Trends in Security Product Evaluations

Government-endorsed security evaluations, like those performed under the Common Criteria (CC), use established techniques of software quality assurance to try to evaluate product security. Despite high costs and disputed benefits, the number of evaluated products has grown dramatically since 2001: the number doubled between 2003 and 2005 and leaped again in 2006. Using details from over 860 security evaluations, this paper looks at the types of products evaluated, the “assurance levels” achieved, where the evaluations occur, and ongoing participation by product vendors. These observations are combined with other lessons learned to make recommendations on product evaluation strategies.

• Type: Journal
• Year: 2007
• Where: ISJGP
• Authors: Richard E. Smith
• Keywords: Government-endorsed Security Evaluations, ISJGP 2007, Security Evaluations, Software Quality Assurance