| 8.1 |  | Introduction to Firewalls |
| 8.1.4 |  | Security and VPN certifications |

| Validating the capabilities of a security product in today's ever-increasing technical environment is complex and time-consuming. In most instances, enterprises lack the required expertise and time to perform formal, valid, and globally-recognized security evaluations. To address this issue, numerous independent security evaluations have arisen to provide organizations with an unbiased and objective review of security products. For example, Common Criteria, FIPS 140, and ICSA are some of the independent certifications and evaluations. A particular security product may exhibit one or more of these certifications . Many large enterprises, the military, and ISPs mandate minimum certification and evaluation levels for firewall and VPN devices.

Common Criteria
The Common Criteria is an international standard for evaluating IT security. It was developed by a consortium of fourteen countries to replace a number of existing country-specific security assessment processes (European/Australian ITSEC and the US NSA "Orange Book"), and was intended to establish a single high-quality standard for international use. Common Criteria version 2.1 recently became an International standard - ISO 15408.

Although there are seven security levels defined for the Common Criteria evaluation process, Evaluation Assurance Level 4 (EAL4) is the highest universal evaluation level implemented under the Common Criteria today .

FIPS
The Federal Information Processing Standard (FIPS) 140 is a US and Canadian Government standard that specifies security requirements for cryptographic modules. FIPS 140 has four levels of assurance: Level 1 is the lowest and Level 4 is the most stringent. Each level builds upon the one below it, so a Level 2 certification means that a product meets the requirements for both Level 1 and Level 2 .

FIPS 140 testing is done by independent vendor laboratories that have been certified, and the results of product certification testing are submitted to the National Institute of Standards and Technology (NIST) in the US, and the Canadian Security Establishment (CSE) in Canada for independent validation. Just as with the Common Criteria, the value of the FIPS 140 process comes from rigorous standards for both the module being tested as well as the laboratory conducting the test. This dual process enhances the validation of test results.

ICSA
ICSA Labs tests firewalls against a standard set of functional and assurance criteria elements. ICSA Labs is presently testing firewalls against the Modular Firewall Product Certification Criteria version 4.0. ICSA also test VPN devices for IPSec interoperability. IPSec interoperability testing validates a product or set of products that use cryptography to provide effective security services (e.g. VPN). ICSA Certification exists to provide a set of measurable, public-domain standards for commercial security products.

| Web Links http://csrc.nist.gov/cryptval/ http://www.commoncriteria.org http://www.icsalabs.com http://niap.nist.gov

http://www.cisco.com/go/securitycert