citrix XenDesktop Version 5.6 Platinum Edition Running on Server Components: Microsoft Windows Server 2008 R2 SP1, Enterprise Edition, 64-bit and User Devices and VMs: More information CERTIFICATION REPORT No. CRP253
National Information Assurance Partnership TM Common Criteria Evaluation and Validation Scheme Validation Report Safend Protector Version 3.0 Report Number: CCEVS-VR-10177-2008 Dated: August 13, 2008 Version: More information National Information Assurance Partnership
National Information Assurance Partnership TM Common Criteria Evaluation and Validation Scheme Validation Report NetIQ Security Manager Version 5.5 Report Number: CCEVS-VR-07-0058 Dated: 9 August 2007 More information National Information Assurance Partnership
National Information Assurance Partnership TM Common Criteria Evaluation and Validation Scheme Validation Report Retina Enterprise Suite Report Number: CCEVS-VR-07-0043 Dated: Version: 1.0 National Institute More information Certification Report. NXP Secure Smart Card Controller P40C012/040/072 VD
TÜV Rheinland Nederland B.V. Version 20101101 Certification Report NXP Secure Smart Card Controller P40C012/040/072 VD Sponsor and developer: NXP Semiconductors Germany GmbH, Business Unit Identification More information National Information Assurance Partnership
National Information Assurance Partnership TM Common Criteria Evaluation and Validation Scheme Validation Report The Boeing Company, P.O. Box 3999, M/S 88-12, Seattle, WA 98124-2499 Boeing Secure Server More information Joint Interpretation Library
for smart cards and similar devices Document purpose: provide requirements to developers and guidance to evaluators to fulfill the Security Architecture requirements of CC V3 ADV_ARC family. Version 2.0 More information 1E POWER AND PATCH MANAGEMENT PACK INCLUDING WAKEUP AND NIGHTWATCHMAN Version 5.6 running on multiple platforms
122-B CERTIFICATION REPORT No. CRP252 1E POWER AND PATCH MANAGEMENT PACK INCLUDING WAKEUP AND NIGHTWATCHMAN Version 5.6 running on multiple platforms Issue 1.0 December 2009 Crown Copyright 2009 All Rights More information Collaborative efforts in Malaysia: Producing Protection Profile for Internet Banking Application
Collaborative efforts in Malaysia: Producing Protection Profile for Internet Banking Application Ahmad Dahari Bin Jarno Senior Analyst & MySEF Evaluator CyberSecurity Malaysia-MySEF (Malaysia) Co. Author: More information Citrix NetScaler Platinum Edition Load Balancer
122-B CERTIFICATION REPORT No. CRP262 Citrix NetScaler Platinum Edition Load Balancer Version 9.2 running on platforms MPX 5500, MPX 9700-FIPS, MPX 10500-FIPS, MPX 12500-FIPS, MPX 15500-FIPS, MPX 7500, More information Common Criteria for Information Technology Security Evaluation. Part 1: Introduction and general model. August 1999. Version 2.
Common Criteria for Information Technology Security Evaluation Part 1: Introduction and general model August 1999 Version 2.1 CCIMB-99-031 Part 1: Introduction and general model Foreword This version of More information Security Standards. 17.1 BS7799 and ISO17799
17 Security Standards Over the past 10 years security standards have come a long way from the original Rainbow Book series that was created by the US Department of Defense and used to define an information More information Supporting Document Guidance. Security Architecture requirements (ADV_ARC) for smart cards and similar devices. April 2012. Version 2.
Supporting Document Guidance Security Architecture requirements (ADV_ARC) for smart cards and similar devices April 2012 Version 2.0 CCDB-2012-04-003 Foreword This is a supporting document, intended to More information Certification Report StoneGate FW/VPN 5.2.5
Ärendetyp: 6 Diarienummer: 11FMV3127-87:1 Dokument ID HEMLIG/ enligt Offentlighets- och sekretesslagen (2009:400) 2012-01-23 Country of origin: Sweden Försvarets materielverk Swedish Certification Body More information CA Performance Center
CA Performance Center Single Sign-On User Guide 2.4 This Documentation, which includes embedded help systems and electronically distributed materials, (hereinafter referred to as the Documentation ) is More information THE IMPORTANCE OF CODE SIGNING TECHNICAL NOTE 02/2005
THE IMPORTANCE OF CODE SIGNING TECHNICAL NOTE 02/2005 13 DECEMBER 2005 This paper was previously published by the National Infrastructure Security Co-ordination Centre (NISCC) a predecessor organisation More information CRC Data at Rest (DaR) Service (Native) Version 1.0.0 (Version Code 2)
National Information Assurance Partnership Common Criteria Evaluation and Validation Scheme Validation Report CyberReliant Corp. 175 Admiral Cochrane Drive, Suite 404 Annapolis, MD 21401 CRC Data at Rest More information Cryptographic Modules, Security Level Enhanced. Endorsed by the Bundesamt für Sicherheit in der Informationstechnik
Common Criteria Protection Profile Cryptographic Modules, Security Level Enhanced BSI-CC-PP-0045 Endorsed by the Foreword This Protection Profile - Cryptographic Modules, Security Level Enhanced - is issued More information BlackBerry 10.3 Work and Personal Corporate
GOV.UK Guidance BlackBerry 10.3 Work and Personal Corporate Published Contents 1. Usage scenario 2. Summary of platform security 3. How the platform can best satisfy the security recommendations 4. Network More information FINAL DoIT 04.01.2013- v.8 APPLICATION SECURITY PROCEDURE
Purpose: This procedure identifies what is required to ensure the development of a secure application. Procedure: The five basic areas covered by this document include: Standards for Privacy and Security More information Using EMC Unisphere in a Web Browsing Environment: Browser and Security Settings to Improve the Experience
Using EMC Unisphere in a Web Browsing Environment: Browser and Security Settings to Improve the Experience Applied Technology Abstract The Web-based approach to system management taken by EMC Unisphere More information ADP Workforce Now Security Guide. Version 2.0-1
ADP Workforce Now Security Guide Version 2.0-1 ADP Trademarks The ADP logo, ADP, and ADP Workforce Now are registered trademarks of ADP, Inc. Third-Party Trademarks Microsoft, Windows, and Windows NT are More information Common Criteria. Introduction 2014-02-24. Magnus Ahlbin. Emilie Barse 2014-02-25. Emilie Barse Magnus Ahlbin
Common Criteria Introduction 2014-02-24 Emilie Barse Magnus Ahlbin 1 Magnus Ahlbin Head of EC/ITSEF Information and Security Combitech AB SE-351 80 Växjö Sweden magnus.ahlbin@combitech.se www.combitech.se More information National Information Assurance Partnership. Common Criteria Evaluation and Validation Scheme Validation Report
National Information Assurance Partnership Common Criteria Evaluation and Validation Scheme Validation Report TM HP Network Node Management Advanced Edition Software V7.51 with patch PHSS_35278 Report More information JMCS Northern Light Video Conferencing System Security Target
JMCS Northern Light Video Conferencing System Security Target Common Criteria: EAL2 Version 1.2 22 FEB 12 Document management Document identification Document ID Document title Product version NLVC_ST_EAL2 More information Citrix XenServer 6.0.2 Platinum Edition
CERTIFICATION REPORT No. CRP270 Citrix XenServer 6.0.2 Platinum Edition Issue 1.0 September 2012 Crown Copyright 2012 All Rights Reserved Reproduction is authorised, provided that this report is copied More information Kenna Platform Security. A technical overview of the comprehensive security measures Kenna uses to protect your data
Kenna Platform Security A technical overview of the comprehensive security measures Kenna uses to protect your data V2.0, JULY 2015 Multiple Layers of Protection Overview Password Salted-Hash Thank you More information IEEE 2600-series Standards for Hardcopy Device Security
IEEE 2600-series Standards for Hardcopy Device Security Brian Smithson PM, Security Research Ricoh Americas Corporation Lead Editor IEEE P2600 Standards Working Group 17 November, 2010 Ottawa, ON Agenda More information Thick Client Application Security
Thick Client Application Security Arindam Mandal (arindam.mandal@paladion.net) (http://www.paladion.net) January 2005 This paper discusses the critical vulnerabilities and corresponding risks in a two More information DCH File Transfer Application User Manual
DCH File Transfer Application User Manual Table of Contents HIPAA Compliancy Statement 3 Overview 4 General.4 Getting Started 4 Screen Basics...4 Accessing the File Transfer application...5 Single Sign More information National Information Assurance Partnership. Common Criteria Evaluation and Validation Scheme Validation Report
National Information Assurance Partnership TM Common Criteria Evaluation and Validation Scheme Validation Report Cisco Intrusion Detection System Sensor Appliance IDS-4200 series Version 4.1(3) Report More information Common Criteria v3.1 Vulnerability Assessment: What is new?
Common Criteria v3.1 Vulnerability Assessment: What is new? T-Systems GEI GmbH 25th-27th September, 2007, page 1. Road Map CC Part 3, Class AVA CEM, Class AVA CEM, Annex B 25th-27th September, 2007, page More information SECURITY DOCUMENT. BetterTranslationTechnology
SECURITY DOCUMENT BetterTranslationTechnology XTM Security Document Documentation for XTM Version 6.2 Published by XTM International Ltd. Copyright XTM International Ltd. All rights reserved. No part of More information FileCloud Security FAQ
is currently used by many large organizations including banks, health care organizations, educational institutions and government agencies. Thousands of organizations rely on File- Cloud for their file More information Cyber Essentials Questionnaire
Cyber Essentials Questionnaire Introduction The Cyber Essentials scheme is recommended for organisations looking for a base level Cyber security test where IT is a business enabler rather than a core deliverable. More information USB Portable Storage Device: Security Problem Definition Summary
USB Portable Storage Device: Security Problem Definition Summary Introduction The USB Portable Storage Device (hereafter referred to as the device or the TOE ) is a portable storage device that provides More information Common Criteria Security Target
Common Criteria Security Target for Citrix XenDesktop 5.6 Platinum edition Version 1-1 16 November 2012 2012 Citrix Systems, Inc. All rights reserved Summary of Amendments Version Date Notes 1-1 16 November More information CA Unified Infrastructure Management Server
CA Unified Infrastructure Management Server CA UIM Server Configuration Guide 8.0 Document Revision History Version Date Changes 8.0 September 2014 Rebranded for UIM 8.0. 7.6 June 2014 No revisions for More information Protection Profile for UK Dual-Interface Authentication Card
Protection Profile for UK Dual-Interface Authentication Card Version 1-0 10 th July 2009 Reference: UNKT-DO-0002 Introduction This document defines a Protection Profile to express security, evaluation More information MobileIron Platform Version 9.0
National Information Assurance Partnership Common Criteria Evaluation and Validation Scheme Validation Report MobileIron 415 East Middlefield Road Mountain View, CA 94043 MobileIron Platform Version 9.0 More information MINISTERIO DE DEFENSA CENTRO NACIONAL DE INTELIGENCIA CENTRO CRIPTOLÓGICO NACIONAL ORGANISMO DE CERTIFICACIÓN
REF: 2010-22-INF-764 V1 Distribution: Expediente Date: 21.11.2011 Created: CERT3 Reviewed: CALIDAD Approbed: TECNICO CERTIFICATION REPORT FOR FOR HUAWEI INTEGRATED MANAGEMENT APPLICATION PLATFORM VERSION More information Policy Based Encryption Z. Administrator Guide
Policy Based Encryption Z Administrator Guide Policy Based Encryption Z Administrator Guide Documentation version: 1.2 Legal Notice Legal Notice Copyright 2012 Symantec Corporation. All rights reserved. More information New Systems and Services Security Guidance
New Systems and Services Security Guidance Version Version Number Date Author Type of modification / Notes 0.1 29/05/2012 Donna Waymouth First draft 0.2 21/06/2012 Donna Waymouth Update re certificates More information 2017 © DocPlayer.net Privacy Policy | Terms of Service | Feedback