3 ms·

I didn’t know about ISO 15408, but as I understand from what you say, that isn’t broad or comprehensive enough to be widely used.

• Veserv 3y ago
  The Common Criteria is broadly and comprehensively used and covers most major product categories. There is no product security standard more widely used and internationally accepted and most major vendors already certify against it. It is just that they all certify at the lowest levels of compliance because they are incapable of doing better. To compare against PCI DSS, it is like everybody is compliant… at Level 4. Or like having a certified apprentice electrician wiring up your substation. It is obviously wrong and inadequate, but people have been convinced to have warm fuzzy feelings when they see the word certified no matter how low of a certification level was chosen. It is why everything gets hacked all the time, everybody is deploying systems that are certified insecure and inadequate for their operating environment.