Riding the tiger

The 14th ICCC is now over. 

As you know, we were hoping to see a new CCRA announced but it seems that was an over-optimistic expectation. There has been no new version of the CCRA signed, and it seems that there are still open issues, matters of interpretations which need to be resolved and of course the long and winding road of ratification by each of the nations.

The good news is that there is an agreement in principle that a new CCRA is needed.

In fact during the conference we heard several estimates of tasks and milestones from the CCDB and CCMC chairs on this topic. Since in a previous blog we suggested that a simple Gantt chart might be useful in visualizing this we present a simple chart here, both the optimistic and the pessimistic scenarios. Probably the new CCRA will be with us somewhere between the best and worst case; i.e., sometime between the beginning of 2016 and mid-2018.

 
We have previously raised some of our concerns relating to the CCRA vision in our blog. 
But, and this is important, the impressions we gained from this conference is that some of these issues are at long last being discussed much more actively and openly than ever before with the CCUF. Both in the formal presentations to the conference attendees and also on a one-to-one basis with the participants at the conference. We can hope that with this openness also comes a little more understanding for the concerns in respect of the position from all CCRA nations, both new and old as well as from other stakeholders represented through the CCUF. The opening and closing presentation of the CCMC and CCDB chairs surprised us. 

This time we were positively surprised. Thank you for listening.

We also heard, at last, the confusion caused by mixing up the CCMC vision and national policies being addressed through clearer communication about what is the purview of the CCMC and which is a national approach. One contribution to this clarity is that the CCDB and national schemes are using recently coined terminology more precisely and not re-using terminology for similar, but nevertheless different concepts. It is vital that similar yet different terms are clearly distinguished if we are to avoid wasting time due to issues of fear, uncertainty and doubt.

Some high-lights of the conference:

•    The collaboration between the CCRA community and the CCUF was very evident. We also heard from both the CCMC and the CCUF a clearly stated intent to involve the end-user community in the future. (The assurance consumers.)

•    The CCUF are growing, leading the community, becoming a force for change, can move relatively quickly, are gaining momentum and is proving to be a much respected organization.

•    Although we are not allowed to see any of the 17 drafts of the proposed CCRA agreement, we are made aware that, with so many revisions, the discussions have involved a lot of hard work...

•    The transition period for the new CCRA is 36 months once it is fully signed. Alas it is estimated that it will take at least a year and maybe two before all the nations complete their bureaucratic dance.

•    As of this moment we have no available cPPs. 

We believe that it is necessary for the key cPPs to be in place as soon as the CCRA is signed and a great many more of them must be in place before the 36 month transition period ends.

The CCDB chair estimated that 10, 20, or more cPPs might be possible by next year. Let's see if that is possible. 


•    Several schemes have expressed that they will continue to do medium and high assurance certification, while at the same time participate in the cPP development. This means that there will not be high or low assurance schemes, but schemes that are committed to both and will allow end users to select the assurance they need.

•    India is a new CCRA certificate authorizing member. This is important, not only because India is a large nation, but because they have been the only nation so far to ask for certification of telecom products.

...and some low-lights:

•    The CCRA has 26 nations all over the world. So how is it that we have a marketing panel of U.S. vendors only discussing primarily how to market the CC to the U.S. DoD? The CCUF, although dominated by the U.S., must take great care to make sure that all the CCRA nations are properly represented. An important working group like this, composed of members from only one nation is not credible.

•   One thing to note is that the CCUF has no way to move things forward without the CCDB authorizing that. The CCUF can suggest a cPP but only the CCDB will say "yes" or "no." 

Summary

Not only did we receive positive comments on our “activism” but interestingly references to the atsec blog were made in plenary, formal presentations, and by many individuals at least once a day during the conference. We heard little dissent about our blog, although we recognize that an approach relying on informal public discussion  is a difficult one for government folks to be able to contribute.

There will be a long ride with the tiger. The discussions, development and implementation of the new CCRA framework will not be over soon. During this process it is important not only to understand the technical underpinning of the Common Criteria, but also the technical and political issues involved with the standardization processes.

Finally, it would be appreciated if the CCDB could agree on the location of the next ICCC, at least “in principle."

By Staffan Persson

P.S. If anyone is interested to receive the atsec material we showed at our conference booth (pictures and clips) as well our presentations and other material please send us an email request to  info@atsec.com

Marketing the CC: It's all about Trust

Shall we call our new product "honey" or "bee vomit"?

When it comes to selling products, you need to choose your words wisely, or you might offend your customers and not sell anything at all. Still, just using some wording to hide your intentions most often only buys you some time until your customers realize that your 97% fat-free yoghurt was not so fat-free after all. (I'd rather go for a 100% fat free beer, just to be safe :-).

While starting to pack my stuff to leave for Orlando, I am wondering about some of the wordings we have been accustomed to, and I also wonder how much of a marketing event the upcoming ICCC is going to be, and for whom.

 

One of the key aspects of marketing the CC is that it is a brand. It’s not a product brand (such as those marketing their products use.) Instead it is a brand associated with the trust that others may place in the products sporting the logo. The Common Criteria logo is a registered trademark*, and its use is regulated, because it has value. The CC brand is all about trust.
 

But what is the value of the brand? A brand conveying trust must be recognised for trust: Criteria including credibility, who is supplying the trust, core values of the CCMC, the goals of the CCRA, openness and transparency, etc.

Even the name itself is a key part of the brand: "Common Criteria."* To what does the "common“ refer: The standards containing the criteria, the framework in which they are applied, or both?

Perhaps the "Common Criteria"* brand, as we have previously established it, used it and relied upon, is eroding.

Do we still have a common understanding about what assurance the certificates provide? Are the customers really prepared to trust a certificate, no matter where it comes from? With every cPP defining its own evaluation methodology, disregarding the Part 3 of the CC as the common assurance framework, can we really claim these this to be  either "common“ or "criteria“ at all, and still respect the common framework that has been built over the years?

For the upcoming ICCC panel discussion on "Marketing the CC," I am curious what the topics will be. I have myself some ideas for promoting the acceptance of the "New CC" (did you notice that there are no "New CC" standards? That's probably just another marketing gag.):

1. What are the goals of the CCRA?

The CCRA is the basis for conveying trust. The CCRA has been used for establishing trust supporting commercial trade as well as for helping establish some of the security assurance for those involved with government systems, or even a simply subsection of government organizations.

One of the goals of the CCRA is to support international trade and to support national vendors and developers in their goal to be successful globally. To support this goal it is important that national certificates are accepted by other governments and companies globally. In that scenario it's not helpful if the organization that is your national scheme has core competences including clandestinely break into systems; eaves-dropping on communications and disseminating disinformation. It makes sense to entrust those agencies with your national computer security, but it works really poorly in the international arena. Others just have a hard time to figure out if the schemes are honest or fooling them again.

Signed by many of the worlds key national security agencies, some nations have forgotten or sidelined that commercial goal and as the world changed have not promulgated that CC may be used outside of systems needing higher assurance than national security systems.

At least some of the certificate-issuing nations have built their scheme outside their intelligence community; for example, Turkey has chosen the national standards body to host its scheme. Although such a change is probably very hard for most nations. The U.S. originally envisaged this by founding the National Information Assurance Partnership (NIAP) with both the NSA and the NIST as two signatories of the CCRA. (although of course the current situation is that NIST's currrent involvement is restricted to support of the NSA led scheme by accrediting labs to the US 17025 equivalent.) As a major certificate issuing nation the U.S. could show commitment and leadership by having NIST come back into its original issuing role for the commercial sector.

My hope here is that the CCUF will break up the navel-gazing of government agencies for their own procurement, supposing that „if it's good for us, it's good for everybody else“. The CCUF should open the view into other markets, acknowledging that different markets have different assurance requirements, even for the same product type. "A good marketing organization listens to its customers. We hear you!", if you get my drift :-)

At least if providing assurance to others outside national security systems is no longer a goal of the CCRA then that change should be clearly communicated.

2. In whom do we place our trust?

My understanding is that the CCMC is responsible for managing the international agreement that is the CCRA.

Today, center stage in the CCMC is provided to partners from the "five eyes" club, their contractors and collaborating companies.

When thinking about about marketing, it makes me wonder if this is such a good idea. Clearly, it is expected of the hosting country to provide some focus on how the CC are used locally, but given the current propaganda about the "five eyes“ club members being involved in massive spying on their and other nation's citizens, I'd rather suggest a more open debate on how, given the associations, that issue might affect the CC brand. What effect does this have on end-users and consumer nations perceptions and on trust in the certificates issued?

3. Credibility:

The CCRA is first and foremost about the trust that the signatory isssuing nations have vested in the awarded certificates.

The CC & CEM are standards intended to be used by many nations, and provide at least part of the basis of trust for the CCRA. They are internationally agreed standards. When the CCDB was first established it was intended that the standards become international standards, and indeed they were submitted to ISO and fast tracked as ISO/IEC 15408 and ISO/IEC 18045. The CCDB is a closed community whose task was to bring together the various national criteria from various national agencies, ISO’s role was to be to foster open development allowing input from the commercial community and from IA experts around the globe. This happened and for a while the two communities worked together to keep the two sets of standards in line as the CC and CEM evolved. Of course as we can observe, the CCDB did not "let go" of the standards development (as was intended) and the current CCRA specifies equivalency to a particular version of the IS standards, and so ISO is "stuck in the doldrums" by staying in synch with currently unmaintained standards, and allowing for loopholes that allow signatory nations to bypass the CCRA by specifying the current ISO standards as national standards hence allowing them to produce national policy which is outside of the intention of the CCRA.

Of course this may not be so simple when governments, in order to save money, are specifying that COTS products be used in national security systems wherever possible. While that is, of course, a matter of national perogative the credibility issue that ensues is when the morphing of the CC paradigm, and the policies surrounding cPPs are seen to be a thinly disguised method of converting COTS (that draw requirements from the larger global market) to GOTS (that draw requirements from the government specifications).

4. Transparency:

Another mistake being made is that the "5 eyes club" seem to be subverting the CC brand by morphing the whole CC paradigm into a low-assurance one. The flexibility of picking appropriate assurance, that is the corner-stone of the CC is being removed. Unspoken, but visible through observation, are the close similarities between the current US approach and the UK’s CPA scheme. While that is a perfectly valid approach to address national assurance requirements, it’s a huge marketing mistake that undermines the CC brand.

You see, it‘s not CC at all (it is one perfectly valid corner use-case for CC), but it is being being sold to consumers as the "new CC." That is a huge marketing mistake and leads to issues of reduced credibility and opaqueness! By some definitions the tactic could even be defined as fraud or counterfeiting.

The forthcoming ICCC panel discussion on "Marketing the CC" is scheduled with U.S. panelists only, and the panel discussion about "Widening the use of CC for End users Worldwide" originally had just one European telecom supplier as the only panelist not too deeply entangled with the "five eyes" intelligence community. This supplier does not even have any CC-certified products . Now let's see whether the panel will include another developer who do pursue CC certification on this basis. Perhaps the brand would be much enhanced if the program committee put national politics to one side and reflected the diversity that is CC? Allowing Europeans, and Asians, and perhaps even developers that use the CC that are headquartered outside a CC signatory nation.

5.Don't change everything at once:

The CC standards have been a success story in the past not because of new features added every month, but because it distilled decades of experience with security evaluations into a commonly accepted framework. Back then, the CC actually marketed themselves.

As in every aging house, renovations are due every now and then. If you don't like your house anymore, it's even o.k. to build a new one. However, it's quite silly to burn down the old house first and only then start to think about how to build the new, especially when other people still lived in it.

Gerald Krummeck

atsec GmbH Laboratory Manager 

* "Common Criteria" and the associated logo is a registered trademark by the National Security Agency FEDERAL AGENCY UNITED STATES ATTN: AGC (IP&T) 9800 Savage Road, Suite 6542 Fort Meade MARYLAND 207556542f

One year after the Vision Statement – What has happened in the meantime?

 
At the last ICCC in Paris in September of 2012, the CCMC published their " Vision statement for the future direction of the application of the CC and the CCRA. "

Since Dag Stroman asked me to provide comments on this vision statement, I sent him a long statement on October 4, 2012, listing my concerns. I am still waiting for the swift answer he promised and therefore I have decided to make my statement public. Please read my statement here before reading the rest of this blog.

Now it is time for a short analysis of what has happened in this time frame.

As you can see in my comments, I neither rejected (and still do not reject) the idea of cPPs nor do I reject the idea of a new CCRA. Instead I questioned (and still question) if the CCDB/CCMC has provided us with the basis necessary to achieve success in those efforts. My main criticism is that the CC and CEM do not provide the sound basis required for the development of such cPPs and that the management of the CCRA was bound to fail because of a lack of specification of the technical competence required by schemes and labs and because of a lack of elaborated procedures for the oversight of schemes and labs that would ensure comparable results.
This was not the first time I brought up those points. Just have a look at the presentation I gave in April 2012 in Cannes: Quo Vadis Common Criteria.

So, what has been done in the past year to overcome those problems?

I see at the time of writing this, that 119 Protection Profiles are listed on the CC web site. How many of those are “cPPs” developed using the vision statement? 

Not a single one! 

I acknowledge that the development of a good PP takes time, so I may ask how many CCDB accepted technical communities do we have that are close to publishing their cPPs? 

Not a single one that I am aware of (assuming that some time before publishing a cPP it should be out for public review, announced on the CC web site). 

Yes, there has been some effort to develop Protection Profiles by individual nations (especially the U.S.), but those address national requirements and have not been developed in the cooperative way required for international mutual recognition (if I follow the views of the vision statement).

I know that developing a Protection Profile in a collaborative way that also addresses the technology-specific assurance requirements is not an easy task. I have had this experience myself in the last 18 months with the participation in the development of a Protection Profile for General Purpose Operating Systems. While agreeing on the base functionality that needs to be provided was comparatively easy (but excluding nice and useful security functionality not provided by every product in this category), achieving agreement on the assurance aspects and evaluation activities was hard to impossible. Why this? Quite simple: the two operating systems taken as the “guiding examples” target very different customers, have different architectures, have very different development methods and their developers have very different views on assurance. In addition we had the view of a scheme that believes the security assessment of a product should be done by people that first have demonstrated to not have in-depth knowledge of the product (I remember in a discussion we had if in the case of the evaluation of an Open Source product the evaluator would be allowed to look into the source code and the initial reaction of that scheme was “No, this would destroy comparability of evaluations!”). The lesson learned from this experience is: if you do not start with a good common view on the assurance measures required and how they need to be addressed in the evaluation, it is highly unlikely that you will ever come to useful results!

This leads me to my main criticism of the vision statement: the CC and the CEM need to be improved significantly to be a sound basis for the development of cPPs. As I have noted in my comments one year ago: using the current CC and CEM for the development of cPPs is like using rotten building blocks to construct high-rise buildings – it is bound to fail. 

The drawbacks of the CC and the CEM were identified a long time ago and have led to some useful objectives for the development of version 4 of the CC. See the presentation of the CCDB chairperson for those objectives as defined by the CCDB in 2008 – and the difficulties that one has to deal with (mainly: overcoming subjectivity and required evaluator skills). It is interesting to see how the vision expressed in 2008 (which addressed real problems) has changed to a vision in 2012 that avoids talking about problems.

Instead of working to those objectives identified in 2008, the CCDB/CCMC did not move forward with enhancements to the CC, the CEM and the oversight of the CCRA. We still have basically the same basis that even the CCDB has identified as insufficient many years ago. Instead, we have a “Vision Statement”. What we miss are the coordinated actions required to turn this vision into reality, addressing the well-known problems and improve information assurance. Instead we see many individual and uncoordinated activities not addressing the basic problems identified long ago. As a Japanese proverb states:

Vision without action is a daydream. Action without vision is a nightmare.

... and uncoordinated actions that do not contribute to turn the vision to reality are an even larger nightmare.
 

Helmut Kurth

What I would like to hear (and not) at the next ICCC...

After 13 years, the International Common Criteria Conference (ICCC) returns to the U.S. The first three-day conference took place at the Baltimore Convention Center on May 23-25, 2000. It looks like almost the end of a cycle. In the year 2000, information assurance and use of the Common Criteria standards was firmly on the agenda of all stakeholders: government agencies, vendors, and users.

The need for mutual recognition was strongly voiced and recognized, serving as a key driver for the development of the standards, and one of the core principles for Common Criteria.
Thirteen years later, the community includes 16 certificate issuing nations and a further 10 consuming nations that have subscribed to the principles of the CCRA. Close to 80 vendor companies have registered with the CCUF, and nearly 2,000 certificates have been issued under the auspices of the CCRA.

The establishment and management of something like the CCRA is ambitious. It is a difficult task to lead the management of such an arrangement between nations, which requires supervision of proposed improvements and redefined procedures. 
 
During the years following 2000, we have seen opinions on information assurance changing, but throughout this change, all of the stakeholders agreed that it was important to keep the structure intact.

"Change your opinions, keep to your principles; change your leaves, keep intact your roots."

-Victor Hugo

Although the Common Criteria standard has evolved over the years, the last real change happened more than five years ago. Today, what is at stake are the basic principles
— the roots of the Common Criteria standard. 

Did the CCRA fail?

What I would NOT like to hear at the ICCC this year:

I would not like to see and hear just a "Dog and Pony Show," as David Martin (the CCDB chair), called his duet with Dag Stroman (the CCMC chair), during the certificate handover ceremony at a circus in Paris. This year in Orlando, the ICCC should avoid a "Goofy and Donald Duck Show," and we certainly do not want or need a Mickey Mouse standard.

An old chair

What I want is a presentation of the progress of the standard and the CCRA framework accompanying it, instead of another content-free presentation from David Martin in his role as the CCDB chair. 
For example, I recall a presentation from David Martin summarizing all the problems that CC Version 4 was going to address. Those problems have been brought up by labs and vendors for many years, and yet the CCDB has not addressed a single one of those problems in the vision statement. Have those problems magically disappeared because of the "vision?" Is there no longer a need to address the problems identified over the years, just because some people have had a "vision?"

Last year, during the ICCC presentation titled "Common Criteria in 5 years," the only message I remember is David Martin's opinion that he and Dag Stroman wouldn't be there in 5 years! I am sure this can be achieved without waiting so long!

What I would like to hear about at ICCC: 

I would like the CCMC chair, Dag Stroman,  to say something representative of all of the CCRA members and not just for the same few schemes, and I would like the CCDB chair, Dave Martin, to be open and transparent about how the standards are being developed.

Where are we heading with the standard and the future of mutual recognition through the CCRA?

We want to know, and we are paying to know. I think, after 13 years, the CCDB owes us a correct interpretation of the true direction of mutual recognition through the CCRA.

Although I speak for a lab, it is not just the business of the labs at stake; the vendors need to know what they have to do, whether they need to evaluate once or more than once, and if so, where and using which standard? This is a key point for the various signatory nations too, as they refine their national policies and strategies.

What is the status of the CCRA? 
We need to know. Please be honest and transparent.

The UK is doing CPA; is this recognized by the CCRA? Is CPA a UK-only thing, or is it recognized in the U.S., Canada, and Australia? The labs should know if they need to set up shop in the UK, and the vendors need to know if they have to pay for a special evaluation in the UK, and why.

(correction 2013-09-02)

India is asking for telco equipment to be evaluated only by Indian labs! However, their policies go beyond telecommunication equipment to require even the operating system or database used for accounting—just because they are used in a telco product—to also be evaluated by the Indian lab, even if they have been previously evaluated already.

India is asking for telco equipment to be evaluated only by Indian labs using ISO/IEC 15408 - technically outside the CCRA scope, but certainly outside the spirit of the CCRA. Their policies go beyond telecommunication equipment to even require that operating systems or databases used for accounting also be evaluated by an Indian lab  just because they are used in a telco product; even if they have been previously evaluated already.

(correction 2013-09-02)

These are just two examples of how "old" and "new" schemes are trying to change the roots of the Common Criteria standard and CCRA, in direct opposition to the principles that the users, vendors, and countries originally subscribed to. 


How do scheme-specific technical communities vs the international technical communities affect the development of cPPs?

What about SOGIS? 

How about a summary of real-world policies on mutual recognition from each of the schemes?


Where are we with the cPPs?
Dag Stroman said last year that, "cPPs are like French wine, the older they get the better they become."

The problem is that we are still waiting for the grape harvest to take place! Of course, with good wine there are bad years, and good years and much depends on the quality of the grapes. Not every wine is good, even after waiting several years. If we are using this metaphor for cPPs, I would also make the observation that a good, vintage French wine is expensive, and sometimes very expensive.

 
Vendors, Labs, and People
The vendors too should come out and be heard! Continuing this dance with the different schemes is not helping. Complying with sixteen different cheap, low-assurance schemes is unlikely to be cheaper or quicker than complying with one good one.

If the main objective of the vision is to put the labs out of business and/or put a number of information assurance professionals out of a job, the vision is succeeding! 

The vision does not take into account the people who have devoted their careers to information assurance. They are not in this field  to get rich, they are in it because they believe in it and they will continue to stay around and come together. We now have a chance to direct all our efforts in the right direction under one umbrella. Once the umbrella is gone, anything can and will happen.

Conclusion

A last message to the "Visioners," from the business side: the CC validation business is down heavily and the trend is downward. However, what is more disappointing is to be unable to guide our customers on what to do, how to do it, and particularly, how to avoid being "blackmailed" from various schemes into doing something more or something local. The vision promised cPPs developed by a Technical Community that would solve the problems. But so far the CCDB is still struggling over the criteria just to allow a Technical Community to be accepted by the CCDB. Being unable to solve this fundamental  prerequisite within a year does not give me much hope that the "vision" is anything more than just an illusion.

If you want the vision to succeed, then you need to plan on how to do this without killing the golden goose!

With this in mind, I will end with a quote from the inventor of Mickey Mouse: "All the adversity I've had in my life, all my troubles and obstacles, have strengthened me... You may not realize it when it happens, but a kick in the teeth may be the best thing in the world for you." -- Walt Disney
 
Cheers.

...sal