Security evaluation: what is there apart from common criteria?

Question

ACME makes a product that is used in some security-sensitive applications. There are no particular security regulations or industry standards in the domain of this product. ACME's business arm would like to claim that “we're 150% more secure than our competitors”. ACME's customers would be more prone to believing that if the claim was backed by some kind of independent assessment. ACME's ethical arm would appreciate if such an independent assessment did in fact validate something about ACME's product's security.

It seems that the answer is to have ACME's product undergo some form of certification, the most obvious candidate being a Common Criteria certification. This looks like a daunting process; there isn't even an existing protection profile to hang onto, and CC certification introduces a large delay between the time a product version is finalized and the time it can be released. Also CC seems to validate methodology more than security. Are these somewhat uninformed opinions of CC founded? Are there alternatives to CC?

The French government has recently introduced a “first-level security certification” (CSPN), which is based on a lighter approach than CC: roughly speaking, a government-approved evaluator spends a predefined number of man-days doing gray-box attacks with respect to a PP. This would seem like an ideal solution, except that CSPN is completely unknown outside France. Is there a more internationally recognized certification that is analogous to CSPN?

Answer 1

I'm a CC evaluator with CGI Canada. Hopefully I can answer some of your questions.

I'm not entirely certain that CC is the most obvious choice. Common Criteria -- at least for the Canadian scheme -- cannot simply be purchased (this might be different in other jurisdictions, but I think France is similar). The product has to support the security posture of the Cdn gov't. What this means is that if similar products are not in use in the Cdn gov't, critical infrastructure, and associated services, and is not seen as being one of a handful of emerging technologies that will be implemented, then it is unlikely you could even start a CC program.

With that said, let's assume that you have a product that could go into the CC program. There's no stipulation that states the product has to be finalized before the CC program can start. There is only the stipulation that the product not change in specifications while the evaluation is going on. It is entirely common for a developer to be actively building a product while undergoing an evaluation. This just-in-time evaluation methodology is very efficient and popular.

As for CC focusing more on methodology more than actual "security" keep in mind that infosec is more than just penetration testing. It is a comprehensive examination of all of the tenants that are part of bringing a product through the lifecycle. This includes physical and logical security of the development environment, supply-chain security, HR hiring practices, development methodology, and obviously security evaluations of the product itself including a deep understanding of the design, architecture, functional specs, and -- in some cases -- a source code review.

In this regards, CC is similar to other evaluations. Take a look at PCI-DSS (credit card handling): they have physical security, development processes, HR hiring, etc. in there as well.

I understand you want to stand out, and there are certain other evaluations that may be of more interest to you such as industry-based certifications (almost every industry has one), a recognized penetration test (if this is where you think you are weak), and even independent source code reviews.