Security certification is a snapshot, and buyers read too much into it - Help Net Security
In this Help Net Security video, Mariia Bakhtina, a research specialist at Masaryk University, explains what a Common Criteria or FIPS-140 certificate does and does not promise. In her team’s analysis, about 6 in 10 vulnerabilities matched to certified products, smartcards aside, were disclosed after the certification date. She also describes sec-certs and SCRUTINY, two open-source tools her lab builds, and the one question buyers should put to a vendor.
Luckily, certification documents (e.g., Security Target in CC or Security Policy in FIPS-140) are usually up to around 100 pages, not 300. But that’s still a lot for a procurement manager who isn’t typically a security specialist. In the first hour, I think they’d look for a few things: the exact product name and its version, the assurance level (along with the considered threats, assets and covered security requirements), what the evaluated configuration is, and what’s declared out of scope. That’s where the real boundaries of the security claims are. Covering all of those could take more than 1 hour if the procurement manager is not familiar with the certification scheme details (e.g., how the documents are organized).
Linha do tempo
-
Security certification is a snapshot, and buyers read too much into it - Help Net Security
ler a análise desta fonte ocultar
In this Help Net Security video, Mariia Bakhtina, a research specialist at Masaryk University, explains what a Common Criteria or FIPS-140 certificate does and does not promise. In her team’s analysis, about 6 in 10 vulnerabilities matched to certified products, smartcards aside, were disclosed after the certification date. She also describes sec-certs and SCRUTINY, two open-source tools her lab builds, and the one question buyers should put to a vendor.
Luckily, certification documents (e.g., Security Target in CC or Security Policy in FIPS-140) are usually up to around 100 pages, not 300. But that’s still a lot for a procurement manager who isn’t typically a security specialist. In the first hour, I think they’d look for a few things: the exact product name and its version, the assurance level (along with the considered threats, assets and covered security requirements), what the evaluated configuration is, and what’s declared out of scope. That’s where the real boundaries of the security claims are. Covering all of those could take more than 1 hour if the procurement manager is not familiar with the certification scheme details (e.g., how the documents are organized).