关键词: CC, CEM, 信息技术, 安全技术, 信息安全性评估认证

Abstract: The whole security of IT systems can be guaranteed only if it is designed, implemented, used, maintained according to some common standards. Therefore, the standardization of IT system security is always a common issue all over the world. CC and CEM are a pair of ISO-NIEC international standards for information security evaluation and certification. CC and CEM establish a trustworthy relationship with common basis among all stakeholders of the target system that is evaluated and certified, and therefore CC and CEM are widely used all over the world. However, evaluation and certification based on CC and CEM is very complex. Evaluation and certification process involves of tens of documents and tasks. Performing evaluation and certification process by human shall cost lots of time. Besides, it is also difficult to ensure that evaluation and certification is fair and no subjective mistakes. These issues not only may result in consuming a lot of time, but also may affect the correctness, accuracy, and fairness of evaluation and certification results. Thus, it is necessary to provide a supporting environment that supports all tasks related to the evaluation and certification process automatically to improve the quality of evaluation results，at the same time reduce the complexity of all evaluator and certifiers work. However, there is no such environment existing until now. This paper presents a supporting environment we are developing for IT system security evaluation and certification based on CC and CEM that provides comprehensive facilities to support the whole evaluation and certification process. This is the first supporting environment to support the whole security evaluation and certification process.

Key words: CC, CEM, information technology, security evaluation, information security evaluation and certification