A few days ago, the ICCC21 (International Common Criteria Conference),, was held, the international reference conference on Common Criteria.
Once again, this year, it was attended by top-level speakers who covered different topics related to automation, standardisation, new cybersecurity schemes, new uses of Common Criteria...
But this year`s edition was special for us, as we decided to collaborate as Supporting Sponsor, which allowed us to have much more contact with the attendees and to be able to share our services in a virtual stand, as it was held, for the second consecutive year, online.
Taking into account the great effort involved in creating an internationally recognised evaluation methodology, which requires years of work and involvement by numerous public and private entities in different countries, the most viable proposal is to automate processes, thus saving time and money when carrying out a cybersecurity evaluation.
The product remains in the List of Certified Products for 5 years, as long as there is no vulnerability that affects the certified version and therefore entails the revocation of the certificate. Once this time has elapsed since the certificate was issued, the product goes to the Archived Certified Products List, unless the validation time is extended using the appropriate procedures for this purpose. There is a procedure called Assurance Continuity developed to allow manufacturers to keep their product certified to the latest version.
After a detailed accreditation process by ENAC and CCN that took several months of effort and preparation, last August 19th, we officially obtained the accreditation as a Common Criteria laboratory. A great honor and commitment that makes us give the best of ourselves in this new chapter in the history of jtsec.
CMVP is committed to the creation of tools to automatize the processes and procedures related to the evaluation and testing of cryptographic modules FIPS 140-2 and FIPS 140-3 to address the problem of long delays. At jtsec we welcome this type of initiatives, as the promotion of automatization in the processes used in cybersecurity certifications has been part of our nature since the beginning.
