Subscribe to the Free Print Edition!
Celebrating 25 Years

GCN Home > 08/13/07 issue

Under attack

Common Criteria has loads of critics, but is it getting a bum rap?

By William Jackson

Pity the poor Common Criteria Evaluation and Validation Scheme. Conceived as a way to provide independent evaluation of security products against a set of standard criteria that could be accepted by end users in many countries, it has been condemned by vendors and security experts alike.

The use of evaluated security products is mandated for government networks carrying sensitive information. But vendors say the validation process is too expensive and cumbersome. Security folks say it is a paperwork drill rather than a product evaluation. Both agree that it has not made software on government systems more secure.

“Common Criteria is just something that we do,” said Wesley Higaki, director of product certification at Symantec. “We’re just going through the motions.”

“If you’re asking, is the effort worth the money, the an
Image: GCN File Photo
“You are not testing the product at all. You are testing the paperwork.”— Alan Paller, Sans Institute
swer is a resounding no,” said Alan Paller, director of research at the SANS Institute.

Trying to be all things to all people, Common Criteria has ended up pleasing almost no one. That is not to say that no one has a good word for it. But even the positive statements are damning in their faint praise.

“The scheme itself is sound,” said Jonathan Shapiro, an assistant professor at Johns Hopkins University’s Computer Science Department. Shapiro has been one of the biggest critics of the Common Criteria. “Personally I think that there is benefit — evaluation is certainly no worse than any other inspection process — but it is not cost-effective,” he said.

It is enough to make you feel sorry for the National Information Assurance Partnership, which oversees Common Criteria in the United States.

“Defending the program is a full-time effort. It is a difficult job,” said NIAP Director Audrey Dale of the National Security Agency. Dale acknowledges industry frustration with the scheme, and she said NIAP is trying to address vendors’ concerns.

More news on related topics: Communications / Networks, IT Security, Enterprise Architecture, Hardware, Software Applications



GCN Popup