6.7 Security measures

What this heading covers

The six families are properties of the product, not a security programme. Confidentiality is about data not being disclosed to those without the right to see it. Integrity is about data not being changed improperly. Non-repudiation is about being unable to deny an action. Accountability is about being able to attribute an action to an entity. Authenticity is about proving an entity or a message is what it claims. Resistance is about withstanding attack. Each is measurable, and each needs evidence from the product and its operation. A penetration test result is evidence for resistance; it is not a measure of confidentiality or accountability. The draft keeps security inside the product quality model, which means the measures are about the product's behaviour, not about whether an organisation has a security management system.

Record position: characteristic 6 of 9, carrying 6 of the 40 measure families in clause 6.

What the heading asks of a team

The common confusion

Security is often reported as a scanner result. The six families are product properties with different evidence, and a scanner covers part of resistance, not confidentiality, accountability or non-repudiation.

The measure families in this characteristic

• 6.7.2 Confidentiality measures
• 6.7.3 Integrity measures
• 6.7.4 Non-repudiation measures
• 6.7.5 Accountability measures
• 6.7.6 Authenticity measures
• 6.7.7 Resistance measures

What to put in place before publication

1. Name the data assets and the trust boundaries the security measures are about.
2. Write one measure per family, with the evidence source and the population it covers.
3. Record the attack model used for resistance, and the date of the last test against it.
4. Check that audit records are complete enough to support the accountability and non-repudiation measures.
5. Keep the security measures in the product quality report, separate from the organisational security programme.

Where teams usually fall short

• A scanner score presented as the security measure for all six families.
• An audit log that exists but cannot attribute an action to a person, so accountability is asserted rather than measured.

What happens next

Confidentiality, integrity and availability are the familiar three, but the draft does not put availability here; it is under reliability. Read the six pages as a set, because a control that helps one property can weaken another.