Security certification is a snapshot, and buyers read too much into it
In this Help Net Security video, Mariia Bakhtina, a research specialist at Masaryk University , explains what a Common Criteria or FIPS-140 certificate does and does not promise.
In this Help Net Security video, Mariia Bakhtina, a research specialist at Masaryk University , explains what a Common Criteria or FIPS-140 certificate does and does not promise.
In her team’s analysis, about 6 in 10 vulnerabilities matched to certified products, smartcards aside, were disclosed after the certification date.
She also describes sec-certs and SCRUTINY, two open-source tools her lab builds, and the one question buyers should put to a vendor.
It doesn’t tell you what’s been found since, or what’s been changed.
In our 2024 analysis, roughly 6 in 10 of the vulnerabilities matched to certified products, smartcards aside, were disclosed after the certification date.
In the first hour, I think they’d look for a few things: the exact product name and its version, the assurance level (along with the considered threats, assets and covered security requirements), what the evaluated configuration is, and what’s declared out of scope.
And then the document would stop helping for the reason that it’s a snapshot of the product in the past.
Covering all of those could take more than 1 hour if the procurement manager is not familiar with the certification scheme details (e.g., how the documents are organized).
Once the documents are searchable, you can check all of that quickly.
Very often that target is based on a Protection Profile for the product type, like smartcards, and you find the certificate, see whether it’s still valid or already archived, and see whether a newer version or re-certification exists.
You can also follow what the document refers to, like the certified hardware or library the product is built on, or the Protection Profile it uses as a baseline.
Meanwhile, security labs check which certificates in the categories of their expertise will expire soon and through this find the potential customer for testing as a part of re-certification.
We highlight that the detected matches are indicative and should be verified.
What happened
In this Help Net Security video, Mariia Bakhtina, a research specialist at Masaryk University , explains what a Common Criteria or FIPS-140 certificate does and does not promise.
In her team’s analysis, about 6 in 10 vulnerabilities matched to certified products, smartcards aside, were disclosed after the certification date.
She also describes sec-certs and SCRUTINY, two open-source tools her lab builds, and the one question buyers should put to a vendor.
What changed
It doesn’t tell you what’s been found since, or what’s been changed.
In our 2024 analysis, roughly 6 in 10 of the vulnerabilities matched to certified products, smartcards aside, were disclosed after the certification date.
Who is affected
In the first hour, I think they’d look for a few things: the exact product name and its version, the assurance level (along with the considered threats, assets and covered security requirements), what the evaluated configuration is, and what’s declared out of scope.
And then the document would stop helping for the reason that it’s a snapshot of the product in the past.
Why it matters
Covering all of those could take more than 1 hour if the procurement manager is not familiar with the certification scheme details (e.g., how the documents are organized).
Once the documents are searchable, you can check all of that quickly.
Technical details
Very often that target is based on a Protection Profile for the product type, like smartcards, and you find the certificate, see whether it’s still valid or already archived, and see whether a newer version or re-certification exists.
You can also follow what the document refers to, like the certified hardware or library the product is built on, or the Protection Profile it uses as a baseline.
Response
Meanwhile, security labs check which certificates in the categories of their expertise will expire soon and through this find the potential customer for testing as a part of re-certification.
What security teams should do
We highlight that the detected matches are indicative and should be verified.
Attribution
Help Net Security: In this Help Net Security video, Mariia Bakhtina, a research specialist at Masaryk University , explains what a Common Criteria or FIPS-140 certificate does and does not promise.
What to watch next
Watch for additional victim details, indicators of compromise and follow-on exploitation reports.