ISO/IEC TR 20004:2012Withdrawn

Information technology — Security techniques — Refining software vulnerability analysis under ISO/IEC 15408 and ISO/IEC 18045

Technologies de l'information — Techniques de sécurité — Redéfinition de l'analyse de vulnérabilité de logiciel selon l'ISO/CEI 15408 et l'ISO/CEI 18045

This edition has been replaced by ISO/IEC TR 20004:2015.

Abstract / scope

ISO/IEC TR 20004:2012 refines the AVA_VAN assurance family activities defined in ISO/IEC 18045:2008 and provides more specific guidance on the identification, selection and assessment of relevant potential vulnerabilities in order to conduct an ISO/IEC 15408 evaluation of a software target of evaluation.

ISO/IEC TR 20004:2012 leverages the Common Weakness Enumeration (CWE) and the Common Attack Pattern Enumeration and Classification (CAPEC) to support the method of scoping and implementing ISO/IEC 18045:2008(E) vulnerability analysis activities.

ISO/IEC TR 20004:2012 does not define evaluator actions for certain high assurance ISO/IEC 15408 components, where there is as yet no generally agreed guidance.

Life cycle

Replaced by

ISO/IEC NP TR 20004-2Deleted (project abandoned)Information technology — Security techniques — Refining software vulnerability analysis under ISO/IEC 15408 and ISO/IEC 18045 — Part 2: CWE and CAPEC based software penetration testingTechnical Report · ISO/IEC JTC 1/SC 27 ISO/IEC TR 20004:2015PublishedInformation technology — Security techniques — Refining software vulnerability analysis under ISO/IEC 15408 and ISO/IEC 18045Technical Report · Published 8 Dec 2015 · ISO/IEC JTC 1/SC 27