When reading something dealing with Common Criteria for Information Technology Security Evaluation it is clear where ABC_DEF-type acronyms come from - they are thoroughly described in parts 2 and 3.
But where do Threats, Policy, Assumption (T.[SOMETHING], P.[SOMETHING], A.[SOMETHING_ELSE] and O.[SOMETHING]-type stuff) and their details come from? Is there a comprehensive list or do people just write anything they want in there?
According to the specification, these have no predefined list. These are defined as required for the situation.
A.6.2 Threats
291 This section of the security problem definition shows the threats that are to be countered by the TOE, its operational environment, or a combination of the two.
292 A threat consists of a threat agent, an asset and an adverse action of that threat agent on that asset.
293 Threat agents are entities that can adversely act on assets. Examples of threat agents are hackers, users, computer processes, TOE development personnel, and accidents. Threat agents may be further described by aspects such as expertise, resources, opportunity and motivation.
294 Threat agents may be described as individual entities, but in some cases it may be better to describe them as types of entities, groups of entities etc.
295 Examples of assets can be found in Section 7.1.
296 Adverse actions are actions performed by a threat agent on an asset. These actions influence one or more properties of an asset from which that asset derives its value.
297 Examples of threats are:
− a hacker (with substantial expertise, standard equipment, and being paid to do so) remotely copying confidential files from a company network;
− a worm seriously degrading the performance of a wide-area network;
− a system administrator violating user privacy;
− Someone on the Internet listening in on confidential electronic communication.
Most of the time SPD (Security Problem Definition) that includes Threats and Assumptions is copied in its entirety from a PP (Protection Profile). It is only in cases when ST-only (i.e. no PP claims) evaluation is conducted is when you define your own Threats, Assumptions and Objectives. There are some rules for defining and mapping these, but existing CCv3.1R5 rules and evaluation activities are not sufficient to ensure coherent SPD. In general terms, in such situations CC practitioners are more concerned that these correctly map to each other than with what they actually say.
