Extended eTVRA vs. Security Checklist: Experiences in a Value-Web

Morali, Ayse and Zambon, Emmanuele and Houmb, Siv Hilde and Sallhammar, Karin and Etalle, Sandro (2008) Extended eTVRA vs. Security Checklist: Experiences in a Value-Web. [Report]

Preview

PDF
899Kb

Abstract:	Security evaluation according to ISO 15408 (Common Criteria) is a resource and time demanding activity, as well as being costly. For this reason, only few companies take their products through a Common Criteria evaluation. To support security evaluation, the European Telecommunications Standards Institute (ETSI) has developed a threat, vulnerability, risk analysis (eTVRA) method for the Telecommunication (Telco) domain. eTVRA builds on the security risk management methodology CORAS and is structured in such a way that it provides output that can be directly fed into a Common Criteria security evaluation. In this paper, we evaluate the time and resource efficiency of parts of eTVRA and the quality of the result produced by following eTVRA compared to a more pragmatic approach (Protection Profile-based checklists). We use both approaches to identify and analyze risks of a new SIM card currently under joint development by a small hardware company and a large Telco provider. The new SIM card should comply with Evaluation Assurance Level 4 or 4+ according to Common Criteria.
Item Type:	Report
Faculty:	Electrical Engineering, Mathematics and Computer Science (EEMCS)
Research Group:	Distributed and Embedded Systems (DIES)
Link to this item:	http://purl.utwente.nl/publications/65094
Export this item as:	BibTeX EndNote HTML Citation Reference Manager

Repository Staff Only: item control page

Metis ID: 252103