A Perspective of the Common Criteria in Modern IT Business

In the late 1980s and 1990s, the rise in the need for increasingly sophisticated security in information systems led to the creation of standards such as TCSEC, ITSEC and CTCPEC to aid in the assessment of security products for their suitability in the protection of national security. These standards have evolved into the Common Criteria: a set of fundamental principles with a basis in best practice and experience, against which products may be evaluated to establish a variety of levels of confidence in those products. However, such models are no longer the sole domain of Defence systems: government and commercial organisations are also under pressure to deploy more mature technology to ensure the security of their information assets. This paper examines the impact of the Common Criteria model on business practice and strategy and considers the ways in which both business and the information technology industry may develop in the near future.