Listen to this Post
Introduction:
In the world of cybersecurity certification, Common Criteria (CC) provides a framework for evaluating the security properties of IT products. A core concept often misunderstood is the “intermediate combination of security requirement components”—a definition that separates novices from experts and directly impacts how security targets and protection profiles are constructed. For professionals building or auditing secure systems, knowing that this role belongs to a Package (not a Protection Profile or Security Target) is critical for accurate compliance and risk assessment.
Learning Objectives:
- Define the four key Common Criteria constructs: Target of Evaluation (TOE), Protection Profile (PP), Package, and Security Target (ST).
- Explain why a Package serves as the only intermediate combination of security requirement components and how it enables modular reuse.
- Apply Package-based thinking to practical system hardening, using CLI tools to map security controls to CC components.
You Should Know:
- The Anatomy of a Common Criteria Package – From Theory to Command Line
A Package is defined in CC Part 1 as an intermediate combination of security requirement components (functional or assurance) that can be used as a building block. Unlike a full Protection Profile (which is implementation-agnostic) or a Security Target (which is product-specific), a Package is reusable and composable. To emulate Package-based control checking on a Linux system, you can use audit tools that map system settings to CC components.
Step‑by‑step guide to inspecting system security controls as if they were CC Packages:
On a Linux system, security requirements components (e.g., FDP_ACC.1 – Subset access control) can be loosely mapped to actual configurations. Use these commands to audit access control – treat each output as a “component” you might bundle into a Package.
List all SELinux Booleans (components of access control policy) sudo semanage boolean -l Audit file permissions against a hypothetical "Package" of strict DAC rules find /etc -type f -perm /o+w -ls 2>/dev/null Check if kernel security modules (a Package component) are active cat /sys/module/apparmor/parameters/enabled For AppArmor getenforce For SELinux
On Windows, use PowerShell to enumerate security policies as components:
Check User Rights Assignment (component of Package "Privilege Management") secedit /export /cfg C:\secpolicy.inf Get-Content C:\secpolicy.inf | Select-String "SeBackupPrivilege" List audit policies (components of assurance Package) auditpol /get /category:
What this does: Each command retrieves a low-level security requirement – like “only root can write to /etc” – which parallels a CC functional component. Grouping several such checks into a script creates your own operational “Package.”
- Protection Profile vs. Security Target vs. Package – Commands to Differentiate
Many confuse Protection Profiles (customer needs) with Security Targets (vendor claims). The Package sits in between as a pre‑assembled set of components. To practice this distinction, use version control and diff tools on real security documents.
Step‑by‑step guide to modeling CC artifacts with Git:
Assume you have three text files: PP_Enterprise_FW.txt, Package_AccessControl.txt, and ST_FirewallX.txt. Commands to see how a Package can be inherited:
Clone a repo that contains CC-like structured requirements git clone https://github.com/iadgov/Common-Criteria-Security-Requirements.git cd Common-Criteria-Security-Requirements Show differences between a Package and a PP diff packages/package_audit.yml profiles/pp_iot_gateway.yml
For Windows, use `findstr` to extract component identifiers from exported security templates:
Treat a security template as a Package, extract component IDs findstr /C:"FDP_" /C:"FAU_" C:\secpolicy.inf
Pro tip: A real PP never combines requirements arbitrarily – it references existing Packages (e.g., “Package for Basic Authentication”). When building your own security baseline (e.g., for cloud hardening), write it as a YAML list of components – that’s your Package.
- Building a Custom Security Package for Cloud Instance Hardening
Cloud misconfigurations occur when security controls are not bundled into reusable, evaluatable components. Use this exercise to create a Package of three functional components: identification, access control, and audit.
Linux commands to enforce a minimal Package (e.g., “Package_SSH_Hardened”):
Component: FIA_UAU.1 (User authentication before action) sudo sed -i 's/ChallengeResponseAuthentication yes/ChallengeResponseAuthentication no/' /etc/ssh/sshd_config sudo systemctl restart sshd Component: FDP_ACC.1 (Subset access control) sudo setfacl -m u:backup:r /etc/ssh/sshd_config Component: FAU_GEN.1 (Audit log generation) sudo auditctl -w /etc/ssh/sshd_config -p wa -k ssh_config_change sudo aureport -k Review audit records for this Package
Windows equivalent (PowerShell as Admin):
Component: FIA_UAU.1 – enforce MFA for administrators Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\System" -Name "EnableMFA" -Value 1 Component: FDP_ACC.1 – restrict RDP logon via local security policy New-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" -Value 1 Component: FAU_GEN.1 – enable PowerShell script block logging Set-ItemProperty -Path "HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging" -Name "EnableScriptBlockLogging" -Value 1
Verification: Test that the three components work as a bundle. If one fails (e.g., MFA not enforced), the entire Package is invalid – exactly how CC evaluations work.
- Common Criteria in API Security – Mapping JWTs and OAuth Scopes to CC Packages
API security can be described using CC’s component‑based language. A JWT validation mechanism can be decomposed into a Package of: `FIA_SOS.1` (verification of secrets), `FIA_UAU.5` (multiple authentication mechanisms), and `FCS_COP.1` (cryptographic operation). Use OpenSSL and `jq` to test these components.
Step‑by‑step command list for API Package validation:
Install JWT tool (Linux) sudo apt install jq Decode a JWT token to check algorithm (FCS_COP.1 – allowed crypto) jwt="eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.dozjgNryP4J3jVmMlOxaQag" echo $jwt | cut -d"." -f1 | base64 -d 2>/dev/null | jq . Verify signature strength (FIA_SOS.1) – check key length openssl rsa -in private.key -text -noout | grep "Private-Key" Test scope enforcement (simulate a CC‑like component) with curl curl -X GET "https://api.example.com/admin" -H "Authorization: Bearer $jwt" -v
On Windows (using `curl` and `certutil`):
Base64 decode JWT header $header = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9"
What Undercode Say:
- Understand the hierarchy: An intermediate combination of components is always a Package – not a PP or ST. This distinction is a common exam trick and a real evaluation pitfall.
- Reusability saves budget: Packages allow vendors to claim compliance with common components (e.g., “Package for secure boot”) without re‑evaluating the whole system.
- Operationalize CC thinking: Use the commands above to audit any system as if you were building a Package. Group controls, verify each, and reject bundles that miss a single requirement.
Prediction:
As supply chain security regulations (like EU Cyber Resilience Act) demand component‑level transparency, the Common Criteria concept of Packages will be repurposed for SBOMs (Software Bills of Materials). Expect to see CLI tools generating “Package manifests” from NIST 800-53 controls, merging CC thinking with DevSecOps pipelines within 18 months. Organizations that train staff on CC’s component model today will lead in automated compliance validation tomorrow.
▶️ Related Video (78% Match):
🎯Let’s Practice For Free:
IT/Security Reporter URL:
Reported By: UgcPost 7459793802774368256 – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
