6. Answer the questions

What is the reason for creating this standard?

What is the sphere of application of CC?

What is meant by TOE?

Which parties use the standard? How?

What are the main types of failure of security? What are the categories of protection related to them?

7. Mark the following statements true or false. Correct the false statements

1. Common Criteria is created as a common set of requirements for developing, assessing and buying IT products and systems.

2. During evaluation, an IT product or system is known as a Security Target of Evaluation.

3. Integrity is the category of information protection relating to the failure of security called unauthorized disclosure.

4. The CC is used to IT security measures implemented in software.

5. The CC concentrates on malicious human threats.

Vocabulary tasks

8. Form the word combinations and give their definitions.

Security, protection, evaluation.

9. Complete the sentences using the words given below.

Require, judgements, inspection, certification, a set.

1. The certification process is the independent ________ of the results of the evaluation leading to the production of the final certificate or approval.

2. The CC is presented as __________ of distinct but related parts.

3. The evaluation scheme, methodology and __________ processes are the responsibility of evaluation authorities that run evaluation scheme.

4. Many of the evaluation criteria _________ the application of expert judgements and background knowledge for which consistency is more difficult to achieve.

5. The CC contains criteria to be used by evaluators when forming __________ about the conformance of TOEs to the security requirements.

10. Make the word combinations.

1. distributed	a) custodians
2. fulfill	b) comparability
3. make	c) disclosure
4. permit	d) information
5. loss	e) measures
6. security	f) claims
7. auxiliary	g) of use
8. assurance	h) system
9. unauthorized	i) function
10. system	j) the needs

11. Match the term and its definition.

1. Evaluation authority

2. Target of Evaluation

3. Assets

4. Augmentation

5. Protection Profile

1. information or resources to be protected by the countermeasures of a TOE.

2. the addition of one or more assurance components from Part 3 to an EAL or assurance package.

3. a body that implements the CC for a specific community by means of evaluation scheme and thereby sets the standards and monitors the quality of evaluation.

4. an implementation-independent set of security requirements for a category of TOEs that meets specific consumer needs.

5. an IT product or system and its associated administrator and user guidance documentation that is the subject of an evaluation.