FOIST - Framework for Operating System Testing by Integrating Standards and Tools

In this innovative and collaborative age, information systems have become an integral component of governmental, social, and economic infrastructures. Therefore, ensuring their security is a major concern in this technological era as the incorporation of communication technologies and sophistication of cyber attacks have increased the threat landscape profoundly. Operating System (OS), being the most fundamental component of these information systems, acts as the core intermediary and manages the underlying mechanisms involved in computer processing. Hence, one of the most efficient ways of achieving optimal security is to deploy a secure OS. To protect OS, evaluation standards including Common Criteria (CC), National Institute of Standards and Technology (NIST), National Bureau of Standards (NBSIR) and International Standardization of Organization (ISO) suggest a set of security requirements, whereas OS tools like Microsoft Security Assessment Toolkit (MSAT) and Belarc Advisor ensure security compliance. This research is focused on assembling such security requirements of an OS by analyzing technical modules of the aforementioned standards as well as tools. The mentioned security standards and tools cover all significant aspects of security, hence the proposed framework for OS testing named FOIST, integrates standards and tools to evaluate major security aspects of OS. Validation of the framework has been done by taking Windows 10 as a test case followed by the evaluation of framework. The results demonstrate that the OS taken as a test case, incorporates high security measures.