GB/T 18336.3-2024Cybersecurity technology—Evaluation criteria for IT security—Part 3: Security assurance components (English PDF)

Foreword

GB/T 18336 "Information technology - Security techniques - Evaluation criteria for IT security" includes the following 3 parts.

— Part 1: Introduction and general model;

— Part 2: Security functional components;

— Part 3: Security assurance components.

This Part is part 3 of GB/T 18336.

This Part is drafted in accordance with specifications in GB/T1.1-2009.

This Part replaces GB/T 18336.3-2008 "Information technology - Security techniques -Evaluation criteria for IT security - Part 3: Security assurance components".

The main differences between this Part and GB/T 18336.3-2008 are as follows.

— "assurance" is replaced by "guarantee" [Translator note. This is mainly adjustment on Chinese. In English, the same word "assurance" should remain the most appropriate, given that "Assurance" is still used in the corresponding ISO/IEC 15408-3:2008.This translation still uses the term "Assurance"];

— "6 Security assurance requirements" is replaced by "6 Security assurance components";

— "6.3 Protection profile and security target evaluation criteria class structure", "6.4 Usage of terms in this Part", "6.5 Assurance classification" and "6.6 General situation of assurance classes and families" are deleted;

— "6.1.5 EAL structure" is re-edited as "6.2 Evaluation assurance levels structure" in this Part;

— "6.3 Combination assurance package structure" is added;

— "7 Protection profile and security target evaluation criteria" and "11 assurance classes, families and components" are deleted;

— "8 Combination assurance package" is added;

— "8.1 TOE description" is deleted;

— "9.2 Conformance declaration" is added;

— "8.2 Security environment" and "8.6 Clearly stated IT security requirements" are amended as "9.3 Security problem definition" and "9.5 Extended components definition" respectively;

— "9.1 TOE description" and "9.5 PP declaration" are deleted;

— "10.2 Conformance declaration" is added;

— "9.2 Security environment" and "9.7 Clearly stated IT security requirements" are amended as "10.3 Security problem definition" and "10.5 Extended components definition" respectively;

— "High level design (ADV_HLD)", "Low level design(ADV_LLD)" and "Representing corresponding relationship (ADV_RCR)" in "ADV class. development" are deleted;

— "Security architecture (ADV_ARC)" and "TOE design (ADV_TDS)" are added in "ADV class. development";

— "Administrator guidelines (AGD_ADM)" and "User guidelines (AGD_USR)" of AGD class are amended as "Operator guidelines(AGD_OPE)" and "Preparation (AGD_PRE)" respectively;

— "CM capability (ACM_CAP)" and "CM scope (ACM_SCP)" in ACM class as well as "delivery (ADO_DEL)" in ADO class are combined into ALC class;

— "CM automation (ACM_AUT)" in "ACM class. configuration management" is deleted;

— "Installation, generation and starting (ADO_IGS) in "ADO class. delivery and operation" is deleted;

— "Test cover (ATE_COV)" is amended as "Cover (ATE_COV)" while "Test depth (ATE_DPT)" is amended as "Depth (ATE_DPT)";

— "Concealed channel analysis (AVA_CCA)", "Misusing (AVA_MSU)" and "TOE strength of function (AVA_SOF)" in "AVA class. vulnerability evaluation" are deleted;

— "Vulnerability analysis (AVA_VLA)" is amended as "Vulnerability analysis (AVA_VAN)";

— "16 ACO class. combination" is added;

— "Annex A development (ADV)", "Annex B combination (ACO)" and "Annex D cross-reference between PP and assurance components" and "Annex F Cross-reference between CAP and assurance components" are added;

— "Annex A Cross-reference of dependency relationship of assurance components" is amended as "Annex C Cross-reference of dependency relationship of assurance components". "Annex B Cross-reference between EAL and assurance components" is amended as "Annex E Cross-reference between EAL and assurance components".

This Part uses translation method to equivalently adopt the international standard ISO/IEC 15408-2:2008 "Information technology - Security techniques - Evaluation criteria for IT security -Part 3: Security assurance components".

The domestic documents that are consistently corresponding to the normative international references in this Part are as follows.

-- GB/T 18336.1 Information technology - Security techniques - Evaluation criteria for IT security – Part 1: Introduction and general mode (GB/T 18336.1-2015, ISO/IEC 15408--1:2009, IDT)

-- GB/T 18336.2 Information technology - Security techniques - Evaluation criteria for IT security - Part 2: Security functional components (GB/T 18336.2-2015, ISO/IEC 15408-2:2008, IDT).

This Part was proposed by and shall be under jurisdiction of China Information Security Standardization Technical Committee (SAC/TC 260).

The main drafting organizations of this Part. China Information Technology Security Evaluation Centre, Information Technology Security Test and Evaluation Centre AND The Third Research Institute of Ministry of Public Security.

1 Scope

This Part of GB/T 18336 defines the assurance requirements. It includes the evaluation assurance levels (EALs) that define a scale for measuring assurance for component TOEs, the composed assurance packages (CAPs) that define a scale for measuring assurance for composed TOEs, the individual assurance components from which the assurance levels and packages are composed, and the criteria for evaluation of PPs and STs.

2 Normative references

The articles contained in the following documents have become part of this document when they are quoted herein. For the dated documents so quoted, all the modifications (including all corrections) or revisions made thereafter shall be applicable to this document.

ISO/IEC 15408-1, Information technology - Security techniques - Evaluation criteria for IT security - Part 1: Introduction and general model ISO/IEC 15408-2, Information technology - Security techniques - Evaluation criteria for IT security - Part 2: Security functional components

3 Terms and definitions

For the purposes of this document, the terms, definitions, symbols and abbreviated terms given in ISO/IEC 15408-1 apply.

4 Overview