Зарубежные нормативные документы и критерии на английском / CCPART3V21

Part 3: Security assurance requirements

Evaluation assurance llevell ((EAL)

overview

6

Evaluation assurance levels

190

The Evaluation Assurance Levels (EALs) provide an increasing scale that balances

the level of assurance obtained with the cost and feasibility of acquiring that degree

of assurance. The CC approach identifies the separate concepts of assurance in a

TOE at the end of the evaluation, and of maintenance of that assurance during the

operational use of the TOE.

191

It is important to note that not all families and components from CC Part 3 are

included in the EALs. This is not to say that these do not provide meaningful and

desirable assurances. Instead, it is expected that these families and components will

192

Table 6.1 represents a summary of the EALs. The columns represent a

hierarchically ordered set of EALs, while the rows represent assurance families.

Each number in the resulting matrix identifies a specific assurance component

where applicable.

193

As outlined in the next subclause, seven hierarchically ordered evaluation assurance

levels are defined in the CC for the rating of a TOE's assurance. They are

hierarchically ordered inasmuch as each EAL represents more assurance than all

lower EALs. The increase in assurance from EAL to EAL is accomplished by

substitution of a hierarchically higher assurance component from the same

assurance family (i.e. increasing rigour, scope, and/or depth) and from the addition

of assurance components from other assurance families (i.e. adding new

requirements).

194

These EALs consist of an appropriate combination of assurance components as

described in clause 2 of this Part 3. More precisely, each EAL includes no more than

one component of each assurance family and all assurance dependencies of every

component are addressed.

195

While the EALs are defined in the CC, it is possible to represent other combinations

of assurance. Specifically, the notion of “augmentation” allows the addition of

assurance components (from assurance families not already included in the EAL)

or the substitution of assurance components (with another hierarchically higher

assurance component in the same assurance family) to an EAL. Of the assurance

constructs defined in the CC, only EALs may be augmented. The notion of an “EAL

minus a constituent assurance component” is not recognised by the standard as a

valid claim. Augmentation carries with it the obligation on the part of the claimant

to justify the utility and added value of the added assurance component to the EAL.

An EAL may also be extended with explicitly stated assurance requirements.

August 1999

Version 2.1

Page 53 of 208

6 - Evaluation assurance levels

Evaluation assurance level details

196

The following subclauses provide definitions of the EALs, highlighting differences

between the specific requirements and the prose characterisations of those

requirements using bold type.

Assurance

Assurance

Assurance Components by

Evaluation Assurance Level

Class

Family

EAL1

EAL2

EAL3

EAL4

EAL5

EAL6

EAL7

Class ACM:

ACM_AUT

1

1

2

2

Configuration

ACM_CAP

1

2

3

4

4

5

5

management

ACM_SCP

1

2

3

3

3

Class ADO:

ADO_DEL

1

1

2

2

2

3

Delivery and

ADO_IGS

1

1

1

1

1

1

1

operation

ADV_FSP

1

1

1

2

3

3

4

ADV_HLD

1

2

2

3

4

5

Class ADV:

ADV_IMP

1

2

3

3

ADV_INT

1

2

3

Development

ADV_LLD

1

1

2

2

ADV_RCR

1

1

1

1

2

2

3

ADV_SPM

1

3

3

3

Class AGD:

AGD_ADM

1

1

1

1

1

1

1

Guidance

AGD_USR

1

1

1

1

1

1

1

documents

Class ALC:

ALC_DVS

1

1

1

2

2

ALC_FLR

Life cycle

ALC_LCD

1

2

2

3

support

ALC_TAT

1

2

3

3

ATE_COV

1

2

2

2

3

3

Class ATE:

ATE_DPT

1

1

2

2

3

Tests

ATE_FUN

1

1

1

1

2

2

ATE_IND

1

2

2

2

2

2

3

Class AVA:

AVA_CCA

1

2

2

AVA_MSU

1

2

2

3

3

Vulnerability

AVA_SOF

1

1

1

1

1

1

assessment

AVA_VLA

1

1

2

3

4

4

Page 54 of 208

Version 2.1

August 1999

Evaluation assurance level details

6 - Evaluation assurance levels

197

EAL1 is applicable where some confidence in correct operation is required, but the

threats to security are not viewed as serious. It will be of value where independent

assurance is required to support the contention that due care has been exercised with

respect to the protection of personal or similar information.

198

EAL1 provides an evaluation of the TOE as made available to the customer,

including independent testing against a specification, and an examination of the

guidance documentation provided. It is intended that an EAL1 evaluation could be

successfully conducted without assistance from the developer of the TOE, and for

minimal outlay.

199

An evaluation at this level should provide evidence that the TOE functions in a

manner consistent with its documentation, and that it provides useful protection

against identified threats.

Assurance components

200

EAL1 (see Table 6.2) provides a basic level of assurance by an analysis of the

security functions using a functional and interface specification and guidance

documentation, to understand the security behaviour.

201

The analysis is supported by independent testing of the TOE security

functions.

202

This EAL provides a meaningful increase in assurance over an unevaluated IT

product or system.

Table 6.2 - EAL1

Assurance class

Assurance components

Class ACM: Configuration

ACM_CAP.1 Version numbers

management

Class ADO: Delivery and

ADO_IGS.1 Installation, generation, and start-up

operation

procedures

Class ADV: Development

ADV_FSP.1 Informal functional specification

ADV_RCR.1 Informal correspondence demonstration

Class AGD: Guidance

AGD_ADM.1 Administrator guidance

documents

AGD_USR.1 User guidance

Class ATE: Tests

ATE_IND.1 Independent testing - conformance

August 1999

Version 2.1

Page 55 of 208

6 - Evaluation assurance levels

Evaluation assurance level details

203

EAL2 requires the co-operation of the developer in terms of the delivery of design

information and test results, but should not demand more effort on the part of the

developer than is consistent with good commercial practice. As such it should not

require a substantially increased investment of cost or time.

204

EAL2 is therefore applicable in those circumstances where developers or users

require a low to moderate level of independently assured security in the absence of

ready availability of the complete development record. Such a situation may arise

when securing legacy systems, or where access to the developer may be limited.

Assurance components

205

EAL2 (see Table 6.3) provides assurance by an analysis of the security functions,

using a functional and interface specification, guidance documentation and the

high-level design of the TOE, to understand the security behaviour.

206

The analysis is supported by independent testing of the TOE security functions,

evidence of developer testing based on the functional specification, selective

independent confirmation of the developer test results, strength of function

analysis, and evidence of a developer search for obvious vulnerabilities (e.g.

those in the public domain).

207

EAL2 also provides assurance through a configuration list for the TOE, and

evidence of secure delivery procedures.

208

This EAL represents a meaningful increase in assurance from EAL1 by

requiring developer testing, a vulnerability analysis, and independent testing

based upon more detailed TOE specifications.

Page 56 of 208

Version 2.1

August 1999

Evaluation assurance level details

6 - Evaluation assurance levels

Table 6.3 - EAL2

Assurance class

Assurance components

Class ACM: Configuration

ACM_CAP.2 Configuration items

management

Class ADO: Delivery and

ADO_DEL.1 Delivery procedures

operation

ADO_IGS.1 Installation, generation, and start-up procedures

ADV_FSP.1 Informal functional specification

Class ADV: Development

ADV_HLD.1 Descriptive high-level design

ADV_RCR.1 Informal correspondence demonstration

Class AGD: Guidance

AGD_ADM.1 Administrator guidance

documents

AGD_USR.1 User guidance

ATE_COV.1 Evidence of coverage

Class ATE: Tests

ATE_FUN.1 Functional testing

ATE_IND.2 Independent testing - sample

Class AVA: Vulnerability

AVA_SOF.1 Strength of TOE security function evaluation

assessment

AVA_VLA.1 Developer vulnerability analysis

August 1999

Version 2.1

Page 57 of 208

6 - Evaluation assurance levels

Evaluation assurance level details

209

EAL3 permits a conscientious developer to gain maximum assurance from positive

security engineering at the design stage without substantial alteration of existing

sound development practices.

210

EAL3 is applicable in those circumstances where developers or users require a

moderate level of independently assured security, and require a thorough

investigation of the TOE and its development without substantial re-engineering.

Assurance components

211

EAL3 (see Table 6.4) provides assurance by an analysis of the security functions,

using a functional and interface specification, guidance documentation, and the

high-level design of the TOE, to understand the security behaviour.

212

The analysis is supported by independent testing of the TOE security functions,

evidence of developer testing based on the functional specification and high-level

design, selective independent confirmation of the developer test results, strength of

function analysis, and evidence of a developer search for obvious vulnerabilities

(e.g. those in the public domain).

213

EAL3 also provides assurance through the use of development environment

controls, TOE configuration management, and evidence of secure delivery

procedures.

214

This EAL represents a meaningful increase in assurance from EAL2 by

requiring more complete testing coverage of the security functions and

Page 58 of 208

Version 2.1

August 1999

Evaluation assurance level details

6 - Evaluation assurance levels

Table 6.4 - EAL3

Assurance class

Assurance components

Class ACM: Configuration

ACM_CAP.3 Authorisation controls

management

ACM_SCP.1 TOE CM coverage

Class ADO: Delivery and

ADO_DEL.1 Delivery procedures

operation

ADO_IGS.1 Installation, generation, and start-up procedures

ADV_FSP.1 Informal functional specification

Class ADV: Development

ADV_HLD.2 Security enforcing high-level design

ADV_RCR.1 Informal correspondence demonstration

Class AGD: Guidance

AGD_ADM.1 Administrator guidance

documents

AGD_USR.1 User guidance

Class ALC: Life cycle

ALC_DVS.1 Identification of security measures

support

ATE_COV.2 Analysis of coverage

Class ATE: Tests

ATE_DPT.1 Testing: high-level design

ATE_FUN.1 Functional testing

ATE_IND.2 Independent testing - sample

Class AVA: Vulnerability

AVA_MSU.1 Examination of guidance

AVA_SOF.1 Strength of TOE security function evaluation

assessment

AVA_VLA.1 Developer vulnerability analysis

August 1999

Version 2.1

Page 59 of 208

6 - Evaluation assurance levels

Evaluation assurance level details

215

EAL4 permits a developer to gain maximum assurance from positive security

engineering based on good commercial development practices which, though

rigorous, do not require substantial specialist knowledge, skills, and other

resources. EAL4 is the highest level at which it is likely to be economically feasible

to retrofit to an existing product line.

216

EAL4 is therefore applicable in those circumstances where developers or users

require a moderate to high level of independently assured security in conventional

commodity TOEs and are prepared to incur additional security-specific engineering

costs.

Assurance components

217

EAL4 (see Table 6.5) provides assurance by an analysis of the security functions,

using a functional and complete interface specification, guidance documentation,

the high-level and low-level design of the TOE, and a subset of the

implementation, to understand the security behaviour. Assurance is additionally

gained through an informal model of the TOE security policy.

218

The analysis is supported by independent testing of the TOE security functions,

evidence of developer testing based on the functional specification and high-level

design, selective independent confirmation of the developer test results, strength of

function analysis, evidence of a developer search for vulnerabilities, and an

independent vulnerability analysis demonstrating resistance to penetration

attackers with a low attack potential.

219

EAL4 also provides assurance through the use of development environment

controls and additional TOE configuration management including automation,

and evidence of secure delivery procedures.

220

This EAL represents a meaningful increase in assurance from EAL3 by

requiring more design description, a subset of the implementation, and

Page 60 of 208

Version 2.1

August 1999

Evaluation assurance level details

6 - Evaluation assurance levels

Table 6.5 - EAL4

Assurance class

Assurance components

Class ACM: Configuration

ACM_AUT.1 Partial CM automation

ACM_CAP.4 Generation support and acceptance procedures

management

ACM_SCP.2 Problem tracking CM coverage

Class ADO: Delivery and

ADO_DEL.2 Detection of modification

operation

ADO_IGS.1 Installation, generation, and start-up procedures

ADV_FSP.2 Fully defined external interfaces

ADV_HLD.2 Security enforcing high-level design

Class ADV: Development

ADV_IMP.1 Subset of the implementation of the TSF

ADV_LLD.1 Descriptive low-level design

ADV_RCR.1 Informal correspondence demonstration

ADV_SPM.1 Informal TOE security policy model

Class AGD: Guidance

AGD_ADM.1 Administrator guidance

documents

AGD_USR.1 User guidance

Class ALC: Life cycle

ALC_DVS.1 Identification of security measures

ALC_LCD.1 Developer defined life-cycle model

support

ALC_TAT.1 Well-defined development tools

ATE_COV.2 Analysis of coverage

Class ATE: Tests

ATE_DPT.1 Testing: high-level design

ATE_FUN.1 Functional testing

ATE_IND.2 Independent testing - sample

Class AVA: Vulnerability

AVA_MSU.2 Validation of analysis

AVA_SOF.1 Strength of TOE security function evaluation

assessment

AVA_VLA.2 Independent vulnerability analysis

August 1999

Version 2.1

Page 61 of 208

6 - Evaluation assurance levels

Evaluation assurance level details

221

EAL5 permits a developer to gain maximum assurance from security engineering

based upon rigorous commercial development practices supported by moderate

application of specialist security engineering techniques. Such a TOE will probably

be designed and developed with the intent of achieving EAL5 assurance. It is likely

that the additional costs attributable to the EAL5 requirements, relative to rigorous

development without the application of specialised techniques, will not be large.

222

EAL5 is therefore applicable in those circumstances where developers or users

require a high level of independently assured security in a planned development and

require a rigorous development approach without incurring unreasonable costs

attributable to specialist security engineering techniques.

Assurance components

223

EAL5 (see Table 6.6) provides assurance by an analysis of the security functions,

using a functional and complete interface specification, guidance documentation,

the high-level and low-level design of the TOE, and all of the implementation, to

understand the security behaviour. Assurance is additionally gained through a

formal model of the TOE security policy and a semiformal presentation of the

functional specification and high-level design and a semiformal demonstration

of correspondence between them. A modular TOE design is also required.

224

The analysis is supported by independent testing of the TOE security functions,

evidence of developer testing based on the functional specification, high-level

design and low-level design, selective independent confirmation of the developer

test results, strength of function analysis, evidence of a developer search for

vulnerabilities, and an independent vulnerability analysis demonstrating resistance

to penetration attackers with a moderate attack potential. The analysis also

includes validation of the developer’s covert channel analysis.

225

EAL5 also provides assurance through the use of a development environment

controls, and comprehensive TOE configuration management including

automation, and evidence of secure delivery procedures.

226

This EAL represents a meaningful increase in assurance from EAL4 by

requiring semiformal design descriptions, the entire implementation, a more

structured (and hence analysable) architecture, covert channel analysis, and

improved mechanisms and/or procedures that provide confidence that the

TOE will not be tampered with during development.

Page 62 of 208

Version 2.1

August 1999