Report on the work in ISO/IEC JTC 1/SC 27/WG 3 related to ISO/IEC 15408

Last week I was once again privileged to be able to  join ISO/IEC JTC 1/SC 27/WG 3 during the latest of their bi-annual working sessions held in April and October.

Convened by Miguel Bañón, this working group is of particular interest to atsec since it includes work on the international standards and guidance documents relating to ISO/IEC 15408, ISO/IEC 19790 and other documents closely related to evaluation and testing and the provision of assurance.

I have written in more detail on these standards in:

• ISO's work related to the Common Criteria and
• ISO's cryptographic module work

A little history on the relationship between ISO/IEC 15408 and the Common Criteria reveals that in the early 1990's, as the various national criteria , including Europe's ITSEC, The Canadian Criteria (CTCPEC) and the US Federal criteria, were brought together in order to create a single set of harmonized criteria, the intention was to publish the new set of "Common Criteria" as an ISO standard. A decision was made to create a more agile  technical community that could produce the work and present it to ISO. This was not done using the "PAS" process, but aimed to produce and submit  a substantially complete work that would allow expeditious instantiation of the work with the full involvement of the ISO community,which could then support the standard's future maintenance within ISO.

Hence the CCDB and ISO established a close liaison relationship, the Common Criteria were submitted to ISO by the CCDB and the first edition of  ISO/IEC 15408 was published in December of 1999.  Since then the CCDB have continued to liaise with ISO enabling the content  ISO/IEC 15408 and the "Common Criteria" to remain synchronized. It's a two way relationship allowing for changes and innovations to be brought to WG 3, and vice versa.

ISO brings to the table a breadth and depth of constituents far beyond that of the CCDB. SC 27 (Security Techniques) currently brings together 50 participating nations, a further 27 observing nation and is in liaison with many industry groups and standards organizations.
(At the SC 27 level these currently include CCDB, CCETT, Cloud security alliance, ECBS, ENISA, EPC, ETSI, Ecma International, ISACA/ITGI, ISSEA, ITU, MasterCard, and Visa, and organizations in direct liaison with WG 3 include the CCDB, CSNISG, ENISA, FIRST, ISCI, ISA99, ITU-T, ISO SC 7, ISO SC 37, ISO TC 65/WG 10, ISO TC 247. TCG and The Open Group.)

The various national bodies and liaison organizations represented in WG 3 work closely within their home fields to garner the participation of, and to  represent the interests of, their own constituents.

The CCDB was initially comprised of representatives from those  countries contributing their own national criteria, today the CCDB is still a subset of  the  13 members of the CCRA certificate issuing signatory nations and development efforts  focus on the needs of the government agencies which they represent. From the perspective of commercial industry and the wider group of CCRA it is a closed group, a little disconcerting when you realize that at least in the U.S., the stated policy is to adopt COTS products as a means of making government systems, more timely and cost-effective  and the US government emphasizes the benefits of public-private partnership.

What does this mean in practice? WG 3 have focused on the open development of supporting standards and guidance. My earlier blogs detailed much of the work the WG 3 has established or that in progress. During  our  last WG 3 meeting  we heard from both The Open Group Real Time Embedded Systems forum and from our hosts at ETSI that work on High-assurance is an important topic to them and so WG 3 has initiated a study period on High-assurance - asking for contributions on this topic from it's national bodies and liaison organizations. WG 3 is also calling for contributions on the study period for predictive assurance, in which we hope to  understand the needs of industry and the  nations for this important topic.

As a result of  our last meeting WG 3:

• Proposed a new work item - A Catalogue of Architectural and Design Principles for Secure products, Systems and Applications 
• Resolved  to revise the existing standard ISO/IEC 19791: Security assessment of operational systems in the light of progress that has been made in the few years since it was published and expected findings from the study of predictive assurance
• Resolved to send the final corrigenda for  ISO/IEC 15408 and ISO/IEC 18045 for ballot by the ISO members. (These corrections to the standards reflect the changes that were introduced by Common Criteria V3.1 release 4.)
• Initiated a study period on high-assurance
• Extended the study period on predictive assurance

If you are interested in contributing to these or other developments within SC 27 then you can do so either through your national body, or through one of the liaison organizations to SC 27.

By, Fiona Pattinson

Call for Papers: The First International Cryptographic Module Conference(ICMC 2013)

This first ICMC aims to bring together experts from around the world to confer on the topic of cryptographic modules, with emphasis on their secure design, implementation, assurance, and use, referencing both new and established standards such as FIPS 140-2 and ISO/IEC 19790.

We are focused on attracting participants from the engineering and research community, test laboratories, government organizations, the procurers, deployers and administrators of cryptographic modules and academia. Our program consists of one day of workshops and tutorials, followed by two days of 30 minute presentations (plus 15 minute for questions). We solicit proposals for high quality papers and relevant workshops that will be of interest to the community involved with cryptographic modules on topics such as:

• Management of cryptographic modules in the field
• Standards: including FIPS 140-2, ISO/IEC 19790, FIPS 140-3
• Physical security and Hardware design
• Key management
• Random number generation
• Side channel analysis, non-invasive attacks
• Choice of and Implementing cryptographic algorithms
• Cryptographic modules implemented in Open Source
• Hybrid systems, Embedded systems
• Tools and methodologies

The committee favors vendor-neutral presentations that focus on the practical design, testing and use of cryptographic modules. Product vendors are encouraged to recruit clients and partners who are front-line implementers as presenters.

Visit www.icmc-2013.org for more information.

Dates:

Abstracts:	April 1st, 2013
Review and comments:	April 23rd, 2013
Acceptance notifications:	July 16th, 2013
Final versions due:	September 3rd, 2013
Workshops/Tutorials:	September 24th, 2013
Presentation of papers:	September 25th and 26th, 2013

All prospective authors must submit their abstracts and workshop proposals using this link:
http://www.icmc-2013.org/paper-submissions.html

For any questions regarding submissions or the conference in general, please contact us at info@icmc-2013.org.

SPONSORS

We would like to thank the following sponsors for their support:

Platinum Sponsors

atsec information security

Steve Weingart to Speak at the Non-Invasive Attack Testing Workshop in Nara, Japan

atsec's principal consultant Steve Weingart will be a panelist at the Non-Invasive Attack Testing Workshop (September 25th – 27th, 2011) in Nara, Japan l. Weingart was asked to join the panel as a laboratory representative discussing the practicality of non-invasive testing and how it fits into the conformance testing and business requirements of the laboratories. He will give a short introduction of the subject matter before joining the panel discussion.

Read more about this on our website.

July Newsletter

We invite you to take a look at our current newsletter. The focus of this issue is on independent security analysis and hardware testing. It is available for download from our website.

- Andreas Fabis

Automobile Security

One of the best things about working for atsec is that I never know what I will be working on or investigating next. That is so long as it's on the topic of information security.

A topic that sometimes gets discussed with my atsec colleagues is that of embedded systems; how pervasive they are; how they are often found in very hostile environments where it is difficult to use some of the environment safeguards that are typically found in data-centers and that we can "assume" in an analysis of operating systems and applications. These include restricting access to attackers, and that there is a trusted administrator. In the world of embedded systems these assumptions can be much less readily assumed. Our office in Germany has had projects with some major European car manufacturers and the topic of information security for the on-board systems is for some reason a topic of much interest to the guys...

I was reminded of this when I found this paper: "Experimental Security Analysis of a Modern Automobile". I guess we'll be talking more on this topic.

Fiona Pattinson