eLibrary >
BS EN ISO/IEC 19896-3:2023 IT security techniques. Competence requirements for information security testers and evaluators - Knowledge, skills and effectiveness requirements for ISO/IEC 15408 evaluators >
BS EN ISO/IEC 19896-3:2023 IT security techniques. Competence requirements for information security testers and evaluators - Knowledge, skills and effectiveness requirements for ISO/IEC 15408 evaluators, 2023
- undefined
- Foreword
- Introduction
- 1 Scope
- 2 Normative references
- 3 Terms and definitions
- 4 Knowledge
- 4.1 General
- 4.2 Knowledge of ISO/IEC 15408 and ISO/IEC 18045
- 4.2.1 ISO/IEC 15408-1
- 4.2.2 ISO/IEC 15408-2
- 4.2.3 ISO/IEC 15408-3
- 4.2.4 ISO/IEC 18045
- 4.3 Knowledge of the assurance paradigm
- 4.3.1 Knowledge of the evaluation authority
- 4.3.2 Knowledge of the evaluation scheme
- 4.3.3 Knowledge of the laboratory and it’s management system
- 4.4 Knowledge of information security
- 4.5 Knowledge of the technology being evaluated
- 4.5.1 Knowledge of the technology being evaluated
- 4.5.2 Protection Profiles, packages and supporting documents
- 4.6 Knowledge required for specific assurance classes
- 4.7 Knowledge required when evaluating specific security functional requirements
- 4.8 Knowledge needed when evaluating specific technologies
- 5 Skills
- 5.1 Basic evaluation skills
- 5.1.1 Evaluation methods
- 5.1.2 Evaluation tools
- 5.2 Core evaluation skills given in ISO/IEC 15408-3 and ISO/IEC 18045
- 5.2.1 Evaluation principles
- 5.2.2 Evaluation methods and activities
- 5.3 Skills required when evaluating specific security assurance classes
- 5.3.1 General
- 5.3.2 ADV (Development) Class
- 5.3.3 AGD (Guidance Documents) Class
- 5.3.4 ALC (Life-Cycle Support) Class
- 5.3.5 ASE and APE (ST and PP evaluation) Classes
- 5.3.6 ATE (Tests) Class
- 5.3.7 AVA (Vulnerability Assessment) Class
- 5.3.8 ACO (Composition) Class
- 5.4 Skills required when evaluating specific security functional requirement classes
- 5.4.1 General
- 5.4.2 Skills required when evaluating the FCS (Cryptographic support) Class
- 5.5 Skills needed when evaluating specific technologies
- 6 Experience
- 7 Education
- 8 Effectiveness
- 8.1 General
- 8.2 Effectiveness of the evaluation
- 8.3 Evaluation scheme responsibilities for evaluator effectiveness
- 8.4 Effectiveness in performing timely evaluations
- 8.5 Effectiveness in performing accurate evaluations
- 8.6 Effectiveness in reporting results
- Annex A (informative) Technology types: Knowledge and skills
- Annex B (informative) Examples of knowledge required for evaluating security assurance requirement classes
- Annex C (informative) Examples of knowledge required for evaluating security functional requirement classes
- Bibliography [Go to Page]