An investigation of CC´s contribution to confidence in security

To facilitate the availability of commercial computer products with sufficient security, excellent evaluation criteria have to be of the potential to drive the course of the security marketplace. The newness and the lack of experiences in the exercise of the Common Criteria (CC), which was adopted in 1999 as an international standard for security product evaluation, make it imperative that efforts be exerted to investigate the prospective influence of the CC in advancing the state of computer security. The paper casts light on the contribution of the CC to establishing confidence in security, which is still a barren land in need of cultivation. A picture of the process of the work to produce a security product is outlined. The roles each part of the work may play in obtaining confidence are examined. In practice, a research experiment is carried out aiming at building a secure operating system in accordance with the CC philosophy