A Quantitative Analysis of Common Criteria Certification Practice
نویسندگان
چکیده
The Common Criteria (CC) certification framework defines a widely recognized, multi-domain certification scheme that aims to provide security assurances about IT products to consumers. However, the CC scheme does not prescribe a monitoring scheme for the CC practice, raising concerns about the quality of the security assurance provided by the certification and questions on its usefulness. In this paper, we present a critical analysis of the CC practice that concretely exposes the limitations of current approaches and provide directions to improve the practice.
منابع مشابه
Mind the Gap: Formal Verification and the Common Criteria (Discussion Paper)
It is a common belief that the rise of standardized software certification schemes like the Common Criteria (CC) would give a boost to formal verification, and that software certification may be a killer application for program verification. However, while formal models are indeed used throughout high-assurance certification, verification of the actual implementation is not required by the CC a...
متن کاملA Common Weight Data Envelopment Analysis Approach for Material Selection
Material selection is one of the major problems in manufacturing environments since the improper selected material may lead to fail in the production processes and result in customer dissatisfaction and cost inefficiency. Every material has different properties which should be considered as major criteria during the material selection procedure. Selection criteria could be quantitative or quali...
متن کاملCommon Criteria certified open source software - fact or fiction?
In 2012 the two open source projects CESeCore and EJBCA were Common Criteria certified [CCP], using open source tools and open source methodologies. As the actual software and its long term evolution is perhaps the most important result for most users, we will look at how certification, distribution and maintenance is managed. Can they be done in an open source way, and is certification always ...
متن کاملExamining Security Certification and Access Control Conflicts Using Deontic Logic
Component-based software has become a mainstream practice as organizations attempt to streamline application development tasks. These applications invariably contain third-party Commercial-off-the-Shelf (COTS) systems with black box functionality. When integrated applications require security certification, COTS components, even if individually certified, may introduce vulnerabilities into the ...
متن کامل