MyCC EAL1 Khairul Izhar Khalid. Experience. StarVision Sdn. Bhd.

Transcription

1 MyCC EAL1 Khairul Izhar Khalid. Experience StarVision Sdn. Bhd.

2 Agenda 1. About StarVision and The Product 2. The MyCC Project Experience 3. Lesson Learned 4. Benefits 5. Recommendations

3 MyCC EAL1 Experience About Us and The Product StarVision Sdn. Bhd.

4 About Starvision 1. Microsoft Gold Certified Partner since Strong presence in both public and private sectors 3. Proven solutions, meeting both business and technology needs 4. Pioneer in Workflow and Web Enabled solutions, Geographical Information apps 5. Specialized Technology:- Web Development : ASP.NET, AJAX, jquery, SilverLight, eplatform.net Microsoft Technology :.NET Framework, Windows Server, SQL Server, Exchange Server, BizTalk Server, Visual Studio.Net Oracle Technology : Oracle 9i, 10g LBS / GIS Development : Location Determination Technology, GPRS, SMS, MMS, Bluetooth, 3G

5 About Starvision Internet Platform : Sec cured Environment :: MecWise Toolkit MecWise Report Server MecWise Workflow MecWise eplatform.net :: MecWise Supply Chain MecWise Distribution MecWise Logistics MecWise POS MecWise Fixed Assets :: Network Infrastructure MecWise Networks Singtel Data Links BroadWeb / NSFocus Security Products Softnext Secure Content Vodtel VOIP Technology Products :: MecWise People MecWise HR MecWise Training MecWise Performance Review MecWise Payroll MecWise Time Management System (TMS) MecWise Employee Self Service (ESS) MecWise Leave Admin Biometric Clock :: Partner Solutions Jeeves ERP InfoConnect Docuflo DMS Elixir BI Suite Actuate Balanced Scorecard Call Centre Management Solutions Consultancy, Development, Data Migration, Implementation, Training, Documentation, Support

6 The Product 1. TOE: MecWise HR Human Resource Application (Web Based Software) 3..Net Platform 4. Personnel Profile, Database & Report, Promotion and Progress, Leaving Service 5. Six (6) Security modules. i.e. Security Profile, Security Group, Session Log Viewer, Audit Trail Utility, Web Interface, User Account Profile 6. Developed by our Core Development Team

7 MyCC EAL1 Experience The MyCC EAL1 Project Experience StarVision Sdn. Bhd.

8 Why we do it 1. MyCC Financial Assistance Hey..it s free 2. Enhance Product Security Reputation 3. Gain Customers confidence 4. Adopting Best Practices knowledge 5. To make the product internationally recognized 6. To maintain competitiveness with competitors.

9 Project Experience Summary 1. The earliest MyCC Financial Assistance batch 2. Evidence Submission (Iterative Process): a) Security Target (ASE) b) ADV: Functional Specification c) AGD: Guidance documents (Operational user guidance and Preparative procedures) d) ALC: Life-cycle support (Configuration Management Documentation e) ATE: Tests (Acceptance Test) 3. Test Environment for MecWise HR Security Areas Claimed: Audit, Security Management, Identification and Authentication and User Data Protection. Security Functional Requirements: (24) 5. Meetings and Clarification ( is key ) Sessions 6. Product Demonstration Sessions

10 MecWise HR 3.1 EAL 1 Project Experience Overview ASE (Security Target) ADV (Development) AGD (Guidance) ALC (Life Cycle) ATE (Independent Test) AVA Vulnerability Assessment Security Target StarVision Functional Specification CyberSecurity (MySEF) Preparative and Operational Guidance Configuration List Acceptance Test Project Reporting and Clarification Sessions 10

11 MyCC EAL1 Experience Lessons Learned StarVision Sdn. Bhd.

12 Lessons Learned 1. Management Commitment (all the way) 2. Internal Awareness Session 3. Read the CC 3.1 documents (although its tedious) 4. Spent time with the creators 5. Dedicated team 6. Constant three (3) way communication (CyberSecurity, Project Team and the Authors) 7. Really know your security functionalities (provide sufficient evidence)

13 MyCC EAL1 Experience Benefits StarVision Sdn. Bhd.

14 Benefits 1. CC knowledge (Project is an experience) 2. Adopting best practice 3. Security aspects (know your capabilities) 4. Internal (In house) capability (do it on your own) 5. Slowly gain reputation to potential and existing customers

15 MyCC EAL1 Experience Recommendations StarVision Sdn. Bhd.

16 Recommendations 1. Continuous Training and awareness 2. Provide a tool to make it easier way for developers to understand CC documentation 3. Constant communication and clarification during project is key 4. You can do it on your own 5. Consider Non Security Related Product If we can do it so can you