Common Criteria A Prime Factor In Information Security For The Dod
Below is a MRR and PLR article in category Home Family -> subcategory Other.
Common Criteria: Key to Information Security for the DoD
Summary
Is your critical information secure? How can you be sure? There are multiple ways to bolster confidence in your security measures, like relocating data to inaccessible locations or hiring security firms for system management. However, one of the simplest and now mandated methods for the Department of Defense (DoD) involves using IT products that undergo independent evaluation and certification.Enhancing Information Security
Ensuring the security of vital information is crucial. You might consider restricted access or hiring a firm to manage your security systems. Yet, for the DoD, employing independently evaluated IT products is essential.
Certified IT Products
Finding these certified IT products is straightforward ?" they are listed on the National Information Assurance Partnership (NIAP) website. The NIAP, established by the National Institute of Standards and Technology (NIST) and the National Security Agency (NSA), evaluates IT products against international standards, specifically the Common Criteria (CC).
The NIAP's Role
The NIAP manages the Common Criteria Evaluation and Validation Scheme (CCEVS) for IT Security. This partnership between public and private sectors helps consumers select commercial off-the-shelf (COTS) products that meet security requirements and assists manufacturers in gaining global acceptance.
Instruction 8500.2 and Its Importance
Instruction 8500.2 introduces definitions for "robustness" levels and assigns baseline levels of Information Assurance (IA) services according to the value and environment of the system. These descriptions assist the Information Systems Security Engineer (ISSE) and Designated Approving Authority (DAA) in determining the level of assurance required.
In selecting an evaluation confidence level, factors such as asset value, risk of compromise, potential adversary resources, and specific requirements are considered.
Evaluation Requirements
Products acquired under contracts made before July 1, 2002, must be evaluated if a new version is released. Contracts should also include provisions requiring completion of the evaluation process within a specified time.
Vendors collaborate with their Commercial Testing and Certification Laboratories (CCTL) and the Defense Department to set a reasonable timeframe, depending on product complexity and the lab’s familiarity.
Maintaining Certification
CC certification applies to specific versions and configurations of a product. Requirements for maintaining certification across versions are outlined in “Assurance Continuity: CCRA Requirements.” Vendors must ensure their products meet and maintain CC certification standards according to the contract.
Federal Policies and Evaluations
Federal laws emphasize the importance of evaluations. Public Law 107-314 directs that defense acquisition policies prioritize products evaluated and validated according to appropriate criteria. Waivers to these policies are difficult to obtain, highlighting the necessity of independent evaluations.
Conclusion
Evaluations ensure the DoD can trust that purchased products meet security claims. The selection of assurance levels must align with protection needs and intended use. While evaluations and maintenance require effort and time, understanding the process is crucial for procurement officers, contract officers, and vendors. Common Criteria evaluations are vital to safeguarding information for the DoD.
You can find the original non-AI version of this article here: Common Criteria A Prime Factor In Information Security For The Dod.
You can browse and read all the articles for free. If you want to use them and get PLR and MRR rights, you need to buy the pack. Learn more about this pack of over 100 000 MRR and PLR articles.