National E-business Trust Infrastructure Evaluation Scheme

Building E-business trust infrastructure is a challenging task. The Web poses some trust issues that most users are rarely aware of, and business should at the most consider liabilities and necessary efforts to minimize risks. However, issues related to control, IT auditing and IT security test and evaluation procedures and mechanisms have never been addressed in a clear text in Turkey. This paper presents a fundamental approach to a National Common Methodology for Information Security Evaluation (CEM) Scheme. A multinational supported common methodology has already been developed in several works. Similar to this, the methodology presented here is mainly based on ISO/IEC 15408 and Common Criteria for Information Technology Security Evaluation (CC). Unfortunately, due to lack of governmental policy and unforeseen technological standards regarding IT and IT security test and evaluation, we will customarily concentrate on practical approaches rather than presenting solutions to accomplish full compliance with the CC. We hope that this work will initate a nationwide formal awareness program, serve as the basis to establish IT security test and evaluation facilities and formal regulations, and to assure confidence in IT consumer relations.