Security certificates are a point-in-time snapshot, and buyers over-rely on them

Mariia Bakhtina of Masaryk University explains what Common Criteria and FIPS-140 certificates do and do not promise. Her team's analysis found that about 6 in 10 vulnerabilities matched to certified products, smartcards aside, were disclosed after the certification date. She also presents the open-source tools sec-certs and SCRUTINY, which her lab builds.

For IT people · Written by AI from 1 source · Wrong?