What Is a Security Target?

A security target (ST) is the name of a document created by an information technology (IT) security company or business with regard to a particular application or company it is working with. For example, a particular software developer that creates antivirus programs might provide an ST for a specific program to document the types of security threats it is designed to detect and deal with for a customer. A security target can also be issued by an IT security service for a particular company it is working with, in which it details specific ways in which that company is vulnerable to attack and provides information on how security might be increased for that company.

The name “security target” refers to the actual document drawn up by an IT security company to detail ways in which that company can help secure others. Specific information provided in this type of document can vary depending on the kinds of threats a company may be facing or the services that business can provide. In general, however, a security target usually provides extensive information regarding the security needs of an individual or company and how those needs might be met.

A software developer may, for example, draw up a security target to indicate the types of threats a new security program can deal with. The security target for a new antivirus program might indicate the types of viruses and other malware the software can find and deal with for a customer. If there are any specific issues this program has with false positives or not finding certain forms of malware, this may be included in the document. All of this information is typically provided in reference to the target of evaluation (TOE), which is typically a particular company that might use a given product or service.

The security target generated by an IT security service might also deal with the specific needs and threats to a particular company. In this case, the TOE is not only the company itself but also specific files and types of information the company has. Once the TOE is named and detailed, then the security target usually provides information on how threats can be handled, though in a fairly general way that does not provide security assistance without the use of that company’s services. All of this information is typically created and provided using Common Criteria for Information Technology Security Evaluation or “common criteria,” which refers to a set of standards utilized in the IT and security industry.