Security certifications are snapshots buyers overinterpret
Original title: Security certification is a snapshot, and buyers read too much into it
Research shows 6 in 10 vulnerabilities in certified products were disclosed after certification.
Mariia Bakhtina of Masaryk University explains that Common Criteria and FIPS-140 certificates are snapshots of past evaluations and do not guarantee ongoing security. In her analysis, roughly 6 in 10 vulnerabilities matched to certified products were disclosed after the certification date. She promotes open-source tools sec-certs and SCRUTINY to help buyers check certificate status and linked vulnerabilities.
- 6 in 10 vulnerabilities disclosed after certification
- Certificates apply to fixed configurations
- Validity limited typically to 5 years
- sec-certs makes public certification documents searchable
- 1.Check if certificate is still active
- 2.Use sec-certs to review vulnerability history
- Organizations
- Masaryk University
From the original article
9 min read at helpnetsecurity.com
In this Help Net Security video, Mariia Bakhtina, a research specialist at Masaryk University, explains what a Common Criteria or FIPS-140 certificate does and does not promise. In her team’s analysis, about 6 in 10 vulnerabilities matched to certified products, smartcards aside, were disclosed after the certification date.
By Mirko Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.