The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [common-criteria]

The Common Criteria for Information Technology Security Evaluation (CC for short)

Filter by
Sorted by
Tagged with
1
vote
2answers
52 views

Where do Common Criteria threats, policies, assumptions and objectives come from?

When reading something dealing with Common Criteria for Information Technology Security Evaluation it is clear where ABC_DEF-type acronyms come from - they are thoroughly described in parts 2 and 3. ...
0
votes
1answer
43 views

Guidelines to make Windows Server 2008 Common Criteria Installation

I'm new to certification arguments. I have an issue with a requirement that is to make an application in a certified Windows 2008 environment. What are / where can I find a guide to WS2008 CC-...
0
votes
1answer
50 views

why Common Criteria evaluation wont give 100% security [closed]

To understand Common Criteria in better way, could someone tell if system has passed a CC evaluation ie. EAL4, what can we say about the security of this system?
1
vote
1answer
247 views

WinHTTP and python requests package, fail to validate certificate containing valid CN but invalid SAN

We're using WinHTTP to send API calls from our client. Now according to Common Criteria, FCS_TLSC_EXT.1.2 assurance activity Test 2, if certificate contains a valid CN (common name) but invalid SAN(...
3
votes
2answers
234 views

SP 800-56B compliance in OpenSSL

We are working to make a product Common Criteria Compliance for one of our customers. The Client part of the product uses OpenSSL for TLS communication, which implies that we need to fulfill the ...
0
votes
1answer
103 views

How to run FCS_TLSS tests of for common criteria evaluation? [closed]

So we are working on making a product of one of our clients common criteria compliant. We are using tls-cc-tools for running FCS_TLSC tests but we are unable to run FCS_TLSS_EXT.1.1 test 5. Please ...
2
votes
1answer
400 views

WinHTTP - Prevent successful handshake if peer certificate is invalid

I am using WinHTTP on a Delphi project to make calls over to the server. Script: userAgent := 'TestClient.exe'; hsession := WinHttpOpen(pwidechar(userAgent), WINHTTP_ACCESS_TYPE_DEFAULT_PROXY, nil,...
1
vote
1answer
142 views

Which Protection Profiles required for EAL 1 test?

I have some question about PPs for EAL1 test. 1- Which PPs required for a Router Devices in EAL 1 test?We only need compliance with 'collaborative Protection Profile for Network Devices' (aka NDcPP) ...
1
vote
0answers
46 views

Are there any methodology for malware in case of threat assessment?

Malware is a threat in security assessment. Are there any criteria to assess malware in case of threat assessment?
2
votes
2answers
443 views

what is the relation between ISO IEC 15408 and Protection Profile?

I've been researching on EAL tests. there are some questions and i can't make heads or tails of them. I read ISO/IEC 15408-3 standard. I can't understand the numbers in the matrix table in page 33 (...
1
vote
1answer
114 views

Security certification of software products: what about libraries or third-party services?

How the security certification works if the software uses third party libraries or services? E.g., if someone would like to certify a software product following Common Criteria standard (let's say, ...
9
votes
2answers
15k views

Deference Between EAL 1-7 in Common Criteria Standard?

I have a question about ISO/IEC 15408 standard: I want know if the level of evaluation is higher we can conclude that a product is safer? i.e, if we have two products, is the one which has a higher ...
2
votes
1answer
472 views

Functional Specification for Common Criteria EAL 1 evaluation

I want to write a functional specification for CC EAL1 evaluation, There is an example in CC part 3 document but it is not enough complete, Are there any template or sample of a functional ...
4
votes
2answers
173 views

Evaluating hosting providers for CC development environment

An organization that develops software that may be subject to security evaluations such as Common Criteria is looking to externalize part of its IT infrastructure, including critical components such ...
8
votes
1answer
581 views

What compliance problem does “Common Criteria Certification” solve?

It has been said Common Criteria solves a "Compliance problem, and not a security problem". Can someone explain where CC certification is required or benefits an industry? Is it simply a marketing ...
5
votes
2answers
804 views

Is Common Criteria (CC) a suitable standard to certify web applications

I never came across a web application that has been certified according to Common Critera. As far as I know there isn't even a protection profile available for web applications. What is the reason ...