ISO/IEC TR 20004:2015

Overview

ISO/IEC TR 20004:2015 is a Technical Report that refines software vulnerability analysis activities defined in ISO/IEC 18045 to support evaluations under ISO/IEC 15408 (Common Criteria). It provides focused guidance for identifying, selecting and assessing potential vulnerabilities in a software Target of Evaluation (TOE). The report leverages public information-security resources (notably CWE, CAPEC and CVE) to define an objective, repeatable approach for scoping and implementing the AVA_VAN assurance-family activities used in Common Criteria evaluations.

Key topics and requirements

• Refinement of AVA_VAN activities: clarifies evaluator actions for “Potential vulnerability identification from public sources” and “Penetration testing” across AVA_VAN levels (AVA_VAN.1–AVA_VAN.5).
• Use of structured vulnerability resources: recommends employing the Common Weakness Enumeration (CWE) and Common Attack Pattern Enumeration and Classification (CAPEC) to identify relevant weaknesses and attack patterns; use of other appropriate resources is permitted.
• Public-source searches: defines focus and extensiveness of searches in public domain sources (product-specific CVE data, vendor advisories, known attack patterns) as part of the vulnerability survey.
• Assessment of TOE susceptibility: guidance on designing, specifying, executing and documenting security/penetration testing based on identified potential vulnerabilities and expected attack potential.
• Reporting and evidence: requirements to record candidate vulnerabilities, test results and judgments about exploitability and residual vulnerabilities in the Evaluation Technical Report (ETR).
• Scope limitations: does not cover all vulnerability-analysis methods and does not define evaluator actions for certain high-assurance components where no consensus guidance exists.

Practical applications and users

• Common Criteria evaluators and certifiers use the report to standardize vulnerability identification and penetration testing for software TOEs.
• Product developers and secure-development teams can apply the structured CWE/CAPEC-based approach during development to build TOE-specific weakness/attack-pattern templates and reduce evaluation effort.
• Protection Profile (PP) and Security Target (ST) authors and technical communities benefit from clearer guidance on what constitutes a minimal set of relevant weaknesses for AVA_VAN activities.
• Security architects and QA teams can adopt the methodology to prioritize testing based on CVE/CWE/CAPEC mappings and documented attack potential.

Related standards and resources

• ISO/IEC 15408 (Common Criteria) - security functional and assurance requirements
• ISO/IEC 18045 - methodology for vulnerability analysis
• CWE, CAPEC, CVE - public vulnerability and attack pattern repositories referenced by the Technical Report

Keywords: ISO/IEC TR 20004:2015, vulnerability analysis, AVA_VAN, ISO/IEC 15408, ISO/IEC 18045, CWE, CAPEC, CVE, penetration testing, Common Criteria.