• Proceedings of the Korea Information Processing Society Conference
• /
• 2015.10a
• /
• pp.832-834
• /
• 2015

최근 CCRA(Common Criteria Recognition Arrangement) 협정서 개정에 따라 공통평가기준인 CC(Common Criteria) 평가제도에 변화가 생기고 있다. 현재의 CC 평가제도가 가지는 한계를 보완하고자 PP(protection profile)를 대신하는 cPP(collaborative protection profile)가 개발되었는데, 기존의 폐쇄적으로 운영되던 PP 개발 프로세스와 달리 cPP 개발에는 CCRA 회원국의 여러 기관 및 기업이 적극적으로 개발에 참여할 수 있다. 따라서 현재 세계 각국에서 cPP 개발에 관한 논의가 활발히 진행되고 있으며 세분화된 연구도 요구되고 있다. 본 논문에서는 기존의 CC 평가제도가 가지는 한계를 살펴보고 이러한 한계를 극복하기 위한 cPP의 등장 및 개정되는 새로운 CC 평가제도의 운영을 분석한다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.24 no.1
• /
• pp.171-182
• /
• 2014

Common Criteria is a scheme that minimize IT products's vulnerabilities in accordance with the evaluation assurance level. SSDLC(Secure Software Development Lifecycle) is a methodology that reduce the weakness that can be used to generate vulnerabilities of software development life cycle. However, Common Criteria does not consider certificated IT products's vulnerabilities after certificated it. So, it can make a problem the safety and reliability of IT products. In addition, the developer and the evaluator have the burden of duplicating evaluations of IT products that introduce into the government business due to satisfy both Common Criteria and SSDLC. Thus, we researched the relationship among the Common Criteria, the static code analysis tools, and the SSDLC. And then, we proposed how to combine SSDLC into Common Criteria.

• The Journal of Society for e-Business Studies
• /
• v.10 no.3
• /
• pp.67-83
• /
• 2005

Common Criteria(CC) was announced in June, 1999 in order to solve a problem which be happened by applying a different evaluation criteria among nations. Currently, a official version is v2.2 and v3.0 is a draft version. Because an evaluation demand is increased in the inside and outside of the country, an evaluation market growth is expected. Also, It needs methodology and work automation and project management for evaluation. In this paper, we propose A CC based Security Evaluation Management System(CC-SEMS) that is managing evaluation resources(deliverables , evaluation criteria, evaluators) and is useful in evaluation environment efficiently. CC-SEMS is to have integrated project management, workflow management, process management and is composed of deliverables, Evaluation Activity Program(EAP), Management Object(MO), Evaluation Database(EDB), Evaluation Workflow Engine(EWE).

• Journal of Digital Contents Society
• /
• v.5 no.2
• /
• pp.95-100
• /
• 2004

For improve level of information security, the necessity of evaluation and certification of Information Security System(ISS) in increasing. Evalustion and Certification Institute have evaluated ISS for risk prevention of information dysfunction in an advanced countries. But, the problem of the time and cost occurred when it is caused by with application of unlike evaluation criteria each other. The result of effort to solution, Common Criteria(CC) and Common Evaluation Methodology(CEM) is using for evaluation of ISS and mutual recognition. Evaluation participant is needed flexible and active interpretation of CC and CEM for an efficient evaluation preparation and performance.

• The Journal of Society for e-Business Studies
• /
• v.17 no.4
• /
• pp.57-68
• /
• 2012

As the functions and technology of IT security solution has been diversified and complicated, it is necessary to make the functions standardized. The common criteria (CC) evaluation and certification scheme was introduced with this background in 2000. For over 10 years after the introduction of CC evaluation and certification scheme, many security solution vendors have developed functions following the security functional requirement in CC. Most of CC evaluators and developers think that CC has helped to enhance the security of the solution. So, it is a right time to prove the affirmative effects of CC in quantity. In this research, we compare two cases, the security status of the solution before and after the experience of CC evaluation, and analyze the results. We made the questionnaire for the domestic solutions vendors. We show that CC has made positive effects on the security of the solution quantitatively using statistical analysis. This research is meaningful security enhancement of domestic security solutions.

• Review of KIISC
• /
• v.13 no.5
• /
• pp.1-15
• /
• 2003

IT(Information Technology) 제품의 보안 기능을 평가하기 위한 서로 다른 체계를 이용함으로써 평가를 위한 이중의 비용 소요와 추가의 시간 소모 등의 문제점을 해결하기 위하여, 미국, 영국 등의 선진국들은 국제간에 상호 인정이 가능한 공통평가기준(CC : Common Criteria)에 대한 연구를 활발히 수행하고 있고, CCRA(Common Criteria Recognition Agreement)에 가입한 나라에서 평가된 제품은 다른 나라에서 재평가 과정을 거치지 않고 상호 인정하는 CCRA 라는 평가를 위한 국제 조약을 체결하여 시행 중에 있다. 그러나 CC는 다양한 보안 제품에 대하여 시행되고 있고, 표준안의 분량이 매우 많을 뿐만 아니라 복잡하며, 개발자와 평가자, 그리고 이용자 모두가 평가를 위한 기술적, 관리적, 절차적 과정의 이해가 무엇보다도 중요하다. 따라서 CC 주요 주체에 대한 평가 교육의 필요성이 매우 중요하게 대두되고 있다. 또한 우리 나라도 국제공통평가기준 인정 협정인 CCRA로의 가입을 준비중에 있고, 다양한 제품으로 평가제도의 확대를 준비하고 있다. 본 논문에서는 각 나라의 CC 교육 과정을 분석하고, 현재 CC 체제하에서 평가된 정보보호 제품들의 특성을 분석하며, 이를 바탕으로 우리의 평가 교육 현실을 살펴본 후, 국내 CC 교육 프레임워크와 실천 방안을 제시한다.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.14 no.5
• /
• pp.79-95
• /
• 2004

The Common Criteria can be used as a guideline for one CCRA member to avoid re-evaluating IT security products which were already evaluated by other CCRA members. In this paper, we have analyzed the evaluated IT security products under CC scheme in several nations, such as Unite States, Great Britain and Australia. and defined new category of the IT security products for the domestic CC evaluation. And we have analyzed the domestic and international market on the information security products, have conducted a poll to receive opinions and demands of the Korean industries for Korea policy decision maker to select the possible IT security products which will be evaluated in Korea under CC scheme. As a conclusion, we have selected 15 IT products based on the response to a poll by the industries, the market size, the evaluation amount demanded by the user, manufacturer, and evaluator, to select the possible IT security product under CC schemes in Korea during next 5 years. Moreover, the characteristics, the benefit, and the demerit of the selected IT products were analyzed. This paper can be used as a guideline document for Korea policy decision maker to select the IT products to be evaluated under CC scheme in Korea for next 5 years.

• Convergence Security Journal
• /
• v.5 no.4
• /
• pp.7-18
• /
• 2005

Recently, ISO/IEC SC27 WG3 is actively working on the revision of CC V3.0 to be an international standard by 2008, principally supported by Common Criteria Development Board (CCDB). Hence, it is essential for Korea to review and analyze the changes in CC V3.0, so as to be completely prepared for any change to be occurred from CC V2.* to V3.0. Taking into account of CC V3.0 being revised currently, this paper gives a general overview of revision in CC V3.0 : then, closely examines and explains the improvements and changes made by the revision in CC V3.0

• Convergence Security Journal
• /
• v.8 no.2
• /
• pp.7-13
• /
• 2008

In domestic and international, evaluation of product with Common Criteria(CC) for security product estimation is expanding standard of product estimation. This expansion is due to multi aspects of product versions. However, it is very difficult to approach the most suitable form of security estimation guide in the developer's perspective, because estimation basis presented to developers is indefinite. With this pending dilemma, we are presenting a composition product introduce definite security standard for information security products.

• 한국IT서비스학회:학술대회논문집
• /
• 2003.11a
• /
• pp.467-478
• /
• 2003

국제공통평가기준(Common Criteria)2.1을 기반으로 한 국제공통평가인정협정(Common Criteria Recognition Arrangement)은 21세기 정보보호 산업 전반에 수출입 장벽 및 국제적 표준으로 자리매김 할 것이다. 이미 국제공통평가상호인정협정(CC-MRA)에서부터 적극적으로 기술을 축적하고 세계적 표준을 선도한 미국, 캐나다, 영국, 독일, 프랑스 등의 주요 선진국들은 국제공통평가인정협정 인증서발행국(CCRA-CAP)으로서의 우월적 지위를 확보한 상태이다. 이에 본 연구는 CCRA-CAP국가들에 대한 스킴(Skim) 분석을 통하여 우리나라 의 스킴 개발이 국제적인 선도국과 비교하여 어떤 차이를 보이는지와 우리나라의 문제점을 도출해보고자 한다. 이를 통하여 향후, CCRA-CAP국가로 세계적 평가, 인증체계의 선도국이 되기 위한 준비과정에서 얻을 수 있는 통찰력과 시사점을 제공하고자 한다. 본 연구에서는 여러 스킴 중 정보보호시스템 평가, 인증 제도 관련 기관 책임 및 임무에 관한 1번 스킴을 주요 논의의 대상으로 하여 분석 연구한다.