sec-certs: Examining the security certification practice for better vulnerability mitigation

arXiv:2311.17603v2 Announce Type: replace
Abstract: Products certified under security certification frameworks such as Common Criteria undergo significant scrutiny during the costly certification process. Yet, critical vulnerabilities, including private key recovery (ROCA, Minerva, TPM-Fail...), get discovered in certified products with high assurance levels. Furthermore, assessing which certified products are impacted by such vulnerabilities is complicated due to the large amount of unstructured certification-related data and unclear relationships between the certified products. To address these problems, we conducted a large-scale …

arxiv certification certs cs.cr mitigation practice sec security security certification vulnerability vulnerability mitigation