From: Jeremy Mineweaser <Jeremym@area1s220.residence.gatech.edu>
Date: Thu, 18 Jan 1996 23:03:33 +0800
To: "cypherpunks@toad.com>
Subject: Re: ITSEC?
Message-ID: <2.2.32.19960118133432.00923e2c@area1s220.residence.gatech.edu>
MIME-Version: 1.0
Content-Type: text/plain


At 10:32 AM 1/18/96 -0000, Juan D. Sandoval wrote:

>does anyone know where I can get info on Information Technology 
>Secure Evaluation Criteria (ITSEC)?

Here's what I found:

------------------------>
Excerpted from _Computer_Security_Handbook,_Third_Edition_ by Hutt,
Bosworth, & Hoyt
(C) 1995 by John Wiley and Sons:

(d) European and Canadian Security Standards.  
        Since its original publication in 1983, the TCSEC has greatly
influenced It security.  It is widely recognized as a yardstick for
evaluating products in relation to security features and assurances needed
to support security objectives.  TCSEC has also influenced the development
of other documents both in the US and abroad, forming a foundation of
second-generation requirements.
        In 1991, the European Community adopted the Information Technology
Security Evaluation Criteria (ITSEC) for a two year trial period.  The ITSEC
approach uses "Security Targets" for expressing security functionality
profiles.  ITSEC was builtin upon various national initiatives, including
the TCSEC, and represents a /harmonized/ effort among Franfce, Germany, the
Netherlands, and the United Kingdom.

------------------------>
A quick search of INSPEC (described below) turned up some useful results, as
well.

INSP (INSPEC) 
        Citations and abstracts of articles in physics, electronics,
engineering, computer and information technology journals. 

A keyword search for ITSEC revealed 30+ documents related to IT and systems
security measures.  The citation below seemed the most useful:

        Sizer, R.  "Information technology security evaluation criteria
(ITSEC)."  _Computer_Bulletin_, vol.5, pt.5, p.7.  Oct. 1993.   ISSN:
00104531 ;;gtec.  Keywords: data integrity. data privacy. security of data.
Class codes: C0310D. C6130S.  Date indexed: 12/93.

Abstract:
        The insecurity of IT systems (typified by unauthorised access) is a
complex and increasingly aggravating social problem. All sectors of
society-commerce, industry, government (local and national) and domestic are
at risk. People who have the responsibility for choosing, installing or
using IT systems have faced considerable difficulty in choosing IT security
products purporting to provide a 'secure environment' employing technical
security mechanisms in hardware and software. The problem has, in the main,
been the highly subjective claims for, and interpretation of, those security
mechanisms. The ITSEC criteria involve the independent evaluation of IT
products and systems (hardware and software) which claim security features.
Security includes confidentiality, integrity and availability

------------------------>

This citation may also be useful, but the text of the paper is in German.

        Peleska, J. and Reichel, H. of Deutsche Syst.-Tech. GmbH, Kiel,
Germany.  "Formal specification of generic ITSEC functionality classes."
_Informatik_-_Wirtschaft_-_Gesellschaft_ (Informatics - Economy - Society).
p.354-64, 1993.  ISSN: 3540571922;;gtec.  Conference: Informatik Wirtschaft
Gesellschaft (Informatics, Economy, Society), Dresden, Germany, 27 Sept.-1
Oct. 1993.  Keywords: formal specification. software quality. standards.
Class. Codes: C6110B.  Date Indexed:  10/94.

Abstract:
        On the basis of the formal specification, the consistency of
specification of a concrete product to the ITSEC standards is not only
informally motivatable, but also mathematically provable. In this way, the
objective visability, quality and efficiency of the evaluation process are
increased. For the evaluation of products at Stage E6, use of the described
concepts (or of comparable ones) is indispensable

------------------------>

I have access via my local library to the first document (the actual ITSEC
specification) but not to the second.  You should be able to find the
_Computer_Bulletin_ at most universities with CS majors.

Hope this helps,

Jeremy
---
   Jeremy Mineweaser     | GCS/E d->-- s:- a--- C++(+++)$ ULC++(++++)>$ P+>++$
 j.mineweaser@ieee.org   | L+>++ E-(---)  W++ N+  !o-- K+>++  w+(++++) O-  M--
                         | V-(--) PS+(--) PE++ Y++>$ PGP++>+++$ t+() 5 X+ R+()
    *ai*vr*vx*crypto*    | tv(+)  b++>+++ DI+(++)  D+  G++ e>+++  h-() r-@ !y-