ДСТУ ISO/IEC TR 15446:2024 Информационная разработка. Методы безопасности. Руководство по созданию профилей защиты и целей безопасности (ISO/IEC TR 15446:2017, IDT)

ДСТУ ISO/IEC TR 15446:2024
(ISO/IEC TR 15446:2017, IDT)

Інформаційна технологія. Методи безпеки.
Настанови щодо створення профілів захисту та цілей безпеки

 
   
 
Не є офіційним виданням.
Офіційне видання розповсюджує національний орган стандартизації
(ДП «УкрНДНЦ» http://uas.gov.ua)

Contents

Foreword

Introduction

1 Scope

2 Normative references

3 Terms and definitions

4 Abbreviated terms

5 Purpose and structure of this document

6 Overview of PPs and STs

6.1 General

6.2 Audience

6.3 Use of PPs and STs

6.4 The PP/ST development process

6.5 Reading and understanding PPs and STs

7 Specifying the PP/ST introduction

8 Specifying conformance claims

9 Specifying the security problem definition

9.1 General

9.2 Identifying the informal security requirement

9.3 Howto identify and specify threats

9.4 How to identify and specify policies

9.5 How to identify and specify assumptions

9.6 Finalizing the security problem definition

10 Specifying the security objectives

10.1 General

10.2 Structuring the threats, policies and assumptions

10.3 Identifying the non-IT operational environment objectives

10.4 Identifying the IT operational environment objectives

10.5 Identifying the TOE objectives

10.6 Producing the objectives rationale

11 Specifying extended component definitions

12 Specifying the security requirements

12.1 General

12.2 Security paradigms in ISO/IEC 15408

12.3 How to specify security functional requirements in a PP or ST

12.4 Howto specify assurance requirements in a PP or ST

13 The TOE summary specification

14 Specifying PP/STs for composed and component TOEs

14.1 Composed TOEs

14.2 Component TOEs

15 Special cases

15.1 Low assurance Protection Profiles and Security Targets

15.2 Conforming to national interpretations

15.3 Concepts to enhance the flexibility of Protection Profiles

16 Use of automated tools

Annex A (informative) Example for the definition of an extended component

Annex В (informative) Example for the specification of refinements

Bibliography