Ontology-based analysis of information security standards and capabilities for their harmonization

Vorobiev, V. I.; Fedorchenko, Ludmila; Zabolotsky, Vadim P.; Lyubimov, Alexander V.

doi:10.1145/1854099.1854129

Cited by 3 publications

(2 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…To fulfill encryption-related operations, such as using key material to sign by clients, the key management products require clientside software to be securely linked. The description of the TOE is the foundation of a PP and determines the number of PPs that will be developed [141]. To achieve harmonization, the TOE description facilitates the further comparison of the same types of products when conducting evaluation by comparing technical documents [142].…”

Section: ) Transferability Of Protection Profilesmentioning

confidence: 99%

Defining Security Requirements With the Common Criteria: Applications, Adoptions, and Challenges

Sun

Chan

et al. 2022

IEEE Access

View full text Add to dashboard Cite

Advances in emerging Information and Communications Technology (ICT) technologies push the boundaries of what is possible and open up new markets for innovative ICT products and services.The adoption of ICT products and systems with security properties depends on consumers' confidence and markets' trust in the security functionalities and whether the assurance measures applied to these products meet the inherent security requirements. Such confidence and trust are primarily gained through the rigorous development of security requirements, validation criteria, evaluation, and certification. The Common Criteria for Information Technology Security Evaluation (often referred to as Common Criteria or CC) is an international standard (ISO/IEC 15408) for cyber security. Motivated by encouraging the adoption of the CC that is used for ICT security evaluation and certification, in this paper, we conduct a systematic review of the CC standard and its adoptions. Adoption barriers of the CC are investigated based on the analysis of current trends in cyber security evaluation. In addition, we share the experiences and lessons gained through the recent Development of Australian Cyber Criteria Assessment (DACCA) project on the development of the Protection Profile that defines security requirements with the CC. Best practices, challenges, and future directions on defining security requirements for trusted cyber security advancement are presented.

show abstract

Section: ) Transferability Of Protection Profilesmentioning

confidence: 99%

Defining Security Requirements With the Common Criteria: Applications, Adoptions, and Challenges

Sun

Chan

et al. 2022

IEEE Access

View full text Add to dashboard Cite

show abstract

“…To fulfill encryption-related operations, such as using key material to sign by clients, the key management products require client-VOLUME 4, 2016 side software to be securely linked. The description of the TOE is the foundation of a PP and determines the number of PPs that will be developed [132]. To achieve harmonization, the TOE description facilitates the further comparison of the same types of products when conducting evaluation by comparing technical documents [133].…”

Section: ) Transferability Of Protection Profilesmentioning

confidence: 99%

Defining Security Requirements with the Common Criteria: Applications, Adoptions, and Challenges

Sun,

Li,

Chan

et al. 2022

Preprint

View full text Add to dashboard Cite

Advances of emerging Information and Communications Technology (ICT) technologies push the boundaries of what is possible and open up new markets for innovative ICT products and services.The adoption of ICT products and systems with security properties depends on consumers' confidence and markets' trust in the security functionalities and whether the assurance measures applied to these products meet the inherent security requirements. Such confidence and trust are primarily gained through the rigorous development of security requirements, validation criteria, evaluation, and certification. The Common Criteria for Information Technology Security Evaluation (often referred to as Common Criteria or CC) is an international standard (ISO/IEC 15408) for cyber security. In this paper, we conduct a systematic review of the CC standard and its adoptions. Adoption barriers of the CC are also investigated based on the analysis of current trends in cyber security evaluation. In addition, we share the experiences and lessons gained through the recent Development of Australian Cyber Criteria Assessment (DACCA) project on the development of the Protection Profile that defines security requirements with the CC. Best practices, challenges, and future directions on defining security requirements for trusted cyber security advancement are presented.

show abstract

Mapping the State of Security Standards Mappings

Mussmann¹,

Brunner²,

Breu³

2020

WI2020 Zentrale Tracks

View full text Add to dashboard Cite

Companies often have to comply with more than one security standard and refine parts of security standards to apply to their domain and specific security goals. To understand which requirements different security standards stipulate, a systematic overview or mapping of the relevant natural language security standards is necessary. Creating such standards mappings is a difficult task; to discover which methodologies and tools researchers and practitioners propose and use to map security standards, we conducted a systematic literature review. We identified 44 resources published between 2004 and 2018 using ACM Digital Library, IEEEXplore, SpringerLink, ScienceDirect, dblp and additional grey literature sources. We found that research focuses either on manual methods or on security ontologies to create security standards mappings. We also observed an increase in scientific publications over the investigated timespan which we attribute to the ISO 27001 standard update in 2013 and the EU GDPR coming into effect in 2018.

show abstract

Ontology-based analysis of information security standards and capabilities for their harmonization

Cited by 3 publications

References 0 publications

Defining Security Requirements With the Common Criteria: Applications, Adoptions, and Challenges

Defining Security Requirements With the Common Criteria: Applications, Adoptions, and Challenges

Defining Security Requirements with the Common Criteria: Applications, Adoptions, and Challenges

Mapping the State of Security Standards Mappings

Contact Info

Product

Resources

About