Раздел: Документация

0 ... 17 18 19 20 21 22 23 ... 73

6 Evaluation assurance levels

The Evaluation Assurance Levels (EALs) provide an increasing scale that balances the level of assurance obtained with the cost and feasibility of acquiring that degree of assurance. The ISO/IEC 15408 approach identifies the separate concepts of assurance in a TOE at the end of the evaluation, and of maintenance of that assurance during the operational use of the TOE.

It is important to note that not all families and components from ISO/IEC 15408-3 are included in the EALs. This is not to say that these do not provide meaningful and desirable assurances. Instead, it is expected that these families and components will be considered for augmentation of an EAL in those PPs and STs for which they provide utility.

6.1Evaluation assurance level (EAL) overview

Table 6.1 represents a summary of the EALs. The columns represent a hierarchically ordered set of EALs, while the rows represent assurance families. Each number in the resulting matrix identifies a specific assurance component where applicable.

As outlined in the next subclause, seven hierarchically ordered evaluation assurance levels are defined in ISO/IEC 15408 for the rating of a TOEs assurance. They are hierarchically ordered inasmuch as each EAL represents more assurance than all lower EALs. The increase in assurance from EAL to EAL is accomplished by substitution of a hierarchically higher assurance component from the same assurance family (i.e. increasing rigour, scope, and/or depth) and from the addition of assurance components from other assurance families (i.e. adding new requirements).

These EALs consist of an appropriate combination of assurance components as described in clause 2 of this part of ISO/IEC 15408. More precisely, each EAL includes no more than one component of each assurance family and all assurance dependencies of every component are addressed.

While the EALs are defined in ISO/IEC 15408, it is possible to represent other combinations of assurance. Specifically, the notion of "augmentation" allows the addition of assurance components (from assurance families not already included in the EAL) or the substitution of assurance components (with another hierarchically higher assurance component in the same assurance family) to an EAL. Of the assurance constructs defined in ISO/IEC 15408, only EALs may be augmented. The notion of an "EAL minus a constituent assurance component" is not recognised by the standard as a valid claim. Augmentation carries with it the obligation on the part of the claimant to justify the utility and added value of the added assurance component to the EAL. An EAL may also be extended with explicitly stated assurance requirements.

6.2Evaluation assurance level details

The following subclauses provide definitions of the EALs, highlighting differences between the specific requirements and the prose characterisations of those requirements using bold type.

---

Table 6.1 - Evaluation assurance level summary

Assurance Class	Assurance Family	Assurance Components by Evaluation Assurance Level
		EAL1	EAL2	EAL3	EAL4	EAL5	EAL6	EAL7
Configuration management	ACMAUT				1	1	2	2
	ACMCAP	1	2	3	4	4	5	5
	ACMSCP			1	2	3	3	3
Delivery and operation	ADODEL		1	1	2	2	2	3
	ADOIGS	1	1	1	1	1	1	1
Development	ADV FSP	1	1	1	2	3	3	4
	ADVHLD		1	2	2	3	4	5
	ADVIMP				1	2	3	3
	ADVENT					1	2	3
	ADVLLD				1	1	2	2
	ADV RCR	1	1	1	1	2	2	3
	ADVSPM				1	3	3	3
Guidance documents	AGDADM	1	1	1	1	1	1	1
	AGDUSR	1	1	1	1	1	1	1
Life cycle support	ALC DVS			1	1	1	2	2
	ALC FLR
	ALC LCD				1	2	2	3
	ALC TAT				1	2	3	3
Tests	ATE COV		1	2	2	2	3	3
	ATE DPT			1	1	2	2	3
	ATE FUN		1	1	1	1	2	2
	ATE IND	1	2	2	2	2	2	3
Vulnerability assessment	AVA CCA					1	2	2
	AVA MSU			1	2	2	3	3
	AVA SOF		1	1	1	1	1	1
	AVA VLA		1	1	2	3	4	4

---

Assurance class	Assurance components
configuration management	ACMCAP.l Version numbers
Delivery and operation	ADOIGS.l Installation, generation, and start-up procedures
Development	ADVFSP.l Informal functional specification
	ADV RCR.l Informal correspondence demonstration
Guidance documents	AGD ADM.l Administrator guidance
	AGD USR.l User guidance
Tests	ATEIND.l Independent testing - conformance

Objectives

EAL1 is applicable where some confidence in correct operation is required, but the threats to security are not viewed as serious. It will be of value where independent assurance is required to support the contention that due care has been exercised with respect to the protection of personal or similar information.

EAL1 provides an evaluation of the TOE as made available to the customer, including independent testing against a specification, and an examination of the guidance documentation provided. It is intended that an EAL1 evaluation could be successfully conducted without assistance from the developer of the TOE, and for minimal outlay.

An evaluation at this level should provide evidence that the TOE functions in a manner consistent with its documentation, and that it provides useful protection against identified threats.

Assurance components

EALl (see Table 6.2) provides a basic level of assurance by an analysis of the security functions using a functional and interface specification and guidance documentation, to understand the security behaviour.

The analysis is supported by independent testing of the TOE security functions.

This EAL provides a meaningful increase in assurance over an unevaluated IT product or

system.

Table 6.2 - EALl

0 ... 17 18 19 20 21 22 23 ... 73