A network camera with a security certificate sounds reassuring. Less reassuring: the evaluation may assume the network itself can be trusted. Masaryk University researcher Mariia Bakhtina says her team encountered a certified camera with that assumption. The certificate and the buyer can be answering rather different questions.
In a November 6 interview with Help Net Security, Bakhtina explains what Common Criteria certification and FIPS 140 validation actually promise. Her useful starting point is scope: the product, version, configuration and security functions examined. "Certified" is a very short word for an answer that has boundaries.
I like independent testing. I'd rather have a supplier offer something I can examine than another paragraph about how seriously it takes security. But a badge in a proposal can end a conversation precisely where the interesting part begins.
The part inside the product
FIPS 140 deals with cryptographic modules, the components that perform encryption and related operations. NIST's own guidance distinguishes a validated module from a larger product containing it. That larger product cannot claim the module's validation as its own. NIST also says validation doesn't establish that the surrounding product uses the module correctly.
That's a useful distinction even if you never read a cryptography paper. A tested component gives you something concrete to rely on. It doesn't explain every other thing the software does with your files.
For an illustrative purchase, suppose you're comparing two file-transfer products. One proposal prominently mentions validated encryption. Your main concern is whether a departing employee can still retrieve customer documents. Encryption and access removal are different questions. The certificate may be relevant to the first while leaving the second unanswered. Paying a premium for one doesn't buy an answer to both.
A useful page beats a reassuring badge
The research team's sec-certs project makes public security certification documents searchable and links related certificates and possible vulnerabilities. It's a route into the evidence. Bakhtina cautions that automated vulnerability matches need verification; a match alone isn't proof that the product you're considering is affected.
You don't have to become the person who reads every appendix. For a purchase where certification matters, I'd start by writing one plain sentence about the protection you're paying for. Keeping files unreadable on a lost device, for example. Then have the supplier connect that sentence to the relevant certificate and the exact model or software version in the quote.
If the answer involves a different version, an optional setting or a component inside the product, that detail belongs in the buying conversation. It may be perfectly reasonable. It may change which product fits. Either way, you've learned something the badge couldn't tell you.
A good certificate is worth reading. The most useful page is the one that explains where its promise ends.
Sources and further reading
