A Study on the Secure Software Development Life Cycle for Common Criteria (CC) Certification

Abstract

Common Criteria (CC) is a global standard for the information technology security evaluation of IT products. IT products must obtain at least a certain Evaluation Assurance Level (EAL) to be supplied to governmental institutions. The general software development life cycle (SDLC) does not provide guidelines for the removal of the weaknesses in the software development process for CC certification, and software applications developed with security weaknesses that have not been removed can lead to fatal situations. At present, CC provides only security certification for the target of evaluation (TOE) and does not provide guidelines regarding the secure software development life cycle (SSDLC), which considers the weaknesses in the development process. If a TOE that has been specialized for CC is developed by SSDLC, both evaluators and developers can undertake CC certification from an objective standpoint. This paper presents an SSDLC that is appropriate for CC by discerning weaknesses, by referring to MS-SDL, McGraw’s TouchPoints, and OWASP CLASP based on the weaknesses provided by CWE (Common Weakness Enumeration). The findings of this study can be used as guidelines for the development process of weakness-free software applications by developers aiming for CC certification.