GB/T 18336.3-2015Information technology -- Security techniques -- Evaluation criteria for IT security -- Part 3: Security assurance components (English PDF)

Foreword

GB/T 18336 "Information technology - Security techniques - Evaluation criteria for IT

security" includes the following 3 parts.

— Part 1.Introduction and general model;

— Part 2.Security functional components;

— Part 3.Security assurance components.

This Part is part 3 of GB/T 18336.

This Part is drafted in accordance with specifications in GB/T1.1-2009.

This Part replaces GB/T 18336.3-2008 "Information technology - Security techniques -

Evaluation criteria for IT security - Part 3.Security assurance components".

The main differences between this Part and GB/T 18336.3-2008 are as follows.

— "assurance" is replaced by "guarantee" [Translator note. This is mainly adjustment

on Chinese. In English, the same word "assurance" should remain the most

appropriate, given that "Assurance" is still used in the corresponding ISO/IEC

15408-3.2008.This translation still uses the term "Assurance"];

— "6 Security assurance requirements" is replaced by "6 Security assurance

components";

— "6.3 Protection profile and security target evaluation criteria class structure", "6.4

Usage of terms in this Part", "6.5 Assurance classification" and "6.6 General

situation of assurance classes and families" are deleted;

— "6.1.5 EAL structure" is re-edited as "6.2 Evaluation assurance levels structure" in

this Part;

— "6.3 Combination assurance package structure" is added;

— "7 Protection profile and security target evaluation criteria" and "11 assurance

classes, families and components" are deleted;

— "8 Combination assurance package" is added;

— "8.1 TOE description" is deleted;

— "9.2 Conformance declaration" is added;

— "8.2 Security environment" and "8.6 Clearly stated IT security requirements" are

amended as "9.3 Security problem definition" and "9.5 Extended components

definition" respectively;

— "9.1 TOE description" and "9.5 PP declaration" are deleted;

— "10.2 Conformance declaration" is added;

— "9.2 Security environment" and "9.7 Clearly stated IT security requirements" are

amended as "10.3 Security problem definition" and "10.5 Extended components

definition" respectively;

— "High level design (ADV_HLD)", "Low level design(ADV_LLD)" and "Representing

corresponding relationship (ADV_RCR)" in "ADV class. development" are deleted;

— "Security architecture (ADV_ARC)" and "TOE design (ADV_TDS)" are added in

"ADV class. development";

— "Administrator guidelines (AGD_ADM)" and "User guidelines (AGD_USR)" of

AGD class are amended as "Operator guidelines(AGD_OPE)" and "Preparation

(AGD_PRE)" respectively;

— "CM capability (ACM_CAP)" and "CM scope (ACM_SCP)" in ACM class as well as

"delivery (ADO_DEL)" in ADO class are combined into ALC class;

— "CM automation (ACM_AUT)" in "ACM class. configuration management" is

deleted;

— "Installation, generation and starting (ADO_IGS) in "ADO class. delivery and

operation" is deleted;

— "Test cover (ATE_COV)" is amended as "Cover (ATE_COV)" while "Test depth

(ATE_DPT)" is amended as "Depth (ATE_DPT)";

— "Concealed channel analysis (AVA_CCA)", "Misusing (AVA_MSU)" and "TOE

strength of function (AVA_SOF)" in "AVA class. vulnerability evaluation" are

deleted;

— "Vulnerability analysis (AVA_VLA)" is amended as "Vulnerability analysis

(AVA_VAN)";

— "16 ACO class. combination" is added;

— "Annex A development (ADV)", "Annex B combination (ACO)" and "Annex D

cross-reference between PP and assurance components" and "Annex F

Cross-reference between CAP and assurance components" are added;

— "Annex A Cross-reference of dependency relationship of assurance components"

is amended as "Annex C Cross-reference of dependency relationship of

assurance components". "Annex B Cross-reference between EAL and assurance

components" is amended as "Annex E Cross-reference between EAL and

assurance components".

This Part uses translation method to equivalently adopt the international standard ISO/IEC

15408-2.2008 "Information technology - Security techniques - Evaluation criteria for IT

security -Part 3.Security assurance components".

The domestic documents that are consistently corresponding to the normative

international references in this Part are as follows.

-- GB/T 18336.1 Information technology - Security techniques - Evaluation criteria for

IT security – Part 1.Introduction and general mode (GB/T 18336.1-2015, ISO/IEC

15408--1.2009, IDT)

-- GB/T 18336.2 Information technology - Security techniques - Evaluation criteria for

IT security - Part 2.Security functional components (GB/T 18336.2-2015, ISO/IEC

15408-2.2008, IDT).

This Part was proposed by and shall be under jurisdiction of China Information Security

Standardization Technical Committee (SAC/TC 260).

The main drafting organizations of this Part. China Information Technology Security

Evaluation Centre, Information Technology Security Test and Evaluation Centre AND The

Third Research Institute of Ministry of Public Security.

1 Scope

This Part of GB/T 18336 defines the assurance requirements. It includes the evaluation

assurance levels (EALs) that define a scale for measuring assurance for component

TOEs, the composed assurance packages (CAPs) that define a scale for measuring

assurance for composed TOEs, the individual assurance components from which the

assurance levels and packages are composed, and the criteria for evaluation of PPs and

STs.

2 Normative references

The articles contained in the following documents have become part of this document

when they are quoted herein. For the dated documents so quoted, all the modifications

(including all corrections) or revisions made thereafter shall be applicable to this

document.

ISO/IEC 15408-1, Information technology - Security techniques - Evaluation criteria for

IT security - Part 1.Introduction and general model

ISO/IEC 15408-2, Information technology - Security techniques - Evaluation criteria for

IT security - Part 2.Security functional components

3 Terms and definitions

For the purposes of this document, the terms, definitions, symbols and abbreviated terms

given in ISO/IEC 15408-1 apply.

4 Overview