Skip to content

DoD über CC

In einem Report (PDF) des U.S. DoD findet man folgende - doch recht amüsante - Anmerkung:
The primary process relied upon by the DoD for evaluation of the assurance of commercial products today is the Common Criteria (CC) evaluation process. The task force believes that Common Criteria is presently inadequate to raise sufficiently the trustworthiness of software products for the DoD. This is particularly true at Evaluation Assurance Level-4 (EAL4) and below, where penetration testing is not performed. Nonetheless, Common Criteria evaluation is an international program, well established, and not easy to change.
Es ist interessant zu sehen, dass einer der Haupt-Initiatoren der Common Criteria nun erkennt, dass diese nicht sehr nützlich ist - und was noch viel interessanter ist - nicht so einfach geändert werden kann, da diese nun im Standardisierung-Morast festsitzt. Auf den Report hat übrigen's Oracle's CSO Mary Ann Davidson hingewiesen.


No Trackbacks


Display comments as Linear | Threaded

No comments

Add Comment

BBCode format allowed
Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
E-Mail addresses will not be displayed and will only be used for E-Mail notifications.
To leave a comment you must approve it via e-mail, which will be sent to your address after submission.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.