>Outside Government and Military circles where I can see Common Criteria
>Certification being extremely useful, how valuable is it, ie within the
>financial sector etc ? More importantly what are it's failings?

CAVEAT: My direct knowledge of the CC is about 2 years old. Maybe things
are better. I doubt it.

The Common Criteria has all the markings of what it is: a government
created and organized, committee deliberated, process. (That's meant to be
really negative, for those who like such things, and exclaimed, "Cool!")
Notice the definition on their web page: "The Common Criteria represents
the outcome of a series of efforts to develop criteria for evaluation of IT
security that are broadly useful within the international community."

The "warning signs" are "series of efforts" and "broadly useful." (And it
is over 600 pages.) The CC is a standard for measurement. But there is no
"Firewall test," not "IDS test," etc. As long as you understand that it is
a set of specific criteria in standard format against which a vendor can
document any product, there is no problem.

Example: If we had such a thing for automobiles, you'd be able to lay a
chart for every one next to the other and compare across for the things you
cared about. They would all use standard notation for the same features.

Wait... that sounds really useful. Yes, except -- using the example I just
gave -- you have to create the tables and you have to know the code name
for each feature. Oh, and the manufacturer gets to decide what features to
highlight and what to leave out. There is no requirement to include and
specific criterion. It is *not* a Consumer Reports (sorry, I realize some
of you don't know what I mean) evaluation of products with identical
selection criteria reporting how each product fared.

Is Common Criteria useful? I don't see how it is.

Fred
Avolio Consulting, Inc.
16228 Frederick Road, PO Box 609, Lisbon, MD 21765, US
+1 410-309-6910 (voice) +1 410-309-6911 (fax)
http://www.avolio.com/

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]