Okay, so when is Apple going to certify against any standards[1][2] higher than "Applies when you require confidence in a product's correct operation, but do no

Okay, so when is Apple going to certify against any standards[1][2] higher than "Applies when you require confidence in a product's correct operation, but do not view threats as serious."[3] with a security standard, AVA_VAN.1, whose objective is: "A vulnerability survey of information available in the public domain is performed by the evaluator to ascertain potential vulnerabilities that may be easily found by an attacker. ... Penetration testing is performed by the valuator assuming an attack potential of Basic." [4][5]. On page 25 of [1], we can see the security auditing done as part of their only official security certification for the iOS was: "The evaluators searched for publicly known vulnerabilities applicable to iOS using the following sources... The search was performed on multiple occasions between... using the following search terms... The valuator's CVE search found no vulnerabilities apart from the ones listed in the developer's security content disclosure statements, all of which have been fixed in subsequent releases on iOS. The validators reviewed the work of the valuation team, and found that sufficient evidence and justification was provided by the valuation team to confirm that the evaluation was conducted in accordance with the requirements of ..." tl;dr The evaluation process is that they do a web search of key words, check that all the publicly disclosed vulnerabilities have been patched, then call it a day. To put that into perspective, their are certifying against AVA_VAN.1. It is only at AVA_VAN.2 that the evaluator is required to do any independent vulnerability analysis as seen in [5] Page 155 AVA_VAN.2.3E (bold is changes from the previous level). At AVA_VAN.3 you need to evaluate against "Enhanced-Basic" attack potential. It is only at AVA_VAN.4 that you need to evaluate against attackers with a "Moderate" attack potential. At AVA_VAN.5 (the highest level) you need to evaluate against attackers with a "High" attack potential. Apple's only security certification, which in their own words "provide a measure of confidence—that is, security assurance—that the security needs of a system are being satisfied" and are "used by many organizations as a basis for performing security evaluations of IT product" is wholly three levels below "Moderate" and is effectively self-graded. Until they actually certify against a standard requiring moderate security, it is only prudent to take them at their word and assume that their products are only fit for systems that "do not view threats as serious". If they want their security to be taken more seriously they should prove it against internationally recognized standards assessed by independent third parties rather than issuing unsupported marketing fluff. [1] https://support.apple.com/guide/certifications/ios-security-certifications-apc3fa917cb49/1/web/1.0 https://support.apple.com/guide/certifications/ios-security-... [2] https://support.apple.com/library/APPLE/APPLECARE_ALLGEOS/CERTS/st_vid11146-vr.pdf https://support.apple.com/library/APPLE/APPLECARE_ALLGEOS/CE... [3] https://www.cisa.gov/uscert/bsi/articles/best-practices/requirements-engineering/the-common-criteria https://www.cisa.gov/uscert/bsi/articles/best-practices/requ... EAL1: Functionally Tested [4] https://commoncriteriaportal.org/files/ppfiles/pp_md_v3.1.pdf https://commoncriteriaportal.org/files/ppfiles/pp_md_v3.1.pd... Page 136 Section 5.2.6 AVA_VAN.1 [5] https://www.commoncriteriaportal.org/files/ccfiles/CC2022PART3R1.pdf https://www.commoncriteriaportal.org/files/ccfiles/CC2022PAR... Page 154 Section 14.3.3