The Information Technology Security Evaluation Criteria (ITSEC) is a structured set of criteria for evaluating computer security within products and systems. The ITSEC was first published in May 1990 in

France France (), officially the French Republic ( ), is a country primarily located in Western Europe. It also comprises of Overseas France, overseas regions and territories in the Americas and the Atlantic Ocean, Atlantic, Pacific Ocean, Pac ...

Germany Germany,, officially the Federal Republic of Germany, is a country in Central Europe. It is the second most populous country in Europe after Russia, and the most populous member state of the European Union. Germany is situated betwe ...

, the

Netherlands ) , anthem = ( en, "William of Nassau") , image_map = , map_caption = , subdivision_type = Sovereign state , subdivision_name = Kingdom of the Netherlands , established_title = Before independence , established_date = Spanish Netherl ...

, and the

United Kingdom The United Kingdom of Great Britain and Northern Ireland, commonly known as the United Kingdom (UK) or Britain, is a country in Europe, off the north-western coast of the continental mainland. It comprises England, Scotland, Wales and North ...

based on existing work in their respective countries. Following extensive international review, Version 1.2 was subsequently published in June 1991 by the

Commission of the European Communities The European Commission (EC) is the executive of the European Union (EU). It operates as a cabinet government, with 27 members of the Commission (informally known as "Commissioners") headed by a President. It includes an administrative body o ...

for operational use within evaluation and certification schemes. Since the launch of the ITSEC in 1990, a number of other European countries have agreed to recognize the validity of ITSEC evaluations. The ITSEC has been largely replaced by

Common Criteria The Common Criteria for Information Technology Security Evaluation (referred to as Common Criteria or CC) is an international standard (ISO/IEC 15408) for computer security certification. It is currently in version 3.1 revision 5. Common Criteria ...

, which provides similarly-defined evaluation levels and implements the target of evaluation concept and the Security Target document.

Concepts

The product or system being evaluated, called the ''target of evaluation'', is subjected to a detailed examination of its security features culminating in comprehensive and informed functional and penetration testing. The degree of examination depends upon the level of confidence desired in the target. To provide different levels of confidence, the ITSEC defines ''evaluation levels'', denoted E0 through E6. Higher evaluation levels involve more extensive examination and testing of the target. Unlike earlier criteria, notably the

TCSEC Trusted Computer System Evaluation Criteria (TCSEC) is a United States Government Department of Defense (DoD) standard that sets basic requirements for assessing the effectiveness of computer security controls built into a computer system. The TCS ...

developed by the US defense establishment, the ITSEC did not require evaluated targets to contain specific technical features in order to achieve a particular assurance level. For example, an ITSEC target might provide authentication or integrity features without providing confidentiality or availability. A given target's security features were documented in a ''Security Target'' document, whose contents had to be evaluated and approved before the target itself was evaluated. Each ITSEC evaluation was based exclusively on verifying the security features identified in the Security Target.

Use

The formal

Z notation The Z notation is a formal specification language used for describing and modelling computing systems. It is targeted at the clear specification of computer programs and computer-based systems in general. History In 1974, Jean-Raymond Abrial ...

was used to prove security properties about the

Mondex Mondex was a smart card electronic cash system, implemented as a stored-value card and owned by Mastercard. Pioneered by two bankers from NatWest in 1990, it was spun-off to a separate consortium later on, then sold again to Mastercard. Mond ...

smart card electronic cash system, allowing it to achieve ITSEC level E6, the highest granted security-level classification. Jim Woodcock, Susan Stepney, David Cooper, John Clark, and Jeremy Jacob
The certification of the Mondex electronic purse to ITSEC Level E6
''

Formal Aspects of Computing ''Formal Aspects of Computing'' (''FAOC'') is a peer-reviewed scientific journal published by Springer Science+Business Media, covering the area of formal methods and associated topics in computer science. The editors-in-chief are Jim Woodcock and ...

'', Volume 20, Number 1, pages 5–19, January 2008.

References

Bibliography

* {{Cite web , author=ITSEC , title=Information Technology Security Evaluation Criteria (ITSEC): Preliminary Harmonised Criteria , publisher=Commission of the European Communities , date=June 1991 , version=Document COM(90) 314, Version 1.2 , url=http://www.ssi.gouv.fr/site_documents/ITSEC/ITSEC-uk.pdf , access-date=2006-06-02 , url-status=dead , archive-url=https://web.archive.org/web/20060523094527/http://www.ssi.gouv.fr/site_documents/ITSEC/ITSEC-uk.pdf , archive-date=2006-05-23 Computer-related introductions in 1990 Computer security accreditations Computer security standards