Defining requirements for network solution in protection profiles

Abstract

The international standards about computer security are widely being used for both government and commercial sector. Many countries seek for their computer security at the common criteria (CC), so organizations learn more how to make protection profiles (PPs) to protect them from outside threats. However in case people make protection profiles using both "Guide for the Production of PPs and STs" and the common criteria, they confront some problems when defining requirements for network-wide systems instead of a single system. Many requirements in the CC are described based on a single system's activities. We found that network-wide product's PPs are required of different approach, where some statements in the CC are modified or newly extended. We show that how the network-wide targets of evaluation (TOEs) are different from a single system TOE in terms of its protection scope. This paper is of prior interest to PP/ST writers who have tasks of composing network product, or typically IDS PP/ST.