-
ISO 15408 ("Common Criteria")
The International Organization for Standardization (ISO) has
produced ISO standard IS 15408. This standard, The Common
Criteria for Information Technology Security Evaluation v2.1 (ISO
IS 15408) is effectively an evolutionary blending of
ITSEC (see below), the Canadian criteria, and the US
Federal Criteria.
It available from
http://csrc.nist.gov/cc/ccv20/ccv2list.htm.
-
Rainbow Series ("Orange Book") (US)
An important series of documents are the Rainbow Series, which
outline a number of security standards developed in the United
States. This series is available at
http://www.radium.ncsc.mil/tpep/library/rainbow/.
Perhaps the most important of these books is the Trusted
Computer System Evaluation Criteria (TCSEC, or
Orange Book). While this standard has effectively been
superseded by other standards outlined above (it is dated 1985),
it is nevertheless a useful document. A further document, the
US Federal Criteria, was drafted but not adopted in the
early 1990's.
TCSEC can be found at
http://www.radium.ncsc.mil/tpep/library/rainbow/5200.28-STD.html
-
Information Technology Security Evaluation Criteria ("ITSEC") (UK)
The United Kingdom produced the Information Technology
Security Evaluation Criteria (ITSEC) in the early
1990's, and this is another important historical evaluation
scheme/standard. It builds on the Orange Book scheme to
some extent, with greater granularity.
Details about the scheme are available at http://www.itsec.gov.uk/.