A security evaluation from a vendor perspective
Today I enjoyed a presentation of a company that has gone through the process of evaluating one of their products with conformance to ITSEC (similar to Common Critera). The Swedish company Stoneridge develops a product that monitors and records the behavior of the driver, a system used in many heavy vehicles for increased road safety et cetera. This is, according to the presenters, a law in the US, and will soon become one in European Union and Sweden.
They described the process from their perspective, and I reacted on three issues:
(1) They described the problems with updating/patching the Security Target, when for example fixing a bug. If the bug where to be in one of the code segments classified as Security Enforcing or Security Related, a long and costly process would have to be taken for each time this is done. They provided a piece of code for example:
If ( X > 60 ) then { … }
changed to
If ( X > 59 ) then { … }It wasn't all clear to them or the evaluators that this simple change wouldn't affect security, and it was thus close that a large part of the evaluation process would have to be re-done. In the end, they were allowed a less thorough evaluation of that specific update.
The problem with this, as I see it, is if changes to the code become to expensive for the vendor, there is a chance that they might be even more reluctant to disclose vulnerabilities, and in the end even to produce patches. This might in the end produce a system that has more undisclosed vulnerabilities and unpatched flaws than an unevaluated competitive product. If ITSEC and Common Criteria hasn't got a painless solution for certifying updates/patches, perhaps in an incremential way, products will most likely be kept secretly vulnerable.
(2) After the presentation I asked one of the presenters, whom was a software developer consultant at the company, how and if ITSEC had influenced her in here way of coding. She responded with a clearly pronounced Yes, and further stated that she is more thorough and aware of security issues. She also mentioned that the long and expensive process of doing updates to the Security Target made her act faster in turns of alerting other parties in the company and in the development process. These statements show that certifications like these indeed is positive from a security perspective.
(3) I also asked if they had calculated or evaluated the costs of transforming the product and development processes, as well as the entire organisation structure and physical defense. They responded that they had no such figures, but indicated that the costs where indeed huge. I plan to ask here if she can get that information from someone else at their company.