sec-certs: Examining the security certification practice for better vulnerability mitigation

Result code in IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F00216224%3A14330%2F24%3A00136553" target="_blank" >RIV/00216224:14330/24:00136553 - isvavai.cz</a>

Result on the web

<a href="https://www.sciencedirect.com/science/article/pii/S0167404824001974" target="_blank" >https://www.sciencedirect.com/science/article/pii/S0167404824001974</a>

DOI - Digital Object Identifier

<a href="http://dx.doi.org/10.1016/j.cose.2024.103895" target="_blank" >10.1016/j.cose.2024.103895</a>

Result language

angličtina

Original language name

sec-certs: Examining the security certification practice for better vulnerability mitigation

Original language description

Products certified under security certification frameworks such as Common Criteria undergo significant scrutiny during the costly certification process. Yet, critical vulnerabilities, including private key recovery (ROCA, Minerva, TPM-Fail...), get discovered in certified products with high assurance levels. Furthermore, assessing which certified products are impacted by such vulnerabilities is complicated due to the large amount of unstructured certification-related data and unclear relationships between the certified products. To address these problems, we conducted a large-scale automated analysis of Common Criteria certificates. We trained unsupervised models to learn which vulnerabilities from NIST’s National Vulnerability Database impact existing certified products and how certified products reference each other. Our tooling automates the analysis of tens of thousands of certification-related documents, extracting machine-readable features where manual analysis is unattainable. Further, we identify the security requirements that are associated with products being affected by fewer and less severe vulnerabilities. This indicates which aspects of certification correlate with higher security. We demonstrate how our tool can be used for better vulnerability mitigation on four case studies of known, high-profile vulnerabilities. All tools and continuously updated results are available at https://sec-certs.org.

Czech name

—

Czech description

—

Type

J_imp - Article in a specialist periodical, which is included in the Web of Science database

CEP classification

—

OECD FORD branch

10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)

Project

Result was created during the realization of more than one project. More information in the Projects tab.

Continuities

P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)

Publication year

2024

Confidentiality

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Name of the periodical

Computers & Security

ISSN

0167-4048

e-ISSN

1872-6208

Volume of the periodical

143

Issue of the periodical within the volume

103895

Country of publishing house

GB - UNITED KINGDOM

Number of pages

13

Pages from-to

1-13

UT code for WoS article

001248232600001

EID of the result in the Scopus database

2-s2.0-85194461698