🔥🔥 Don’t Miss Out on Our End of Autumn Sale. If you have any questions, feel free to click the bottom right corner to contact our customer service..

Concat us[email protected]
Shopping Cart

No products in the cart.

🔍
BSI 21/30430578 DC:2021 Edition

BSI 21/30430578 DC:2021 Edition

$13.70

BS EN 17640. Fixed time cybersecurity evaluation methodology for ICT products

Published By Publication Date Number of Pages
BSI 2021 58
PDF Format Searchable Printable Preview Now
Guaranteed Safe Checkout
Category:

If you have any questions, feel free to reach out to our online customer service team by clicking on the bottom right corner. We’re here to assist you 24/7.
Email:[email protected]

This document describes the cybersecurity evaluation methodology for ICT products. It is intended for use for all three assurance levels as defined in the Cybersecurity Act (i.e. basic, substantial and high). The methodology is comprised of different evaluation blocks including assessment activities that comply with the evaluation requirements of the CSA for the three levels. Where appropriate, it can be applied both to 3rd party evaluation and self-assessment. It is expected that this methodology may be used by different candidate schemes and verticals providing a common framework to evaluate ICT products.

PDF Catalog

PDF Pages PDF Title
10 1 Scope
2 Normative references
3 Terms and definitions
12 4 Conformance
14 5 General concepts
5.1 Usage of this methodology
5.2 Knowledge of the TOE
15 5.3 Development process evaluation
5.4 Attack Potential
5.5 Knowledge building
16 6 Evaluation tasks
6.1 Completeness check
6.1.1 Aim
6.1.2 Evaluation method
6.1.3 Evaluator qualification
6.1.4 Evaluator work units
6.1.4.1 Work unit 1
6.1.4.2 Work unit 2
6.1.4.3 Work unit 3
6.2 Protection Profile Evaluation
6.2.1 Aim
6.2.2 Evaluation method
17 6.2.3 Evaluator qualification
6.2.4 Evaluator work units
6.2.4.1 Work unit 1
18 6.3 Security Target Evaluation
6.3.1 Aim
6.3.2 Evaluation method
6.3.3 Evaluator qualification
6.3.4 Evaluator work units
6.3.4.1 Work unit 1a
19 6.3.4.2 Work unit 1b
6.4 Review of security functionalities
6.4.1 Aim
6.4.2 Evaluation method
6.4.3 Evaluator qualification
6.4.4 Evaluator work units – Work unit 1
6.5 Development documentation
6.5.1 Aim
20 6.5.2 Evaluation method
6.5.3 Evaluator qualification
6.5.4 Work units
6.5.4.1 Work unit 1
6.6 Evaluation of TOE Installation
6.6.1 Aim
6.6.2 Evaluation method
6.6.3 Evaluator qualification
6.6.4 Evaluator work units
6.6.4.1 Work unit 1
21 6.6.4.2 Work unit 2
6.6.4.3 Work unit 3
6.7 Conformance testing
6.7.1 Aim
6.7.2 Evaluation method
6.7.3 Evaluator qualification
22 6.7.4 Evaluator work units
6.7.4.1 Work unit 1
6.7.4.2 Work unit 2
23 6.7.4.3 Work unit 3
6.8 Vulnerability review
6.8.1 Aim
6.8.2 Evaluation method
6.8.3 Evaluator qualification
6.8.4 Evaluator work units
6.8.4.1 Work unit 1
24 6.8.4.2 Work unit 2
6.9 Vulnerability testing
6.9.1 Aim
6.9.2 Evaluation method
6.9.3 Evaluator qualification
25 6.9.4 Evaluator work units
6.9.4.1 Work unit 1
6.9.4.2 Work unit 2
6.9.4.3 Work unit 3
26 6.9.4.4 Work unit 4
6.9.4.5 Work unit 5
6.10 Penetration testing
6.10.1 Aim
6.10.2 Evaluation method
6.10.2.1 General
27 6.10.2.2 Flaw Hypothesis Methodology
6.10.3 Evaluator qualification
28 6.10.4 Evaluator work units
6.10.4.1 Work unit 1
6.10.4.2 Work unit 2
6.11 Basic crypto analysis
6.11.1 Aim
6.11.2 Evaluation method
29 6.11.3 Evaluator qualification
6.11.4 Evaluator work units
6.11.4.1 Work unit 1
30 6.12 Extended crypto analysis
6.12.1 Aim
6.12.2 Evaluation method
6.12.3 Evaluator qualification
6.12.4 Evaluator work units
6.12.4.1 Work unit 1
31 6.12.4.2 Work unit 2
33 Annex A (informative)Example for a structure of a Security Target
A.1 General
A.2 Example structure
34 A.3 Typical content of an ST
35 Annex B (normative)The concept of a Protection Profile
B.1 General
B.2 Aim and basic principles of a Protection Profile (PP)
B.3 Guidance for schemes to implement the PP concept
36 Annex C (informative)Acceptance Criteria
C.1 Introduction
C.2 Identification, Authentication Control, and Access Control
39 C.3 Secure Boot
40 C.4 Cryptography
41 C.5 Secure State After Failure
42 C.6 Least Functionality
43 C.7 Update Mechanism
44 Annex D (informative)Guidance for integrating the methodology into a scheme
D.1 General
D.1.1 Introduction
D.1.2 Perform a risk assessment, reviewing the vertical domain under consideration
D.1.3 Assign the attack potential to the CSA levels
D.1.4 Select the evaluation tasks required for this level
D.1.5 Review and set the parameters for the tasks
45 D.1.6 Possible selection of additional or higher tasks
D.1.7 Review and set the parameters for the additional tasks
D.1.8 Set up and maintain further scheme requirements and guidelines
46 D.2 Example
49 Annex E (informative)Parameters of the methodology and the evaluation tasks
E.1 General
E.2 Parameters of the methodology
E.3 Parameters of the evaluation tasks
E.3.1 Parameters for 6.1 “Completeness check”
E.3.2 Parameters for 6.2 “Protection Profile Evaluation”
E.3.3 Parameters for 6.3 “Security Target Evaluation”
E.3.4 Parameters for 6.4 “Review of security functionalities”
E.3.5 Parameters for 6.5 “Development documentation”
E.3.6 Parameters for 6.6 “Evaluation of TOE Installation”
50 E.3.7 Parameters for 6.7 “Conformance testing”
E.3.8 Parameters for 6.8 “Vulnerability review”
E.3.9 Parameters for 6.9 “Vulnerability testing”
E.3.10 Parameters for 6.10 “Penetration testing”
E.3.11 Parameters for 6.11 “Basic crypto analysis”
E.3.12 Parameters for 6.12 “Extended crypto analysis”
51 Annex F (normative)Calculating the Attack Potential
F.1 General
F.2 Factors for Attack Potential
F.3 Numerical factors for attack potential
52 F.3.1 Default rating table
53 F.3.2 Adaptation of the rating table
56 Annex G (normative)Reporting the results of an evaluation
G.1 General
G.2 Written reporting
G.3 Oral defence of the results obtained

Related products

BSI 21/30430578 DC
$13.70