Security Evaluation Laboratory
The Security Laboratory of RCII, recognized as the first IT security laboratory in Iran, has achieved a significant milestone by becoming the first in the country to obtain the ISO/IEC 17025 certification.
Evaluation Standards and Methodologies:
The Following Standards, frameworks and methodologies enable RCII to thoroughly identify security vulnerabilities and weaknesses, ensuring that all evaluated IT products meet rigorous global security standards.
ISO/IEC 15408
The security evaluation tests at RCII are conducted in accordance with the ISO/IEC 15408 standard, also known as the Common Criteria (CC). This standard is divided into five key parts:
RCII employs the Common Evaluation Methodology (CEM) to assess the security of IT products. This methodology ensures that the security requirements, derived from the specific security objectives, identified threats, and vulnerabilities of each product, are rigorously tested.
Other Standards and Methodologies
In addition to ISO/IEC 15408, RCII incorporates several well-recognized industry standards and best practices during its security evaluation process, including:
OWASP Standards provide comprehensive, structured sets of security controls designed to assess and verify the security of web applications, mobile applications, and other software systems. These standards help ensure that applications meet essential security requirements and protect against a wide range of threats
Web Application:
Mobile Application:
OWASP Top10 Projects represents the most critical security risks to Web Applications, Mobile Applications and APIs.
Quality Evaluation Laboratory
RCII’s quality laboratory, recognized as a pioneer in software quality testing in Iran, has achieved ISO/IEC 17025 certification, a globally respected accreditation for laboratories conducting testing. This certification underscores RCII’s commitment to excellence and adherence to international best practices in quality assurance.
The laboratory’s software quality testing processes are rigorously aligned with advanced global standards and methodologies, establishing a state-of-the-art testing framework. RCII has played a pivotal role in developing and implementing numerous national standards, significantly shaping the landscape of software quality assurance in the region.
Among the key international standards adopted at RCII are the ISO/IEC 25000 series, also known as SQuaRE (Software Product Quality Requirements and Evaluation), which offers comprehensive criteria for evaluating software product quality. These standards guide the laboratory’s meticulous evaluation processes, supported by advanced testing tools to ensure accuracy, reliability, and full compliance with both contemporary and legacy benchmarks.
By implementing these standards, RCII ensures that the software products it tests meet the highest levels of quality and reliability across the industry.
The following are the key quality tests rigorously conducted at RCII’s quality laboratory:
Certificate Authority Applications (CA) Evaluation Laboratory
The Research Center of Informatic Industries (RCII) has developed the national standards and criteria for Certificate Authority applications (CA). These standards have been developed under supervision of Governmental Root Certification Authority (GRCA) of Islamic Republic of Iran. With respect to deep knowledge of our experts at RCII we have started the PKI Lab for testing and evaluating CA applications. This Laboratory is the first and currently unique PKI Lab in Iran that has been approved by e-Commerce Development Center.
Public-Key Enabled Applications (PKE) Evaluation Laboratory
The Research Center of Informatic Industries (RCII) has developed the national standards and criteria for Public-Key Enabled Applications (PKE). These criteria have been developed under supervision of Governmental Root Certification Authority (GRCA) of Iran. Regarding to deep knowledge of our experts at RCII, we have started the PKI Lab for testing and evaluating PKE Applications. This Laboratory is the first and currently unique PKI lab in Iran that the e-Commerce Development Center has been approved.
The most significant achievements of Public-Key Enabled Applications (PKE) Evaluation Laboratory
Public Key Infrastructure Evaluation Standards:
Smart Card Testing Laboratory
Today, due to the increasing use of encryption algorithms and encryption capabilities for data integrity and confidentiality, the use of equipment such as hardware encryption modules, hardware tokens, and smart cards will be inevitable. These products, which are used in the secure storage and production of encryption keys, should also be evaluated and conform to their security and functional standards. In smart cards, the following can occur:
Smart Card Standards
- Java Card RE Specification
- Java Card VM Specification
- Java Card API Specification
Testing capabilities:
- APDU interface testing
- Access control validation (PINs, authentication)
- Cryptographic function testing
- Secure channel establishment (e.g., SCP03)
- Secure applet life cycle (install, delete, personalize)
- Fuzz testing on APDU commands
- Logical flaw testing (e.g., bypass authentication)
- Reverse engineering (where possible)
- Testing for cryptographic weaknesses (e.g., key leakage)
Hardware Security Testing Laboratory
The Hardware Security Laboratory is one of the sub-laboratories of the IT department, specializing in the security evaluation of hardware devices. It focuses on identifying and addressing security threats in electronic products and embedded systems. This laboratory, based on internationally recognized standards, provides security assessment tests in two areas: vulnerability assessment and compliance evaluation based on standard requirements.
Types of products which can be tested:
Hardware Security Evaluation Standards
Security evaluation and tests in this laboratory are conducted based on the following international standards:
Vulnerability evaluation
Vulnerability evaluation is a process in which weaknesses and security threats in hardware devices and assets are identified. The results of this evaluation help security teams, system owners, and other stakeholders analyze vulnerabilities, implement necessary fixes, and enhance the security level of their systems.
IACS Testing Laboratory
The Industrial Automation Control System (IACS) Security Laboratory is one of the sub-laboratories within the IT department, specializing in the security evaluation of Operational Technology (OT) under the title “Cybersecurity in Industry Based on ISA/IEC 62443 standard”.
In this laboratory, security testing is performed in accordance with the IEC 62443 standard, focusing on:
IEC 62443-4-2 Based Testing (Component-Level)
This standard defines technical requirements for Software Application Requirements (SAR), Embedded Device Requirements (EDR), Host Device Requirements (HDR) and Network Device Requirements (NDR). These tests validate that technical security requirements for control components and industrial automation according to the Technical Security Requirements (TSRs) defined in part 4-2:
| Component Requirement (CR) | Description |
|---|---|
|
Authentication & Identity (CR 1) |
Ensure users/devices are who they say they are |
|
Use Control (CR 2) |
Limit access to functions/data |
|
System Integrity (CR 3) |
Protect against tampering |
|
Data Confidentiality (CR 4) |
Keep data private |
|
Restricted Data Flow (CR 5) |
Control communication paths |
|
Timely Event Response (CR 6) |
Detect & react to threats |
|
Availability (CR 7) |
Check DoS resistance or system recovery |
IEC 62443-3-3-Based Testing (System-Level)
IEC 62443-3-3 defines the cybersecurity requirements at the system level, specifying the technical security requirements for complete IACS systems. These tests validate that the whole system (network of devices) operates securely and meets architectural and operational cybersecurity expectations:
| System Requirement (SR) | Description |
|---|---|
|
SR 1 – Identification & Authentication |
System-wide user management |
|
SR 2 – Use Control |
Role-based access control across the system |
|
SR 3 – System Integrity |
Configuration hardening and secure boot |
|
SR 4 – Confidentiality |
Encrypted communications between zones |
|
SR 5 – Restricted Data Flow |
Segmentation using zones/conduits |
|
SR 6 – Monitoring & Logging |
Central log collection and event response |
|
SR 7 – Resource Availability |
Backup, failover, system resilience |
Security Levels
IEC 62443-3-3 (focused on system-level security for the entire IACS) and IEC 62443-4-2 (focused on technical requirements for individual components) both define and utilize Security Levels (SLs) appropriate to their scope.
| Security Level | Threat Actor | Definition |
|---|---|---|
|
SL 1 |
Casual or coincidental attacker |
Protection against casual or coincidental violation |
|
SL 2 |
Intentional attacker with simple means |
Protection against intentional violation using simple means with low resources, generic skills and low motivation |
|
SL 3 |
Sophisticated attacker with skills and moderate resources |
Protection against intentional violation using sophisticated means with moderate resources, IACS specific skills and moderate motivation |
|
SL 4 |
Highly motivated attacker with significant resources |
Protection against intentional violation using sophisticated means with extended resources, IACS specific skills and high motivation |
Vulnerability Evaluation
Vulnerability Evaluation in Industrial Automation Control Systems (IACS)/Operational Technology (OT) is the process of identifying, evaluating, and prioritizing weaknesses (vulnerabilities) in industrial control systems that could be exploited by cyber threats.
Approach for Vulnerability Evaluation in IACS/OT:
Source Code Security Evaluation Laboratory
In an era where cyber threats are rapidly evolving and targeting systems across various industries, cybersecurity has become more critical than ever. Secure coding is not merely a best practice—it’s a fundamental element of a robust cybersecurity strategy.
This laboratory is committed to identify vulnerabilities at the source level. By analyzing and evaluating the security of code, we assist organizations in preventing costly breaches and building trust in their digital systems.
By using static and dynamic analysis methods, this laboratory identifies vulnerabilities and security issues in the source code and provides operational solutions to fix and improve them.
Source Code Evaluation Standards
Although the ISO/IEC 15408 standard, does not cover all the requirements for source code evaluation, particularly in terms of secure coding, it is used as the main standard for source code evaluation in this laboratory. Evaluations are conducted at the EAL4 level of the Common Criteria, which assesses not only the product’s security functionality but also aspects such as security architecture and the design and implementation process. The following are the standards, checklists, and authoritative references available for assessing the security of source code used in the laboratory.
Programming language-based standards
Common Weakness Enumeration (CWE)
For programming languages that lack a valid secure coding standard, the laboratory uses CWE as a valid reference for categorizing and reporting various vulnerabilities. Since CWE includes a list of major software vulnerabilities, these vulnerabilities are considered evaluation criteria. Specifically, vulnerabilities such as SQL Injection, Cross-Site Scripting, and Input Validation will be examined in the source code.
OWASP Checklist
Another valid reference for source code evaluation is the OWASP checklist, which comprehensively covers various vulnerabilities in software applications. The OWASP Secure Coding Practices Quick Reference Guide includes 14 subsections, each covering an aspect of software security
This checklist includes the following topics:
AI Product Evaluation Laboratory
AI laboratories are crucial specialized centers addressing the rapid growth of intelligent technologies and AI-based tools. With their increasing impact on individuals and society, comprehensive evaluation—covering performance, security, trust, and ethics—is essential. To meet this need, the RCII has launched the advanced AI lab. Utilizing global standards and expert teams, the lab provides structured and reliable assessments, supporting industry demands and promoting the safe and accountable development of AI technologies.
Laboratory Approach
The AI Laboratory has been established with the aim of providing a structured, scientific, and reliable framework for evaluating artificial intelligence systems. The primary goal of this laboratory is to ensure the performance, security, trustworthiness, and ethical alignment of AI-based tools and technologies. To achieve this, the lab adopts a multidisciplinary approach that combines technical assessments with ethical and governance considerations. The evaluation process covers multiple dimensions—including data quality, functional performance, and vulnerability analysis—while emphasizing transparency and accountability. By aligning with international best practices and developing localized methodologies, the laboratory seeks to bridge the gap between innovation and assurance, empowering industries and institutions to deploy AI responsibly and effectively.
Artificial Intelligence Laboratory Capabilities
The Artificial Intelligence Laboratory, leveraging a team of experienced specialists across various AI domains and an outstanding track record in developing security and quality standards, provides comprehensive evaluation services for AI-based products.
Specializations:
Our multidimensional evaluation process includes:
AI Laboratory Standards
Given the emerging and evolving nature of AI system evaluation, there is currently no single, comprehensive, and globally unified standard dedicated solely to this domain. As such, the AI Laboratory at the Informatics Industries Research Center adopts a flexible and experience-driven approach, based on a combination of existing resources and expert insights. The key components of this approach include:
Development of Internal Guidelines:
Use of Related Standards and Documents:
The laboratory leverages standards from related areas—particularly information security and software evaluation—to build robust assessment frameworks. In this context, Protection Profiles and best practices from existing domains play a key role.
The laboratory incorporates relevant internationally recognized AI standards into its evaluation processes. Among the most important are:
AI Performance and Evaluation Standards
AI Security and Privacy Standards:
• ML01: Input Manipulation Attack
• ML02: Data Poisoning Attack
• ML03: Model Inversion Attack
• ML04: Membership Inference Attack
• ML05: Model Theft
• ML06: AI Supply Chain Attacks
• ML07: Transfer Learning Attack
• ML08: Model Skewing
• ML09: Output Integrity Attack
• ML10: Model Poisoning
• LLM01: Prompt Injection
• LLM02: Sensitive Information Disclosure
• LLM03: Supply Chain Vulnerabilities
• LLM04: Data & Model Poisoning
• LLM05: Improper Output Handling
• LLM06: Excessive Agency
• LLM07: System Prompt Leakage
• LLM08: Vector & Embedding Weaknesses
• LLM09: Misinformation / Hallucination
• LLM10: Unbounded Consumption
• IEEE 7000 – Ethical Design in Intelligent Systems
• OECD AI Principles – Global AI Ethics and Governance
• NIST AI Risk Management Framework – Risk-Based Approach to AI Security and Fairness
By integrating these standards and continuously developing in-house resources, the AI Laboratory ensures its evaluations remain internationally aligned, locally relevant, and technically reliable.