Page 511 - (ISC)² CISSP Certified Information Systems Security Professional Official Study Guide

Select Controls Based On Systems Security

Requirements

Those who purchase information systems for certain kinds of
applications—think, for example, about national security agencies

where sensitive information may be extremely valuable (or dangerous
in the wrong hands) or central banks or securities traders where
certain data may be worth billions of dollars—often want to
understand their security strengths and weaknesses. Such buyers are
often willing to consider only systems that have been subjected to
formal evaluation processes in advance and have received some kind
of security rating. Buyers want to know what they’re buying and,

usually, what steps they must take to keep such systems as secure as
possible.

When formal evaluations are undertaken, systems are usually
subjected to a two-step process:

1. The system is tested and a technical evaluation is performed to
make sure that the system’s security capabilities meet criteria laid
out for its intended use.

2. The system is subjected to a formal comparison of its design and

security criteria and its actual capabilities and performance, and
individuals responsible for the security and veracity of such
systems must decide whether to adopt them, reject them, or make
some changes to their criteria and try again.

Often trusted third parties are hired to perform such evaluations; the
most important result from such testing is their “seal of approval” that
the system meets all essential criteria.

You should be aware that TCSEC was repealed and

replaced by the Common Criteria (as well as many other DoD
directives). It is still included here as a historical reference and as
an example of static-based assessment criteria to offset the benefits
of dynamic (although subjective) assessment criteria. Keep in mind