Web Commerce Security Design and Development

Standards and Related Guidance

The U.S. government has developed a number of approaches to certification and accreditation to ensure that an information system has met all of its security requirements prior to becoming operational. These documents, although developed for the U.S. Department of Defense (DoD) and other government agencies, provide excellent C&A guidance and can be effectively applied to Web commerce, as well as to other commercial and industrial information systems.

Some of the major C&A documents are summarized in the following sections.

Trusted Computer System Evaluation Criteria

The DoD issued the Trusted Computer System Evaluation Criteria (TCSEC), DoD 5200.28-STD in December 1985. Commonly referred to as the Orange Book, it provided computer security guidance for Automated Information Systems (AISs). The Orange Book was then followed by the Trusted Network Evaluation Criteria, The White Book. TCSEC has been replaced by the Common Criteria.

Common Criteria ISO/IEC 15408

TCSEC and other international evaluation criteria have evolved into one set of evaluation criteria called the Common Criteria. The initial version of the Common Criteria, Version 1.0, was completed in January 1996. Based on a number of trial evaluations and an extensive public review, Version 1.0 was extensively revised and Version 2.0 was produced in April of 1998. The latest version, version 3.1, revision 3, was finalized in July of 2009.

In the second revision, the Common Criteria was aligned ...