| |
Functionally
Tested. Provides analysis of the security functions, using a
functional and interface specification of the TOE, to understand
the security behaviour. The analysis is supported by independent
testing of the security functions. |
| |
Structurally
Tested. Anaysis of the security functions using a functional
and interface specification and the high level design of the
subsystems of the TOE. Independent testing of the security functions,
evidence of developer "black box" testing, and evidence
of a development search for obvious vulnerabilities. |
| |
Methodically
Tested and Checked. The analysis is supported by "grey
box" testing, selective independent confirmation of the
developer test results, and evidence of a developer search for
obvious vulnerablitities. Development environment controls and
TOE configuration management are also required. |
| |
Methodically
Designed, Tested and Reviewed. Analysis is supported by the
low-level design of the modules of the TOE, and a subset of
the implementation. Testing is supported by an independent search
for obvious vulnerabilities. Development controls are supported
by a life-cycle model, identification of tools, and automated
configuration management. |
| |
Semiformally
Designed and Tested. Analysis includes all of the implementation.
Assurance is supplemented by a formal model and a semiformal
presentation of the functional specification and high level
design, and a semiformal demonstration of correspondence. The
search for vulnerabilities must ensure relative resistance to
penetration attack. Covert channel analysis and modular design
are also required. |
| |
Semiformally
Verified Design and Tested. Analysis is supported by a modular
and layered approach to design, and a structured presentation
of the implementation. The independent search for vulnerabilities
must ensure high resistance to penetration attack. The search
for covert channels must be systematic. Development environment
and configuration management controls are further strengthened.
|
| |
Formally Verified
Design and Tested. The formal model is supplemented by a formal
presentation of the functional specification and high level
design showing correspondence. Evidence of developer "white
box" testing and complete independent confirmation of developer
test results are required. Complexity of the design must be
minimised. |
