The value of CC EAL certification
Posted Sep 30, 2004 13:38 UTC (Thu) by scripter
Parent article: Mandrake shoots for EAL5
The typical scenario with CC certification is that to sell to a government, they want your app or your OS to be CC certified. So you say "We'll get version 2 certified". You sign a contract for the gov to buy version 2 of your product. While you're working on CC certification, the gov starts using the app, even though it's not certified yet because certification takes a long time.
During the certification process, you realize that there are several (perhaps 300) EAL targets that your app, OS or dev process should meet at EAL5 to be considered secure. But you can only meet two targets. So, you produce the documentation to show that you can satisfy those two EAL5 targets, and now your app or OS is EAL5 certified! Maybe another competitive app is certified at EAL5 for fifty EAL targets -- but few people care really, because now that you've completed a lot of red tape, you can sell your app to even more governments and banks, etc.
By the time you've completed EAL5 certification with a lot of hand waving, perhaps you've produced versions 3, 4, 5, and 6 of your application. The government can still use the latest version of the app, even though it wasn't the one that was certified -- as long as some previous version was certified.
So, CC certification is a lot of hand waving. It might give some semblance of assurance, but it's almost meaningless to compare two competing apps that are EAL5 certified without looking at how many targets each actually met. The real reason for CC certification is so that you can sell your app to governments in several countries.
to post comments)