4 ms·
From a security perspective, Common Criteria certification isn’t particularly meaningful. Plus, it’s not really worth getting certified at a higher level than
by barsonme 3y ago
From a security perspective, Common Criteria certification isn’t particularly meaningful.
Plus, it’s not really worth getting certified at a higher level than you need. Why expend extra effort?
- Veserv 3y agoNo. From a security perspective a Common Criteria certification to the lowest possible level does not establish meaningful security. That is kind of the point. The companies that develop easily hacked systems that are repeatedly hacked hundreds of times a year like Apple, Microsoft, Cisco, Amazon, Google, etc. can only achieve certification levels indicating they are easily hacked. They have never once succeeded at certifying meaningful security. The certification is pinpoint accurate, just the trillion dollar commercial IT companies do not like the results. I agree it is largely not a useful differentiator, but that is because all of the commercial IT vendors are certified incompetent. The Common Criteria will not help you determine which fish in the barrel is hardest to shoot. Its job is to distinguish serious security by professionals.