|Reference||P-ISO/IEC/TR 15443-1 ed1.0 withdrawn corrigendum||
|Title||Information technology - Security techniques - A framework for IT security assurance - Part 1: Overview and framework|
|Abstract||ISO/IEC TR 15443 is a multi-part type 3 Technical Report to guide the IT security professional in the selection of an appropriate assurance method when specifying, selecting, or deploying a security service, product, or environmental factor such as an organization or personnel (known as a deliverable). The aim is to understand the assurance type and amount required to achieve confidence that the deliverable satisfies the stated IT security assurance requirements and consequently its security policy.
ISO/IEC TR 15443-1:2005 describes the fundamentals of security assurance and its relation to other security concepts. This is to clarify why security assurance is required and dispel common misconceptions such as that increased assurance is gained by increasing the strength of a security mechanism. The framework includes a categorization of assurance types and a generic lifecycle model to identify the appropriate assurance types required for the deliverable with respect to the deliverable's lifecycle. The model also demonstrates how security assurance must be managed throughout the deliverable's lifecycle requiring assurance decisions to be made by several assurance authorities for the lifecycle stage relevant to their organization (i.e. developer, standards, consumer). The framework has been developed to be general enough to accommodate different assurance types and map into any lifecycle approach so as not to dictate any particular design. Advanced security assurance concepts, such as combining security assurance methods, are addressed briefly as they are to be addressed in later parts of ISO/IEC TR 15443.
ISO/IEC TR 15443 targets IT security managers and other security professionals responsible for developing a security assurance program, engineering security into a deliverable, determining the security assurance of their deliverable, entering an assurance assessment audit (e.g. ISO 9000, SSE-CMM (ISO/IEC 21827), ISO/IEC 15408-3), or other assurance activities.
|Technical Committee||JTC 1/SC 27 - IT security techniques|
Quick access by ref. number
|Your basket is empty|
|Accepted credit cards:|
|Prices in CHF (Swiss francs)|
|Request a pro forma to pay by bank transfer or cheque|
|Learn how to share your publications with your colleagues, using networking options|
- IECEE INDA-DB-12M Ed. 1.0
- IEC 61400-1 Ed. 3.1
- ISO/IEC 14776-251 Ed. 1.0
- Project IEC 62841-3-9 Ed. 1.0
- Project IEC 61784-1 Ed. 4.0
- Project IEC 61784-2 Ed. 3.0
- Project IEC 62485-3 Ed. 2.0