6

ACME makes a product that is used in some security-sensitive applications. There are no particular security regulations or industry standards in the domain of this product. ACME's business arm would like to claim that “we're 150% more secure than our competitors”. ACME's customers would be more prone to believing that if the claim was backed by some kind of independent assessment. ACME's ethical arm would appreciate if such an independent assessment did in fact validate something about ACME's product's security.

It seems that the answer is to have ACME's product undergo some form of certification, the most obvious candidate being a Common Criteria certification. This looks like a daunting process; there isn't even an existing protection profile to hang onto, and CC certification introduces a large delay between the time a product version is finalized and the time it can be released. Also CC seems to validate methodology more than security. Are these somewhat uninformed opinions of CC founded? Are there alternatives to CC?

The French government has recently introduced a “first-level security certification” (CSPN), which is based on a lighter approach than CC: roughly speaking, a government-approved evaluator spends a predefined number of man-days doing gray-box attacks with respect to a PP. This would seem like an ideal solution, except that CSPN is completely unknown outside France. Is there a more internationally recognized certification that is analogous to CSPN?

1 Answer 1

5

I'm a CC evaluator with CGI Canada. Hopefully I can answer some of your questions.

I'm not entirely certain that CC is the most obvious choice. Common Criteria -- at least for the Canadian scheme -- cannot simply be purchased (this might be different in other jurisdictions, but I think France is similar). The product has to support the security posture of the Cdn gov't. What this means is that if similar products are not in use in the Cdn gov't, critical infrastructure, and associated services, and is not seen as being one of a handful of emerging technologies that will be implemented, then it is unlikely you could even start a CC program.

With that said, let's assume that you have a product that could go into the CC program. There's no stipulation that states the product has to be finalized before the CC program can start. There is only the stipulation that the product not change in specifications while the evaluation is going on. It is entirely common for a developer to be actively building a product while undergoing an evaluation. This just-in-time evaluation methodology is very efficient and popular.

As for CC focusing more on methodology more than actual "security" keep in mind that infosec is more than just penetration testing. It is a comprehensive examination of all of the tenants that are part of bringing a product through the lifecycle. This includes physical and logical security of the development environment, supply-chain security, HR hiring practices, development methodology, and obviously security evaluations of the product itself including a deep understanding of the design, architecture, functional specs, and -- in some cases -- a source code review.

In this regards, CC is similar to other evaluations. Take a look at PCI-DSS (credit card handling): they have physical security, development processes, HR hiring, etc. in there as well.

I understand you want to stand out, and there are certain other evaluations that may be of more interest to you such as industry-based certifications (almost every industry has one), a recognized penetration test (if this is where you think you are weak), and even independent source code reviews.

3
  • Thanks. My industry doesn't have a certification yet, and we're more or less in the process of establishing one, which is why I'm trying to understand where we're heading. I think CSPN qualifies as a recognized (but only in France) penetration test. Dec 7, 2011 at 18:26
  • I should add that just because CC is used by the gov't doesn't mean it can't be used by private industry as an evaluation framework. Our lab does out-of-band evaluations for private clients who want the assurance work but don't require the publicity that goes with it. Of course, many people -- such as ACME in this case -- want and need the publicity as well. Dec 7, 2011 at 23:22
  • Note that CC is used very differently in Europe. Meaning that there is no need for any kind of government use in order to CC evaluate a product. There is also no "CC program" that I know of that you need to be part of. In France and Germany any company (or even individual) can go to the certificate authorities and apply for a CC certificate. Takes money, effort and proper product development, and whether it's worth it you have to judge yourself. As for methodology vs security - depends very much on what and how you chose your certification, i.e. EAL level, SARs etc.
    – ndbd
    Jan 31, 2017 at 12:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .