Open Source Systems Security Certification

ISBN-13: 9781441945907 / Angielski / Miękka / 2010 / 204 str.

Ernesto Damiani; Claudio Agostino Ardagna; Nabil El Ioini

Opis

Open Source Advances in Computer Applications book series provides timely technological and business information for: Enabling Open Source Systems (OSS) to become an integral part of systems and devices produced by technology companies; Inserting OSS in the critical path of complex network development and embedded products, including methodologies and tools for domain-specific OSS testing (lab code available), plus certification of security, dependability and safety properties for complex systems; Ensuring integrated systems, including OSS, meet performance and security requirements as well as achieving the necessary certifications, according to the overall strategy of OSS usage on the part of the adopter. The first attempt to create a standard for security certification of software dates back to 1985 with the creation of the TCSEC standard, commonly referred to as Orange Book (USDoD 1985) in the US. In the following years, the need of such a certification also emerged in other countries, leading to the creation of similar local security certification such as ITSEC in Europe (ITSEC 1991) and CTCPEC in Canada (CSE 1993). Since these certifications are totally independent from each other, the cost of certifying software at an international level was obviously high. This was one of the key factors that led to the creation of an international standard for software security certification. Open Source Systems Security Certification discusses Security Certification Standards and establishes the need to certify open source tools and applications. This includes the international standard for the certification of IT products (software, firmware and hardware) Common Criteria (ISO/IEC 15408) (CC 2006), a certification officially adopted by the governments of 18 nations, including United States, Germany, France, UK and Italy. Without security certification, open source tools and applications are neither secure nor trustworthy. Open Source Systems Security Certification also addresses and analyzes the urgency of security certification for security-sensible markets, such as telecommunications, government and the military through provided case studies. Open Source Systems Security Certification is designed for professionals, consultants and companies trying to implement an OSS-aware IT governance strategy, SMEs looking for a way to attract new markets traditionally held by proprietary products (e.g., network security and operation centers, Linux-based network switching systems) or to reduce costs. OSS development communities wishing to ensure their products become part of dynamically composed complex systems will find this volume invaluable. This book is also suitable for researchers and advanced-level students in computer science.

Spis treści

Basic Notions on Access Control.- Test based security certifications.- Formal methods for software verification.- OSS security certification.- Case Study 1: Linux certification.- Case Study 2: ICSA and CCHIT Certifications.- The role of virtual testing labs.- Long-term OSS security certifications: An Outlook.

O autorze

Ernesto Damiani is a professor at the Department of Information Technology of the University of Milan. He is the Vice-Chair of the ACM Special Interest Group on Applied Computing (SIGAPP).

Blurb

Open Source Systems Security Certification provides an introduction to the notion of the Security Certification, including test-based and model-based approaches to the certification of software products. Several Security Certification standards are presented, including the international standard for the certification of IT products Common Criteria (ISO/IEC 15408) (CC 2006), a certification officially adopted by the governments of 18 nations.

This book discusses Security Certification as a way to foster adoption and deployment of Open Source Software (OSS) in security-sensible markets, such as telecommunications, government and the military. Scientific and technical issues of OSS security certification are highlighted through case studies.

This volume is designed for professionals and companies trying to implement an Open Source Systems (OSS) aware IT governance strategy, and SMEs looking for ways to use OSS in order to enter new security-conscious markets traditionally held by proprietary products. This book is also suitable for researchers and advanced-level students interested in OSS development, deployment and adoption issues.