Conformance with established standards and best practices is essential for increasing the protection baseline in cybersecurity. Many organisations lack personnel experienced in the domain and, therefore, have a hard time adopting new approaches and techniques. Education is an important component, but in-depth knowledge is hard to transfer. Thus, certification methodologies that distil certain best practices into structured, easy-to-apply guidelines have an important role in the proliferation of cybersecurity innovation.

That said, the compacted nature of certification may also have its downsides. For example, the ROCA[1] case in 2017 involved a serious vulnerability in the national eID cards of Estonia and the eID cards of Slovakia, which had to revoke 760,000 and 300,000 certificates, respectively. This vulnerability was found in cards where the chips were certified according to the well-established Common Criteria methodology with an assurance level mandated by European regulation.

While it is currently unclear, how the vulnerable system was able to receive a certificate, we see that development in the certification domain is needed for multiple reasons. Firstly, while Common Criteria is flexible, it does not have protection profiles or security targets for everything. The expectation in Common Criteria use is that, once the innovation reaches maturity, customers and technology vendors assemble to come up with the common points of reference for certifying.

However, this is a limitation for new technologies that may not find adoption due to the lack of certification. This is especially the case for quickly evolving technologies like IoT (the Internet of Things). It is not the intention to sidestep due process and reduce security requirements to technologies. Instead, we need to consider new methodologies that contain considerations for new techniques.

Framework and Toolset for Conformity 

Inspired by this, we set out to identify frameworks that allow us to describe and compare the security properties of new technologies in the IoT domain. In Framework and Toolset for Conformity, we have identified the ARMOUR methodology for IoT devices as a suitable approach. It allows us to support other CyberSec4Europe tasks by analysing technologies, system designs and implementations to determine whether the combination of cybersecurity technologies in use achieves the desired security goals, allowing it to compare different systems. We also present a prototype tool that can be used to automate and simplify the use of the ARMOUR methodology, speeding up its use.

 

Liina Kamm, Cybernetica

 

 

[1] The ROCA vulnerability is a cryptographic weakness that allows the private key of a key pair to be recovered from the public key in keys generated by devices with the vulnerability.