Sustainable Broadband Communications: International Perspective – Common Criteria
description
Transcript of Sustainable Broadband Communications: International Perspective – Common Criteria
![Page 1: Sustainable Broadband Communications: International Perspective – Common Criteria](https://reader036.fdocuments.us/reader036/viewer/2022070420/56815fa3550346895dce9fce/html5/thumbnails/1.jpg)
Bangalore, India ,17-18 December 2012
Sustainable Broadband Communications: International Perspective – Common Criteria
David Martin,Head of International Assurance,
Common Criteria Scheme Director, CESG, UK,
Joint ITU-GISFI Workshop on “Bridging the Standardization Gap: Workshop on
Sustainable Rural Communications”(Bangalore, India, 17-18 December 2012)
![Page 2: Sustainable Broadband Communications: International Perspective – Common Criteria](https://reader036.fdocuments.us/reader036/viewer/2022070420/56815fa3550346895dce9fce/html5/thumbnails/2.jpg)
David Martin
Involved in Information Assurance Standards for many yearsChair of International Common Criteria Development BoardScheme Director for the UK Common Criteria Scheme (operated by UK government)Representing UK Scheme - reporting on new CC vision statement
Bangalore, India ,17-18 December 2012 2
![Page 3: Sustainable Broadband Communications: International Perspective – Common Criteria](https://reader036.fdocuments.us/reader036/viewer/2022070420/56815fa3550346895dce9fce/html5/thumbnails/3.jpg)
Bangalore, India ,17-18 December 2012 3
Common Criteria - Background
Standards for Assurance of IT Product Security 26 Nations (more to come)16 Nations evaluate/certify productsAlso an ISO standard (15408 and 18045)Run by a Management Committee (with an executive to support) and a Development Board
![Page 4: Sustainable Broadband Communications: International Perspective – Common Criteria](https://reader036.fdocuments.us/reader036/viewer/2022070420/56815fa3550346895dce9fce/html5/thumbnails/4.jpg)
Bangalore, India ,17-18 December 2012 4
Common Criteria – The Value
Manufacturers do not have to evaluate products in multiple places.
Evaluation is very expensive in time and moneyGood cyber defence (and sustainable telecom) needs many more products evaluatedAll nations agree and procure to the common standardIndustry involvement (CCUF)
![Page 5: Sustainable Broadband Communications: International Perspective – Common Criteria](https://reader036.fdocuments.us/reader036/viewer/2022070420/56815fa3550346895dce9fce/html5/thumbnails/5.jpg)
Bangalore, India ,17-18 December 2012 5
Common Criteria – New Vision – Rationale -1
CC usage has been little changed for more than 12 years A number of nations found that:-
The focus on ‘assurance level (EAL)’ was damaging product security Not enough products are evaluated - Cyber defence needs many moreExpertise is applied in the wrong place, inconsistently, and without wide peer review.
![Page 6: Sustainable Broadband Communications: International Perspective – Common Criteria](https://reader036.fdocuments.us/reader036/viewer/2022070420/56815fa3550346895dce9fce/html5/thumbnails/6.jpg)
Bangalore, India ,17-18 December 2012 6
Common Criteria – New Vision – Rationale -2
Smartcard Community has developed a very effective way of using CCWork has taken place to support a similar approach for general IT products Resulting in the CCMC (management Committee) vision statement – published in September 2012
![Page 7: Sustainable Broadband Communications: International Perspective – Common Criteria](https://reader036.fdocuments.us/reader036/viewer/2022070420/56815fa3550346895dce9fce/html5/thumbnails/7.jpg)
Bangalore, India ,17-18 December 2012 7
For more information
Common Criteria Portal: www.commoncriteriaportal.orgThe vision statement links from the
front pageOther links show the products,
schemes, operating documents etc.Also see CCUF at
www.ccusersforum.org
![Page 8: Sustainable Broadband Communications: International Perspective – Common Criteria](https://reader036.fdocuments.us/reader036/viewer/2022070420/56815fa3550346895dce9fce/html5/thumbnails/8.jpg)
Existing Approach
Bangalore, India ,17-18 December 2012 8
![Page 9: Sustainable Broadband Communications: International Perspective – Common Criteria](https://reader036.fdocuments.us/reader036/viewer/2022070420/56815fa3550346895dce9fce/html5/thumbnails/9.jpg)
New Approach
Bangalore, India ,17-18 December 2012 9
![Page 10: Sustainable Broadband Communications: International Perspective – Common Criteria](https://reader036.fdocuments.us/reader036/viewer/2022070420/56815fa3550346895dce9fce/html5/thumbnails/10.jpg)
Technical Communities
Bangalore, India ,17-18 December 2012 10
![Page 11: Sustainable Broadband Communications: International Perspective – Common Criteria](https://reader036.fdocuments.us/reader036/viewer/2022070420/56815fa3550346895dce9fce/html5/thumbnails/11.jpg)
Meeting virtually
Bangalore, India ,17-18 December 2012 11
![Page 12: Sustainable Broadband Communications: International Perspective – Common Criteria](https://reader036.fdocuments.us/reader036/viewer/2022070420/56815fa3550346895dce9fce/html5/thumbnails/12.jpg)
Much quicker and more effective
Bangalore, India ,17-18 December 2012 12
![Page 13: Sustainable Broadband Communications: International Perspective – Common Criteria](https://reader036.fdocuments.us/reader036/viewer/2022070420/56815fa3550346895dce9fce/html5/thumbnails/13.jpg)
Bespoke design/evaluation
Bangalore, India ,17-18 December 2012 13
![Page 14: Sustainable Broadband Communications: International Perspective – Common Criteria](https://reader036.fdocuments.us/reader036/viewer/2022070420/56815fa3550346895dce9fce/html5/thumbnails/14.jpg)
Better to have known standards
Bangalore, India ,17-18 December 2012 14
![Page 15: Sustainable Broadband Communications: International Perspective – Common Criteria](https://reader036.fdocuments.us/reader036/viewer/2022070420/56815fa3550346895dce9fce/html5/thumbnails/15.jpg)
Other Important developments
Common view on cryptographySecurity Configuration AutomationStrong Linkage to Vulnerability/Weakness reportingSupply Chain working groupConsistent Government Procurement (and other major users) – addressing what ‘recognition’ really means
Bangalore, India ,17-18 December 2012 15
![Page 16: Sustainable Broadband Communications: International Perspective – Common Criteria](https://reader036.fdocuments.us/reader036/viewer/2022070420/56815fa3550346895dce9fce/html5/thumbnails/16.jpg)
Common support for procurement
Bangalore, India ,17-18 December 2012 16
![Page 17: Sustainable Broadband Communications: International Perspective – Common Criteria](https://reader036.fdocuments.us/reader036/viewer/2022070420/56815fa3550346895dce9fce/html5/thumbnails/17.jpg)
Bangalore, India ,17-18 December 2012 17
Common Criteria – New Vision – Summary
More assurance than a simple ‘EAL approach’ Uses worldwide expertise, instead of relying on single ‘expert’Open, Transparent, Repeatable – as befitting an International StandardStep change in volume – better for cyberdefenceLowers procurement costs
![Page 18: Sustainable Broadband Communications: International Perspective – Common Criteria](https://reader036.fdocuments.us/reader036/viewer/2022070420/56815fa3550346895dce9fce/html5/thumbnails/18.jpg)
Bangalore, India ,17-18 December 2012 18
What does this mean for Sustainable Broadband Communications?
More assurance (Ignore ‘EAL’ look at what is assured)More responsiveLower costWider range and choice of productsUses worldwide expertise, instead of relying on single ‘expert’Open, Transparent, Repeatable – as befitting an International Standard
![Page 19: Sustainable Broadband Communications: International Perspective – Common Criteria](https://reader036.fdocuments.us/reader036/viewer/2022070420/56815fa3550346895dce9fce/html5/thumbnails/19.jpg)
Bangalore, India ,17-18 December 2012 19
Further detail
First International Technical Community about to launch – based on USB storage deviceMany more to follow next yearAlready many TCs exist (mostly US based)
![Page 20: Sustainable Broadband Communications: International Perspective – Common Criteria](https://reader036.fdocuments.us/reader036/viewer/2022070420/56815fa3550346895dce9fce/html5/thumbnails/20.jpg)
Example TC Areas
Networking (NDPP, Firewalls, VPNs, etc)Storage (USB, Hard disks, etc)Applications on Operating systemsMobile telecoms (VOIP, SIP, MDM, etc) Multifunction devices (printers etc.)
Bangalore, India ,17-18 December 2012 20
![Page 21: Sustainable Broadband Communications: International Perspective – Common Criteria](https://reader036.fdocuments.us/reader036/viewer/2022070420/56815fa3550346895dce9fce/html5/thumbnails/21.jpg)
Bangalore, India ,17-18 December 2012 21
Telecoms Applicability
3gPP discussion – potential development of cPPsCould extend to system approachesKey is to have the real technical expertise setting the standards CCRA maintains the fairness, the reliability/reputation, and the worldwide recognition for vendors
![Page 22: Sustainable Broadband Communications: International Perspective – Common Criteria](https://reader036.fdocuments.us/reader036/viewer/2022070420/56815fa3550346895dce9fce/html5/thumbnails/22.jpg)
Conclusions and Recommendations
Bangalore, India ,17-18 December 2012 22