Method of identification the functional security profile

Abstract

The standard functional security profile is a list of the minimum required levels of services that a set of security features of a computer system of an automated system must implement in order to correctly meet certain security requirements for information processed in this automated system. Standard security facilities do not require any security policies or guarantees, although they are permissible if necessary. The computer system security policy implementing the standard profile must reflect the relevant regulatory requirements that set requirements for the processing of information on automated systems. The only requirement for the creation of new profiles is compliance with the prerequisites described in regulatory requirements for each of the services included in the profile. Functional security profiles can also be used to benchmark computer system functionality against national criteria and other countries. Thus, there is a need to create a method that will automate the process of generating a functional security profile and verify its correctness with respect to protection functions (security services) and guarantees. To solve this problem, we propose a method for identifying the functional security profile, which is due to the formation procedure: sets of primary and secondary functional security services; sets of combining primary and secondary functional security services into a functional security profile; sets of order by element indices; the basic functional security profile allowed to formalize the process of generating a functional security profile and verification by an expert of his requirements regarding security functions (security services) and guarantees. Next, we need to develop an information system that would automate the process of generating the functional security profile and verifying its requirements for security features (security services) and guarantees.