Browse > Article
http://dx.doi.org/10.13089/JKIISC.2014.24.5.969

Refining software vulnerbility Analysis under ISO/IEC 15408 and 18045  

Im, Jae-Woo (HYUNDAI AutoEver)
Publication Information
Journal of the Korea Institute of Information Security & Cryptology / v.24, no.5, 2014 , pp. 969-974 More about this Journal
Abstract
CC (Common Criteria) requires collecting vulnerability information and analyzing them by using penetration testing for evaluating IT security products. Under the time limited circumstance, developers cannot help but apply vulnerability analysis at random to the products. Without the systematic vulnerability analysis, it is inevitable to get the diverse vulnerability analysis results depending on competence in vulnerability analysis of developers. It causes that the security quality of the products are different despite of the same level of security assurance. It is even worse for the other IT products that are not obliged to get the CC evaluation to be applied the vulnerability analysis. This study describes not only how to apply vulnerability taxonomy to IT security vulnerability but also how to manage security quality of IT security products practically.
Keywords
Common Criteria; Security Vulnerability; Security Quality; Penetration Test;
Citations & Related Records
연도 인용수 순위
  • Reference
1 "Information technology -- Security techniques -- Evaluation criteria for IT security Part 1,2,3," ISO/IEC 15408-1/2/3, 2009.
2 "Information technology -- Security techniques -- Methodology for IT security evaluation," ISO/IEC 18045, 2005.
3 CWE, "https://cwe.mitre.org"
4 CVE, "http://cve.mitre.org"
5 CAPEC, "http://capec.mitre.org"
6 Thomas R. Rhodes, Frederick E. Boland Jr, Elizabeth N. Fong, and Michael J. Kass, "Software assurance using structured assurance case models," 7608, NIST Interagency/Internal Report (NISTIR), May 2009.
7 Ki-Seok Bang, Il-Gon Kim, Ji-Yeon Lee, Jun-Seok Lee, and Jin-Young Choi "Classification criteria and application methodology for evaluating IT security products," Jonornal of Korea Knowledge Information Technology Society, 6(5), pp. 105-112, Nov. 2011.