基于CC与SSE-CMM的高确信度信息安全系统的开发方法

尽管CC和SSE-CMM均可通过对信息安全产品或系统的开发、评价、使用过程等各个环节实施安全工程来确保产品或系统的安全确信度，但CC和SSE-CMM是两个不同的安全评估标准.文中分别介绍CC和SSE-CMM的结构模型和特点，并对CC和SSE-CMM进行比较分析.最后，针对CC与SSE-CMM具有互补性的特点，提出了将CC与SSE-CMM结合起来开发高确信度信息安全产品或系统的开发方法.

Development Method of High Assurance Information Security System Based on CC and SSE-CMM

By implementing security engineering in the process of development,evaluation,use,and so on,CC(Com- mon Criteria)and SSE-CMM(Systems Security Engineering Capability Maturity Model)ensure security assurance of products or systems,but CC and SSE-CMM are different.In this paper,structure mode and character of CC and SSE- CMM are introduced,and compared each other.Finally,according to the complementary character between CC and SSE-CMM,a development method of high assurance to information security systems or products is presented by combi- ning the CC and SSE-CMM.