Which of the following is a security weakness in the evaluation of common criteria (CC) products?

A significant security weakness in the Common Criteria (CC) evaluation process is that the product manufacturer (the sponsor) defines the scope of the evaluation. The sponsor specifies the exact version, features, and configuration of the product to be tested, known as the Target of Evaluation (TOE), in a document called the Security Target (ST). This allows the sponsor to present a "best-case," highly secured, and potentially unrealistic configuration for assessment. The resulting certification is only valid for that specific configuration, which may not reflect how the product is deployed or used in a real-world operational environment, creating a potential gap between certified security and actual security.

1. Bishop

M. (2004). The Common Criteria: A Mixed Blessing. In Proceedings of the 2004 workshop on New security paradigms (NSPW '04). Association for Computing Machinery

New York

NY

USA

11–17. (DOI: https://doi.org/10.1145/1146260.1146263). On page 12

Bishop notes

"The vendor writes the ST [Security Target]

and so can tailor it to the product’s strengths and omit its weaknesses... This allows the vendor to choose the grounds on which its TOE will be evaluated."

2. Common Criteria for Information Technology Security Evaluation. (2017

April). Part 1: Introduction and general model

Version 3.1

Revision 5. CCMB-2017-04-001. Section 5.3.2

"Security Target

" states

"The ST is a statement of the security claims for a specific TOE... The ST is provided by the author of the ST (e.g. the developer)." This confirms the vendor's role in defining the evaluation scope.

3. Grünwald

G.

& Scheuermann

D. (2008). On the Practicality of the Common Criteria. In Trust and Trustworthy Computing. Springer

Berlin

Heidelberg. (DOI: https://doi.org/10.1007/978-3-540-68979-913). The paper discusses that vendors can "choose the EAL and the security functionality to be evaluated

" which can lead to a minimal set of functions being tested to achieve certification

not necessarily reflecting the full product.

4. Pfleeger

C. P.

& Pfleeger

S. L. (2003). Security in Computing

3rd Edition. Prentice Hall. In Chapter 8

"Program Security

" the text discusses evaluation criteria and notes the limitation that evaluations apply only to the specific configuration tested

which may differ from how a product is used in practice.