Extended eTVRA vs. Security Checklist: Experiences in a Value-Web

A. Morali, Emmanuele Zambon, S.H. Houmb, Karin Sallhammar, Sandro Etalle

    Research output: Book/ReportReportProfessional

    95 Downloads (Pure)


    Security evaluation according to ISO 15408 (Common Criteria) is a resource and time demanding activity, as well as being costly. For this reason, only few companies take their products through a Common Criteria evaluation. To support security evaluation, the European Telecommunications Standards Institute (ETSI) has developed a threat, vulnerability, risk analysis (eTVRA) method for the Telecommunication (Telco) domain. eTVRA builds on the security risk management methodology CORAS and is structured in such a way that it provides output that can be directly fed into a Common Criteria security evaluation. In this paper, we evaluate the time and resource efficiency of parts of eTVRA and the quality of the result produced by following eTVRA compared to a more pragmatic approach (Protection Profile-based checklists). We use both approaches to identify and analyze risks of a new SIM card currently under joint development by a small hardware company and a large Telco provider. The new SIM card should comply with Evaluation Assurance Level 4 or 4+ according to Common Criteria.
    Original languageUndefined
    Place of PublicationEnschede
    PublisherCentre for Telematics and Information Technology (CTIT)
    Number of pages10
    Publication statusPublished - 10 Oct 2008

    Publication series

    NameCTIT Technical Report Series
    PublisherCentre for Telematics and Information Technology, University of Twente
    ISSN (Print)1381-3625


    • EWI-14046
    • METIS-252103
    • SCS-Cybersecurity
    • IR-65094

    Cite this