ComputingInformation SystemsInformation TechnologyComputer SecurityQuality AssuranceSecurity ArchitectureAccreditationCertificationIt AssuranceSecurity AssuranceSecurity MetricsBelief RepresentationComponent Trust AssessmentSecurity AccreditationSecurity Assurance MetricsSecurity CertificationSubjective BeliefTrust ModelsTrusted Systems
. This paper proposes a model for quantifying and reasoning about trust in IT equipment. Trust is considered to be a subjective belief, and the model consists of a belief model and set of operators for combining beliefs. Securityevaluation is being discussed as a method for determining trust. Trust may also be based on other types of evidence such as for example ISO 9000 certi#cation, and the model can be used to quantify and compare the contribution to the total trust eachtype of evidence provides. 1 Introduction Securityevaluation is an example of a well established method for determining trust in implemented system components. The method is based on a set of evaluation criteria like e.g. TCSEC #USD85#, ITSEC #EC92#, CC #ISO98# or similar, and accredited evaluation laboratories which perform the evaluation under supervision of a national authority. A successful evaluation leads to the determination of an assurance level which shall re#ect to which degree the TOE or system component ...