ISO/IEC 18045:2008 - IT安全评估方法论

版权申诉

5星 · 超过95%的资源 34 浏览量更新于2024-07-18 收藏 2.16MB PDF 举报

"ISO IEC 18045:2008 是一份关于信息安全技术评价方法的国际标准，提供了IT安全评估的详细流程和指南。这份文档由ISO（国际标准化组织）和IEC（国际电工委员会）联合发布，旨在帮助组织和机构对信息技术的安全性进行有效评估。标准的第二版于2008年8月15日发布，并在2014年1月15日进行了修正。" ISO/IEC 18045标准涵盖以下几个核心知识点： 1. **范围**：标准明确了适用于所有类型的IT安全产品的安全性评估，包括软件、硬件、系统和服务，旨在确保它们满足预定的安全需求。 2. **规范性参考**：这部分列出与标准实施相关的其他标准和规范，确保评价过程遵循业界最佳实践。 3. **术语和定义**：定义了与信息安全评估相关的专业词汇，以确保在整个评估过程中有共同的理解。 4. **符号和缩略词**：规定了标准中使用的特定符号和缩写，便于读者理解。 5. **概述**：简述了标准的结构，包括组织方式、文档约定等，为用户提供了阅读和应用标准的基础。 6. **文档约定**：详细说明了术语的使用规则、用语习惯以及一般评估指导，还解释了ISO/IEC 15408（即通用安全框架，通常称为CC，Common Criteria）与ISO/IEC 18045结构之间的关系。 7. **评估过程和相关任务**：这是标准的核心部分，描述了评估的完整流程，包括输入任务、执行任务、输出任务等。其中： - **7.2.1 目标**：明确评估的目标，如验证产品是否符合安全要求。 - **7.2.2 角色的责任**：定义了评估者、申请者和其他相关方的职责。 - **7.2.3 角色的关系**：阐述了不同角色在评估过程中的相互作用。 - **7.2.4 一般评估模型**：提供了一个通用的模型来描述评估过程。 - **7.2.5 评估者的裁决**：说明了评估者如何基于证据做出决定。 - **7.3 输入任务**：涉及评估开始前需要准备的资料和信息。 8. **评估输入任务**：这是评估的起始步骤，包括确定安全需求、收集产品信息以及准备评估计划等，确保评估活动的充分准备。 ISO/IEC 18045标准对于组织进行安全评估至关重要，它不仅提供了详细的评估流程，还促进了不同国家和地区之间评估结果的互认，从而降低了市场的进入壁垒。通过遵循此标准，企业可以确保其IT产品和服务达到国际认可的安全水平，同时增强了客户对其安全性的信心。

ISO/IEC 18045:2008(E)

7.3 Evaluation input task

7.3.1 Objectives

The objective of this task is to ensure that the evaluator has available the correct version of the evaluation

evidence necessary for the evaluation and that it is adequately protected. Otherwise, the technical accuracy of

the evaluation cannot be assured, nor can it be assured that the evaluation is being conducted in a way to

provide repeatable and reproducible results.

7.3.2 Application notes

The responsibility to provide all the required evaluation evidence lies with the sponsor. However, most of the

evaluation evidence is likely to be produced and supplied by the developer, on behalf of the sponsor.

Since the assurance requirements apply to the entire TOE, all evaluation evidence pertaining to all parts of the

TOE is to be made available to the evaluator. The scope and required content of such evaluation evidence is

independent of the level of control that the developer has over each of the parts of the TOE. For example, if

design is required, then the TOE design (ADV_TDS) requirements will apply to all subsystems that are part of

the TSF. In addition, assurance requirements that call for procedures to be in place (for example, CM

capabilities (ALC_CMC) and Delivery (ALC_DEL)) will also apply to the entire TOE (including any part

produced by another developer).

It is recommended that the evaluator, in conjunction with the sponsor, produce an index to required evaluation

evidence. This index may be a set of references to the documentation. This index should contain enough

information (e.g. a brief summary of each document, or at least an explicit title, indication of the subclauses of

interest) to help the evaluator to find easily the required evidence.

It is the information contained in the evaluation evidence that is required, not any particular document

structure. Evaluation evidence for a sub-activity may be provided by separate documents, or a single

document may satisfy several of the input requirements of a sub-activity.

The evaluator requires stable and formally-issued versions of evaluation evidence. However, draft evaluation

evidence may be provided during an evaluation, for example, to help an evaluator make an early, informal

assessment, but is not used as the basis for verdicts. It may be helpful for the evaluator to see draft versions

of particular appropriate evaluation evidence, such as:

a) test documentation, to allow the evaluator to make an early assessment of tests and test procedures;

b) design documents, to provide the evaluator with background for understanding the TOE design;

c) source code or hardware drawings, to allow the evaluator to assess the application of the developer's

standards.

Draft evaluation evidence is more likely to be encountered where the evaluation of a TOE is performed

concurrently with its development. However, it may also be encountered during the evaluation of an already-

developed TOE where the developer has had to perform additional work to address a problem identified by

the evaluator (e.g. to correct an error in design or implementation) or to provide evaluation evidence of

security that is not provided in the existing documentation (e.g. in the case of a TOE not originally developed

to meet the requirements of ISO/IEC 15408).

7.3.3 Management of evaluation evidence sub-task

7.3.3.1 Configuration control

The evaluator shall perform configuration control of the evaluation evidence.

ISO/IEC 15408 implies that the evaluator is able to identify and locate each item of evaluation evidence after it

has been received and is able to determine whether a specific version of a document is in the evaluator's

possession.

poorest

ISO/IEC 18045:2008(E)

The evaluator shall protect the evaluation evidence from alteration or loss while it is in the evaluator's

possession.

7.3.3.2 Disposal

Schemes may wish to control the disposal of evaluation evidence at the conclusion of an evaluation. The

disposal of the evaluation evidence should be achieved by one or more of:

a) returning the evaluation evidence;

b) archiving the evaluation evidence;

c) destroying the evaluation evidence.

7.3.3.3 Confidentiality

An evaluator may have access to sponsor and developer commercially-sensitive information (e.g. TOE design

information, specialist tools), and may have access to nationally-sensitive information during the course of an

evaluation. Schemes may wish to impose requirements for the evaluator to maintain the confidentiality of the

evaluation evidence. The sponsor and evaluator may mutually agree to additional requirements as long as

these are consistent with the scheme.

Confidentiality requirements affect many aspects of evaluation work, including the receipt, handling, storage

and disposal of evaluation evidence.

7.4 Evaluation sub-activities

The evaluation sub-activities vary depending whether it is a PP or a TOE evaluation. Moreover, in the case of

a TOE evaluation, the sub-activities depend upon the selected assurance requirements.

7.5 Evaluation output task

7.5.1 Objectives

The objective of this Subclause is to describe the Observation Report (OR) and the Evaluation Technical

Report (ETR). Schemes may require additional evaluator reports such as reports on individual units of work,

or may require additional information to be contained in the OR and the ETR. This International Standard does

not preclude the addition of information into these reports as this International Standard specifies only the

minimum information content.

Consistent reporting of evaluation results facilitates the achievement of the universal principle of repeatability

and reproducibility of results. The consistency covers the type and the amount of information reported in the

ETR and OR. ETR and OR consistency among different evaluations is the responsibility of the evaluation

authority.

The evaluator performs the two following sub-tasks in order to achieve this International Standard

requirements for the information content of reports:

a) write OR sub-task (if needed in the context of the evaluation);

b) write ETR sub-task.

7.5.2 Management of evaluation outputs

The evaluator delivers the ETR to the evaluation authority, as well as any ORs as they become available.

Requirements for controls on handling the ETR and ORs are established by the scheme which may include

delivery to the sponsor or developer. The ETR and ORs may include sensitive or proprietary information and

may need to be sanitised before they are given to the sponsor.

poorest

ISO/IEC 18045:2008(E)

7.5.3 Application notes

In this version of this International Standard, the requirements for the provision of evaluator evidence to

support re-evaluation and re-use have not been explicitly stated. Where information for re-evaluation or re-use

is required by the sponsor, the scheme under which the evaluation is being performed should be consulted.

7.5.4 Write OR sub-task

ORs provide the evaluator with a mechanism to request a clarification (e.g. from the evaluation authority on

the application of a requirement) or to identify a problem with an aspect of the evaluation.

In the case of a fail verdict, the evaluator shall provide an OR to reflect the evaluation result. Otherwise, the

evaluator may use ORs as one way of expressing clarification needs.

For each OR, the evaluator shall report the following:

a) the identifier of the PP or TOE evaluated;

b) the evaluation task/sub-activity during which the observation was generated;

c) the observation;

d) the assessment of its severity (e.g. implies a fail verdict, holds up progress on the evaluation, requires a

resolution prior to evaluation being completed);

e) the identification of the organisation responsible for resolving the issue;

f) the recommended timetable for resolution;

g) the assessment of the impact on the evaluation of failure to resolve the observation.

The intended audience of an OR and procedures for handling the report depend on the nature of the report's

content and on the scheme. Schemes may distinguish different types of ORs or define additional types, with

associated differences in required information and distribution (e.g. evaluation ORs to evaluation authorities

and sponsors).

7.5.5 Write ETR sub-task

7.5.5.1 Objectives

The evaluator shall provide an ETR to present technical justification of the verdicts.

This International Standard defines the ETR's minimum content requirement; however, schemes may specify

additional content and specific presentational and structural requirements. For instance, schemes may require

that certain introductory material (e.g. disclaimers and copyright Clauses) be reported in the ETR.

The reader of the ETR is assumed to be familiar with general concepts of information security, ISO/IEC

15408, this International Standard, evaluation approaches and IT.

The ETR supports the evaluation authority to confirm that the evaluation was done to the required standard,

but it is anticipated that the documented results may not provide all of the necessary information, so additional

information specifically requested by the scheme may be necessary. This aspect is outside the scope of this

International Standard.

poorest

ISO/IEC 18045:2008(E)

The evaluator shall report the identity of the sponsor.

The identity of the sponsor is required to identify the party responsible for providing evaluation evidence to the

evaluator.

The evaluator shall report the identity of the evaluator.

The identity of the evaluator is required to identify the party performing the evaluation and responsible for the

evaluation verdicts.

7.5.5.2.2 Evaluation

The evaluator shall report the evaluation methods, techniques, tools and standards used.

The evaluator references the evaluation criteria, methodology and interpretations used to evaluate the PP.

The evaluator shall report any constraints on the evaluation, constraints on the handling of evaluation results

and assumptions made during the evaluation that have an impact on the evaluation results.

The evaluator may include information in relation to legal or statutory aspects, organisation, confidentiality,

etc.

7.5.5.2.3 Results of the evaluation

The evaluator shall report a verdict and a supporting rationale for each assurance component that constitutes

an APE activity, as a result of performing the corresponding evaluation methodology action and its constituent

work units.

The rationale justifies the verdict using ISO/IEC 15408, this International Standard, any interpretations and the

evaluation evidence examined and shows how the evaluation evidence does or does not meet each aspect of

the criteria. It contains a description of the work performed, the method used, and any derivation of results.

The rationale may provide detail to the level of a evaluation methodology work unit.

7.5.5.2.4 Conclusions and recommendations

The evaluator shall report the conclusions of the evaluation, in particular the overall verdict as defined in

ISO/IEC 15408-1 Clause 9, Evaluation results, and determined by application of the verdict assignment

described in 7.2.5.

The evaluator provides recommendations that may be useful for the evaluation authority. These

recommendations may include shortcomings of the PP discovered during the evaluation or mention of

features which are particularly useful.

7.5.5.2.5 List of evaluation evidence

The evaluator shall report for each item of evaluation evidence the following information:

• the issuing body (e.g. the developer, the sponsor);

• the title;

• the unique reference (e.g. issue date and version number).

7.5.5.2.6 List of acronyms/Glossary of terms

The evaluator shall report any acronyms or abbreviations used in the ETR.

Glossary definitions already defined by ISO/IEC 15408 or by this International Standard need not be repeated

in the ETR.

poorest

剩余298页未读，继续阅读

alarmano

粉丝: 27
资源: 1万+

ISO/IEC 18045:2008 - IT安全评估方法论

ISO ISO IEC 27005 2018.pdf

ISO IEC 38505-1-2017中文 第 1 部分： ISO IEC38500 对数据管理的应用.pdf

ISO IEC17025 1999 与ISO IEC指南25 1990.zip

ISO IEC TR 27023：2015 Information technology — Security techniques — Mapping the revised editions of ISO IEC 27001 and ISO IEC 27002 - 完整英文版（24页）.pdf

资料-ISO IEC17025 1999 与ISO IEC指南25 1990.zip

资料-ISO IEC17025 1999 与ISO IEC指南25 1990.pdf

ISO-IEC-9899-2018-4.pdf.zip_ISO IEC 9899 2018_ISO/IEC 2018_ISO98

ISO IEC TR 20000-7：2019 Information technology — Service management — Part 7：Guidance on the integration and correlation of ISO IEC 20000-1：2018 to ISO 9001：2015 and ISO IEC 27001：2013 -完整英文版（62页）.pdf

ISO IEC 27031

ISO IEC 23531

最新资源

ISO IEC 38505-1-2017中文第 1 部分： ISO IEC38500 对数据管理的应用.pdf