Improving the EPL
The Information Security Manual (ISM) recommends that Australian and New Zealand Government agencies use certified products for the protection of official information and systems. Certified products and systems minimise Information Technology (IT) security risks as they provide a level of assurance to government agencies that the specified security functionality of the product or system will operate as claimed by the developer. DSD lists its certified products on the Evaluated Products List (EPL).
Defence Signals Directorate (DSD) regularly undertakes surveys of Australian Government IT security professionals to identify technologies that are not currently being addressed in the EPL. This information will be used to employ strategies to introduce products onto the EPL that will address these gaps.
2009 review of the EPL
Late last year DSD surveyed all Australian Government agencies to identify current technology gaps in the EPL.
The result of the survey found that the most significant technology gaps on the EPL that are currently concerning government agencies are:
- IPv6 capable gateway devices (e.g. firewalls and CDS);
- Secure mobile devices;
- Virtualisation technologies;
- Secure USB flash media; and
- Portable encryption products.
DSD encourages developers of products in these technologies to consider AISEP evaluation. Details on how to enter a product into the AISEP can be found at: http://www.dsd.gov.au/infosec/evaluation_services/aisep_pages/aisep_certification.html.
Products entering the AISEP in these technologies will be assigned a high priority during the evaluation process to ensure the product becomes available to Australian Government users as soon as possible.
2007 review of the EPL
In November 2007, the secure USB thumbdrive was identified as the
most significant gap in the EPL.
A suitable product, The SanDisk Cruzer Enterprise FIPS edition, is now listed
on the EPL:
http://www.dsd.gov.au/infosec/evaluation_services/epl/In_Evaluation/SanDiskCruzerEnterpriseFIPS.html
DSD continues to encourage developers of secure USB thumbdrives to enter
their products into AISEP evaluation.