4 ms·
Is there any kind of independent organization from which networking device vendors can seek security certification? E.g., they get to review all hw / sw / firm
by DoofusOfDeath 6y ago
Is there any kind of independent organization from which networking device vendors can seek security certification?
E.g., they get to review all hw / sw / firmware, and if appropriate make a public affirmation that they could find no vulnerabilities for that stack?
- edoceo 6y agoUL need to step up their game
- marcan_42 6y agoMost of the time such reviews are not practical; they cost too much money and don't deliver results. Such review industries are almost always all about the rubber stamp and don't end up employing competent reviewers. See e.g. the Infineon ROCA flaw that FIPS certification didn't catch (even though that code reeked of them being too clever, and should've gone through proper cryptanalysis). See: flaws in the FIPS YubiKey (specific to that version! The certification requirements introduced vulns!) See: every audit of every terrible CA ever.