scholarly journals Perancangan Spesifikasi Keamanan untuk Pengembangan Aplikasi Secure Chat Berdasarkan Common Criteria For It Security Evaluation

2021 ◽  
Vol 8 (6) ◽  
pp. 1215
Author(s):  
Amiruddin Amiruddin ◽  
Muhammad Faqih Rohmani
Keyword(s):  
Expert Judgment ◽  
Security Evaluation ◽  
It Security ◽  
Security Design ◽  
Functional Requirements ◽  
Application Development ◽  
Forward Secrecy ◽  
Common Criteria ◽  
Perfect Forward Secrecy ◽  
Design Result

<p class="Abstrak">Spesifikasi keamanan sangat penting bagi pengembangan aplikasi <em>chatting</em> karena dapat menentukan tingkat keamanan aplikasi yang tentunya akan berdampak pada kepercayaan pengguna. Namun, pengembangan fitur keamanan pada aplikasi yang beredar belum semua didasarkan pada suatu spesifikasi kebutuhan keamanan yang jelas. Misanya, aplikasi Mxit dan QQ Mobile tidak memenuhi satu pun dari tujuh kategori keamanan untuk <em>secure chat</em> yang dikeluarkan oleh Electronic Frontiers Foundtaion (EFF). Bahkan, Yahoo! Messenger belum menerapkan disain keamanan yang baik, misalnya kita tidak dapat memverifikasi identitas kontak kita. Selain itu, Yahoo! Messenger tidak menerapkan <em>perfect forward secrecy</em>. Artinya, fitur keamanan pada beberapa aplikasi<em> chat</em> dikembangkan tidak berdasarkan pada rancangan spesifikasi keamanan. Pada penelitian ini, dilakukan perancangan spesifikasi keamanan untuk pengembangan aplikasi <em>secure chat</em> dengan mengacu pada <em>Common Criteria for IT Security Evaluation Version 3.1:2017</em>.  Pada hasil rancangan tersebut, telah ditentukan 28 famili dari 7 kelas <em>Secure Functional Requirement</em> (SFR) yang harus dipenuhi dalam pengembangan aplikasi secure chat. Hasil rancangan telah divalidasi dengan metode <em>expert judgment</em>.</p><p class="Abstrak"><em><strong>Abstract</strong></em></p><p class="Abstrak"><em>Security specifications are very important for chat application development because they can determine the level of its security which, of course, will have an impact on user trust. However, the development of outstanding application security features is not all based on a clear security requirement specification. For example, the Mxit and QQ Mobile applications do not meet any of the seven security categories for secure chat issued by the Electronic Frontier Foundation (EFF). In fact, Yahoo! Messenger has not implemented a good security design, for example, we cannot verify the identity of our contacts and do not apply perfect forward secrecy. This means that security features in some chat applications are developed not based on security specification designs. In this study, the design of security specifications for secure chat application development was carried out by referring to the Common Criteria for IT Security Evaluation Version 3.1: 2017. In the design results, 28 families of 7 classes of Secure Functional Requirements (SFR) have been determined that must be met in the development of secure chat applications. The design result has been validated using expert judgment method.</em></p>

Holistic and Law Compatible IT Security Evaluation

2013 ◽  
Vol 7 (3) ◽  
pp. 16-35 ◽  
Author(s):  
Daniela Simić-Draws ◽  
Stephan Neumann ◽  
Anna Kahlert ◽  
Philipp Richter ◽  
Rüdiger Grimm ◽  
...  
Keyword(s):  
Personal Information ◽  
Point Of View ◽  
Security Evaluation ◽  
It Security ◽  
Technology Design ◽  
Evaluation Standards ◽  
Common Criteria ◽  
It Systems ◽  
Online Voting ◽  
Iso 27001

Common Criteria and ISO 27001/IT-Grundschutz are well acknowledged evaluation standards for the security of IT systems and the organisation they are embedded in. These standards take a technical point of view. In legally sensitive areas, such as processing of personal information or online voting, compliance with the legal specifications is of high importance, however, for the users’ trust in an IT system and thus for the success of this system. This article shows how standards for the evaluation of IT security may be integrated with the KORA approach for law compatible technology design to the benefit of both – increasing confidence IT systems and their conformity with the law on one hand and a concrete possibility for legal requirements to be integrated into technology design from the start. The soundness of this interdisciplinary work will be presented in an exemplary application to online voting.

Holistic and Law Compatible IT Security Evaluation

2015 ◽  
pp. 927-946
Author(s):  
Daniela Simić-Draws ◽  
Stephan Neumann ◽  
Anna Kahlert ◽  
Philipp Richter ◽  
Rüdiger Grimm ◽  
...  
Keyword(s):  
Personal Information ◽  
Point Of View ◽  
Security Evaluation ◽  
It Security ◽  
Technology Design ◽  
Evaluation Standards ◽  
Common Criteria ◽  
It Systems ◽  
Online Voting ◽  
Iso 27001

Common Criteria and ISO 27001/IT-Grundschutz are well acknowledged evaluation standards for the security of IT systems and the organisation they are embedded in. These standards take a technical point of view. In legally sensitive areas, such as processing of personal information or online voting, compliance with the legal specifications is of high importance, however, for the users' trust in an IT system and thus for the success of this system. This article shows how standards for the evaluation of IT security may be integrated with the KORA approach for law compatible technology design to the benefit of both – increasing confidence IT systems and their conformity with the law on one hand and a concrete possibility for legal requirements to be integrated into technology design from the start. The soundness of this interdisciplinary work will be presented in an exemplary application to online voting.

Sign in / Sign up

Export Citation Format

Share Document