用通用标准定义安全需求：应用、采用和挑战
Defining Security Requirements with the Common Criteria: Applications, Adoptions, and Challenges
摘要：
新兴的信息和通信技术（信通技术）的进步推动了可能性的界限，并为创新的信通技术产品和服务开辟了新的市场。采用具有安全特性的信通技术产品和系统取决于消费者和市场对安全功能的信心，以及适用于这些产品的保证措施是否符合固有的安全要求。这种信心和信任主要通过严格制定安全要求、验证标准、评估和认证来获得。信息技术安全评估通用标准（Common Criteria for Information Technology Security Evaluation，简称CC）是一个网络安全认证的国际标准（ISO/IEC 15408）。在本文中，我们对CC标准及其采用进行了系统的回顾。采用CC的障碍也调查的基础上分析当前的安全评估趋势。具体而言，我们分享通过最近的澳大利亚网络标准评估（DACCA）项目的发展所获得的经验和教训，该项目在ICT安全产品的规范，开发，评估，认证和批准，采购和部署方面促进了CC的利益相关者。介绍了制定保护配置文件的最佳实践、建议以及可信网络安全发展的未来方向。
英文摘要：
Advances of emerging Information and Communications Technology (ICT) technologies push the boundaries of what is possible and open up new markets for innovative ICT products and services. The adoption of ICT products and systems with security properties depends on consumers' confidence and markets' trust in the security functionalities and whether the assurance measures applied to these products meet the inherent security requirements. Such confidence and trust are primarily gained through the rigorous development of security requirements, validation criteria, evaluation, and certification. Common Criteria for Information Technology Security Evaluation (often referred to as Common Criteria or CC) is an international standard (ISO/IEC 15408) for cyber security certification. In this paper, we conduct a systematic review of the CC standards and its adoptions. Adoption barriers of the CC are also investigated based on the analysis of current trends in security evaluation. Specifically, we share the experiences and lessons gained through the recent Development of Australian Cyber Criteria Assessment (DACCA) project that promotes the CC among stakeholders in ICT security products related to specification, development, evaluation, certification and approval, procurement, and deployment. Best practices on developing Protection Profiles, recommendations, and future directions for trusted cybersecurity advancement are presented.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
