Penetration testing Malicious logic

Formal evaluation of systems Trust based on assurance evidence { a basis for condence { not a perfect security Helps creating secure systems Evaluation methodology features { set of requirements for a security functionality { set of assurance requirements to establish that system meets functional requirements { methodology for determining that system meets functional requirements based on analysis of the assurance evidence { measure for evaluation (level of trust) What evaluation guarantees? The system is perfectly secure { NOT! Lot of eort put on securing system { system evaluation { security documentation { development methodology)An expensive trill { cost of external evaluators { cost of own work Evaluated system is less likely to have problems 1 Evaluation history Originated from military and government Need for assurance in commerce { trustworthy contractors { information systems Legal requirements, liability { cover your back: it was certied. Many laws, like Sarbanes-Oxley and HIPAA in U.S., require organisations to act very carefully