The Open Group Trusted Technology Forum (OTTF): Tuesday

Objective of Meeting

The objective of the OTTF member meeting sessions held on Tuesday were to discuss::

• Global Outreach & Harmonization:
• Status, Strategy, and Prioritization
• CC Mapping Activities – Liaison with CC-SAE5533 Mapping Activities
• Corrigenda: (1.1) version of the O-TTPS Standard
  • Scope of version 1.1
  • Determining whether Change Requests and Problem Reports were within scope for 1.1 or should be postponed for discussion for 2.0 changes
  • Making recommendations for those CRs within scope for 1.1

Summary

Global Outreach & Harmonization

Status, Strategy, & Prioritization

The GOSH work stream had put together several activities for a prioritization exercise to be conducted with the Steering Committee to determine which activities are of highest priority to be pursued for 2014. At the meeting there was some discussion on each of the 10-15 or so categories – particularly those that involved outreach to governments, with the conclusion from those around the table that outreach to inform is acceptable and different from outreach to advocate for legislation, which is not acceptable – and need to be careful we don’t cross that boundary. This is completely in line with The Open Group management perspective as well. The list of proposed activities will be posted to Plato and circulated by the GOSH group as a prioritization survey next week.

CC Mapping Activities

Mike Lai gave a presentation on the work he, Terrie Diaz, and the EOC TG have been doing on mapping CC SARS to O-TTPS Assessment Procedures. This activity is based on the objective that if a Selected Representative Product is also a TOE that has been through CC evaluation then the O-TTPS assessors could accept for those requirements that have equivalent assessment/evaluation requirements – as defined in the mapping table – the fact that they had been CC certified, without needing to reproduce evidence for those particular requirements. That mapping table will be posted to Plato.

We also discussed whether it was in our best interest and whether it was a priority to do the same with the AS5553 standard – and there were mixed opinions on that. It will re-surface in the prioritization exercise mentioned above.

Corrigenda Changes

One of our major focus areas for the Member Meeting in San Francisco on all three days of the member meeting was reaching agreement on recommendations for Change Requests (CRs) to the O-TTPS. We used a spreadsheet with a row for each CR, as the basis for this activity. We recorded whether it was a CR or PR to be included in 1.1 or postponed to 2.0. and if it was to be included in 1.1 then we provided a proposed recommendation. In the spreadsheet there are a variety of submitted CRs:

• Rows 2-28 are CRs that were submitted to the 1.0 Review Process but were rejected as changes for that now published version and instead recorded for consideration for the next version of the Standard.
• Rows 29-50 are CRs that were submitted by James Andrews on behalf of the EOC (Evidence of Conformance) Task Group as that group worked through the evidence of conformance – and what would later become the Assessment Procedures.
• Rows 52-60 are Problem Reports (PRs) that were recently (within the last three months) submitted to the Problem Reporting Process and were categorized as Interpretations – which means they are Problem Reports against the Standard.

Outputs

The rendering of the CRs and PRs were captured in the Changes for 1.1 worksheet and once cleaned up and edited will be posted to Plato. The suggested changes for 1.1 will be separated from those postponed for 2.0.

Next Steps

The Strategy Prioritization Survey will be sent to the Steering Committee next week.

The Mapping Activity will be presented to the Forum once again during one of the Work Group Sessions – and we will also attempt to re-engage with the CCDB in relation to a liaison, and apprising them of the work on this activity. There was also some discussion as to whether we should present the mapping work at the next CC Conference.

We will announce to the Forum that we will be doing a version 1.1, ask for any additional change requests, work through the recommendations for those, and then ballot all of the CR recommendations for 1.1. Will then submit to Company Review.

Links

None.