Security certificates are a point-in-time snapshot, and buyers over-rely on them

Masaryk University research analysis of Common Criteria and FIPS-140 certified products finds that about 60 percent of vulnerabilities matched to certified products, excluding smartcards, were disclosed after the certification date, so certification reflects a point-in-time assessment. The lab's open-source tools sec-certs and SCRUTINY support this kind of analysis. The article does not name specific CVE IDs or affected versions, and it does not state the single question buyers should ask vendors.

For security analysts · Written by AI from 1 source · Wrong?