All of us in the world of cybersecurity certification (manufacturers, laboratories, certification bodies...) face constant challenges, given the very nature of the products we evaluate and the speed at which they change. However, for some time now, there is an issue that has become particularly relevant: the speed of obtaining certification in order to comply with the time to market of the products.
Time to market, does it make sense to need almost a year to obtain a cybersecurity certification?
This is one of the issues to be resolved in the short term, especially for manufacturers, who want to get their product in the market under certification as soon as possible. In some cases, from the time certification begins until it is obtained, the product has undergone several modifications, and even versioning, which means an insurmountable gap.
It can take a year, or even more, from the time the product developer is interested in the product until certification is achieved. As an example, we will take the estimated times for obtaining a Common Criteria certification with an EAL 2, the maximum level of security recognised by the CCRA (Common Criteria Recognition Arrangement).
As can be seen in the timeline above, which corresponds to a Common Criteria EAL 2 certification, the effort takes no less than 30 weeks. Although it is fact that, on occasions, certain vulnerabilities are found in the product that must be corrected by the manufacturer, which means weeks of work to improve the product. But how can we speed up this process?
Automation, the only possible way?
Taking into account the great effort involved in creating an internationally recognised evaluation methodology, which requires years of work and involvement by numerous public and private entities in different countries, it does not seem, at least in the short to medium term, that the solution is to lighten the amount of work involved in certification in a substantial modification of the different standards. Therefore, right now, the most viable proposal is to automate processes, thus saving time and money when carrying out a cybersecurity evaluation.
At jtsec, we have always believed in and supported automation and the creation of a common framework that uses tools to smooth certification processes. .
Automation in Common Criteria
Common Criteria is an evaluation methodology with a significant workload in terms of documentation, involving several weeks of effort and continuous modifications during the process.
Therefore we created tools such as CCGen for the creation of Common Criteria documentation and CCEval to automate the evaluation. In addition, thanks to funding from the European Commission in the framework of the Connecting Europe Facility (CEF) programme, we are developing CCCAB (Common Criteria Conformity Assessment Body), which will be a free open source tool that will allow Common Criteria CABs of the new EUCC scheme to smooth the certification process of ICT products.
In the last ICCC21 held a few days ago, we had the opportunity to reflect on automation in cybersecurity in general, and more particularly in Common Criteria, showing CCToolbox as the most feasible tool on the market today.
This talk called Automating Common Criteria was conducted by José Ruiz. Stay tuned because next week we will publish a post where we will include links to all the talks in which jtsec participated in ICCC21.
How do we smooth the evaluation process at jtsec?
Having unique tools allows us to speed up the process, being much more competitive than other Common Criteria labs. In addition, saving time and effort is a decisive factor in giving our customers peace of mind in the knowledge that their product will be on the market on time.
We provide our customers to use our tools during the consultancy process, thus working under the same framework that enhances the flow of information and the transmission of documentation between both parties.
Furthermore, at jtsec, we have made a firm commitment to automation with the creation of a development department that currently employs 7 people.
If you are considering to obtain a Common Criteria certification for your product, do not hesitate to contact us, we will go together with you throughout the process for your peace of mind.
