Tag Archive for: Common Criteria

Janine Wolff

SRC and DAkkS accred­i­tation according to ISO/IEC EN 17025: An important step towards EUCC

SRC Security Research & Consulting GmbH kann einen weiteren bedeu­tenden Erfolg verze­ichnen: Die erfol­greiche Akkred­i­tierung durch die Deutsche Akkred­i­tierungsstelle (DAkkS) nach DIN EN ISO/IEC 17025. Dieser Schritt unter­streicht nicht nur die Kompetenz und Zuver­läs­sigkeit unseres Prüflabors für Common Criteria (CC), sondern bereitet uns auch auf die Einführung der EUCC (European Common Criteria) vor, eine wichtige Entwicklung in der europäischen Cybersicherheitslandschaft.

Bedeutung der DAkkS-Akkreditierung

Die Akkred­i­tierung nach DIN EN ISO/IEC 17025 ist ein klares Zeichen für die Profes­sion­alität und den Anspruch von SRC, erstk­lassige Prüfdi­en­stleis­tungen anzubieten. Sie bestätigt, dass unser CC-Prüflabors den inter­na­tional anerkannten Standards entspricht und vertrauenswürdige, konsis­tente Ergeb­nisse liefert.

Vorbere­itung auf die EUCC

Die EUCC stellt das auf den Common Criteria basierende europäische Zerti­fizierungss­chema dar, soll die Sicher­heit­sz­er­ti­fizierung von IKT-Produkten in Europa verbessern. Mit unserer DAkkS-Akkred­i­tierung ist SRC nun bestens gerüstet, um die Heraus­forderungen der EUCC zu meistern und eine führende Rolle in der IT-Sicher­heit­sz­er­ti­fizierung in Europa zu übernehmen. Die EUCC erweitert die Anforderungen der bisherigen Common Criteria und wird künftige Zerti­fizierungen in der EU grundlegend prägen.

Unser Engagement für Qualität und Genauigkeit

Mit dieser Akkred­i­tierung demon­striert SRC sein Engagement für höchste Qualitäts­stan­dards und Unparteilichkeit in unseren Labortätigkeiten. Wir sind stolz darauf, diesen Meilen­stein erreicht zu haben und freuen uns darauf, unseren Kunden weiterhin Dienstleis­tungen auf höchstem Niveau anzubieten.

Bei weiteren Fragen stehen unser Sales-Team Ihnen jederzeit zur Verfügung!

Homepage Admin

BSI publishes CC certifi­cates of connectors in the healthcare sector

Within the framework of the gematik telem­atics infra­structure, a connector coordi­nates and encrypts the commu­ni­cation between the client system, eGK, HBA/SMC and the central telem­atics infra­structure. It thus repre­sents the link between these compo­nents on the decen­tralised service provider side and the central telem­atics infrastructure.

A connector fulfils security require­ments that have been laid down in corre­sponding protection profiles.

The connector in product type version 3 comprises the following components:

  • the network connector,
  • the appli­cation connector including a signature application,
  • the specialised modules “Versicherten­stam­m­daten­man­agement” (VSDM), “Notfall­daten­man­agement” (NFDM) and “Arneimitteltherapiesicherheit/elektr. Medika­tion­splan” (AMTS/eMP).

SRC has success­fully evaluated the network and appli­cation connector in product type version 3 of the company Research Indus­trial Systems Engineering (RISE) Forschungs‑, Entwick­lungs- und Großpro­jek­t­ber­atung GmbH. The certifi­cates BSI-DSZ-CC-1052-V3-2021 and BSI-DSZ-CC-1132–2021 have been published by the BSI.

In addition SRC has success­fully evaluated the network and appli­cation connector in product type version 3 of the company secunet Security Networks AG. The certifi­cates BSI-DSZ-CC-1044-V3-2020 and BSI-DSZ-CC-1135–2020 have been published by the BSI.

For questions about Common Criteria or other evalu­a­tions, please contact us.

IT Security Congress 2019
Homepage Admin

IT-Security Congress 2019 — Arne Schönbohm welcomes SRC

The IT-Security Congress 2019 again offered SRC the platform for dialogues with manufac­turers, partners and repre­sen­ta­tives of public author­ities. The motto of the event was “IT security as a prereq­uisite for successful digiti­zation”. The topics are as varied as the visitors: artificial intel­li­gence and its fields of appli­cation, Common Criteria certi­fi­ca­tions of micro-kernel operating systems and profes­sional perspec­tives for scien­tists and computer scien­tists at SRC. Almost all SRC services were in demand at the stand, whether penetration tests, consulting and certi­fi­cation of infor­mation security management systems or support for product manufac­turers in evalu­a­tions according to Common Criteria.

Sandro Amendola’s lecture at the IT-Security Congress 2019, entitled “Legal Security Require­ments for Payment Proce­dures for Customer Authen­ti­cation Using Mobile Devices”, was widely discussed. The high pace of innovation on the one hand and the parallel devel­opment of regulatory require­ments on the other hand provide continuous material for discus­sions and forecasts of future trends.

The host of the IT-Security Congress 2019, the Federal Office for Infor­mation Security (BSI) (see photo), also stopped by our stand. Thilo Pannen is respon­sible for Business Devel­opment at SRC. “We at SRC are delighted that we have been able to support the BSI for many years with a range of experts,” said Thilo Pannen in his welcoming address. The extensive discussion with BSI President Arne Schönbohm touched all aspects of the extensive cooper­ation with the BSI. Be it the prepa­ration of studies, the support in the various BSI projects or the work of SRC as a BSI-recog­nized testing laboratory. In its function as a testing laboratory, SRC does not only assess according to Common Criteria. The require­ments for the technical domains “Smart­cards and similar Devices” and “Hardware Devices with Security Boxes” are also fulfilled by SRC.
Such extensive and complex cooper­ation in such a dynamic environment requires constant adaptation of the processes. “If we at BSI can contribute to further good cooper­ation, please let me know,” said the BSI President at the end of his visit to the SRC stand.

Janine Wolff

SRC contributes to the German IT Security Congress 2019

IT security as a prereq­uisite for successful digitalisation

This is the motto of this year’s German IT Security Congress, which is held every two years by the Federal Office for Infor­mation Security (BSI). The congress will take place from 21 to 23 May 2019 at the Stadthalle Bonn — Bad Godesberg. The aim of this year’s congress is to examine the topic of IT security from different perspec­tives, to present and further develop possible solutions.

SRC is at the German IT Security Congress

As a BSI-approved evalu­ation body for evalu­a­tions according to Common Criteria (CC) and various other technical guide­lines, SRC will also be present with a booth at the German IT Security Congress in 2019. Thus we offer the experts of customers, partners and those of the BSI once again the well-estab­lished contact point at the German IT Security Congress. This concept has proven itself over many years. The stable personal network between the partic­i­pants offers the optimal platform for the transfer of complex technical and regulatory aspects.

SRC expert Sandro Amendola talks about compliance, mobile payment proce­dures and customer authentication

The triumphal march of mobile payment proce­dures seems unstop­pable. The legis­lator has also inten­sively considered the security of these proce­dures and the necessary customer authen­ti­cation. Sandro Amendola will talk about “Legal security require­ments for payment proce­dures for customer authen­ti­cation using mobile devices” on Thursday, 23 May 2019 at 11:00 a.m. in the main hall.

Aspects of Common Criteria Certifications
Janine Wolff

Aspects of Common Criteria Certi­fi­ca­tions — Guest lecture at the Vienna University of Technology

Aspects of Common Criteria Certi­fi­ca­tions — this is the topic of the lecture that the experts of the SRC evalu­ation body for Common Criteria will address at the Vienna University of Technology. The lecture will take place on 10 May 2019 as part of the lecture IT Security in Large IT Infra­struc­tures at the Institute of Infor­mation Systems Engineering.

Common Criteria in science

With the help of Common Criteria for Infor­mation Technology Security Evalu­ation (CC), IT products can be evaluated regarding their security according to general criteria. As an inter­na­tionally recog­nised standard, Common Criteria is of interest to the scien­tific world. Initially, an evalu­ation is carried out by an evalu­ation body accredited by the German Federal Office for Infor­mation Security (BSI). SRC is accredited as such a CC evalu­ation body. The BSI then carries out the certification.

Guest lecture for students

The SRC experts will discuss the Aspects of Common Criteria Certi­fi­ca­tions at first hand. The lecture informs the students about the basic approach for product certi­fi­ca­tions according to Common Criteria. Infra­struc­tures in the European Union that rely on Common Criteria certi­fi­cation will be highlighted. The formal side including the respon­sible certi­fi­cation and recog­nition bodies will also be considered. The comparison of Common Criteria with other concepts concludes the lecture. Certi­fi­ca­tions according to technical guide­lines of the BSI, ISO27001 or the criteria of the Payment Card Industry (PCI) will be considered.

International Common Criteria Conference
Janine Wolff

SRC gives lecture on JTEMS at the Inter­na­tional Common Criteria Conference in Amsterdam

From 30 October to 1 November, the 17th Inter­na­tional Common Criteria Conference will take place in Amsterdam. The Inter­na­tional Common Criteria Conference is presented with the support of the Common Criteria User Forum (CCUF). The CCUF provides a voice and commu­ni­cation channel between the CC community and the organ­ising committees of the Common Criteria, CCRA member organ­i­sa­tions (national programmes) and policy makers.

SRC will also actively partic­ipate in this year’s conference. In a presen­tation by our expert Sven-Martin Hühne on the topic “JTEMS — a Payment Scheme Independent Framework for POI Terminal specific Security Evalu­a­tions based on Common Criteria” the JTEMS Framework is presented and the current “state of affairs” is explained. The presen­tation deals with the advan­tages of a CC-based and Payment Scheme independent evalu­ation and certi­fi­cation procedure for POI terminals. The framework is a living example of the active use of the CC method by inter­ested parties from the private sector (German banking industry and UK Finance or Common.SECC). The possi­bility of embedding the JTEMS framework in current discus­sions of the EU Commission for a “European Security Certi­fi­cation Scheme” will also be discussed.

In the panel discussion “The Why and How of Using CC in Private Schemes”, Regine Quent­meier discusses these aspects from the point of view of users from the European banking industry in an exchange with repre­sen­ta­tives of other economic sectors.

EMVCo certification
Janine Wolff

SRC’s ITSEF laboratory receives extended EMVCo certification

SRC’s certified Common Criteria security laboratory has recently been enriched by another EMVCo certi­fi­cation. The SRC laboratory has long been approved by the German Federal Office for Infor­mation Security (BSI) for the evalu­ation of hardware and software evalu­a­tions for smart cards and similar devices. After SRC has now success­fully evaluated chip hardware of a well-known and also EMVCo certified manufac­turer, EMVCo confirmed the certi­fi­cation of the SRC security laboratory as EMVCo Security Evalu­ation IC laboratory, which is now also listed as such on the EMVCo website, following a review of the latest findings provided within the scope of an IC security evalu­ation project.

Further infor­mation on the certi­fi­ca­tions for SRC by EMVCo can be found here.

Tag Archive for: Common Criteria