Common Criteria
Common Criteria (CC) is a framework that allows users the ability to define their Security Function Requirements (SFRs) as well as Security Functional Assurance Requirements (SARs) using what is known as Protection Profiles (PPs). What this means is CC “Provides assurance that the process of specification, implementation, and evaluation of a computer security product has been conducted in a rigorous, standard and repeatable manner at a level that corresponds with its target use environment. This process is usually done for systems at the Federal Government or critical infrastructure level, but a lot of different organizations use this process to procure new software. The few reasons for this certification are to streamline IT products and protection profiles that have been evaluated by a panel. Also, this helps keep in order IT products so that there are no duplicated profiles. Overall, they look to improve the cost-effectiveness and efficiency of the certification process for these IT products. From what it looks like, public companies would benefit from applying for CC certification if they deal with some type of government-critical infrastructure. This would allow both parties’ systems to talk to each other because of the certification. CC certification means the systems are tested at a higher level and less susceptible to vulnerabilities and the possibility of attacks.
