CC기반에서 보증수준 및 제품유형을 동시에 고려한 평가업무량 모델

Abstract

Common Criteria(CC, ISO/IEC 15408) is an international standard for evaluation of Information Security Systems(ISS). There need a suitable evidence of estimation of evaluation cost in an evaluation facility under the CC-based evaluation and assurance scheme. In this paper, we propose an evaluation effort model, which is based not only on assurance-level but also on product-type of ISS, by means of real experience of real evaluators, use-ratio concept and the Function Point of security function. The model is based not on a real evaluation environment of evaluation facility, but on CC, public PPs and product specific STs. Our result might be used as a basic model for estimation of evaluation cost and time of ISS in an CC-based evaluation and assurance scheme.