Common Criteria(CC) provides only the standard for evaluating information security product or system, namely Target of Evaluation (TOE). On the other hand, SSE-CMM provides the standard for Security Engineering Process Evaluation. Based on the CC, TOE's security quality may be assured, but its disadvantage is that the development process is neglected. SSE-CMM seems to assure the quality of TOE developed in an organization equipped with security engineering process, but the TOE developed in such environment cannot avoid CC-based security assurance evaluation. We propose an effective method of integrating two evaluation methods, CC and SSE-CMM, and develop CC-based assurance evaluation model, CC_SSE-CMM. CC_SSE-CMM presents the specific and realistically operable organizational security process maturity assessment and CC evaluation model.
|Number of pages||6|
|Journal||Proceedings - IEEE Computer Society's International Computer Software and Applications Conference|
|State||Published - 2003|
|Event||Proceedings: 27th Annual International Computer Software and Applications Conference, COMPSAC 2003 - Dallas, TX, United States|
Duration: 3 Nov 2003 → 6 Nov 2003