Common Criteria Demystified
summary
Explains how Common Criteria maps threats into concrete SFRs (security functional requirements) and a security target that labs test; Red Hat runs full evaluations (RHEL 7 was evaluated twice), older RHEL 7.1 took about two years, new scheme targets 90–180 days by automating test suites and audit trails. Points out gaps: OSPP 4.2 lacks SELinux/MAC and TLS 1.3 coverage, secure boot is mandatory (problematic for some IBM Power systems), and maintenance uses rolled patch-set re‑evaluations roughly every two years.
AI-written summary · about
chapters (21)
- 0:00Intro
- 1:49How Secure
- 2:58What is Common Criteria
- 3:24What is Developer
- 4:10Common Terms
- 5:50Threat
- 6:57Assumptions
- 7:38Security Objectives
- 8:18SFR
- 11:00Protection Profile
- 12:32Security Target
- 14:56Assurance Requirements
- 17:08How can developers help
- 18:25Why should developers care
- 19:24Where are we today
- 22:47What about moving forward
- 24:26Whats next
- 26:56Certification of containers
- 29:42Maintenance updates
- 31:01Reevaluation
- 32:54Summary
related talks
36mSecurity compliance: A global perspective
35mKeeping the linux kernel secure across 10+ RHEL releases
32mImplementing and Validating Linux Cyber Security Requirements: SEAPATH, a Case Study
15mKeynote: Cutting Through the Fog: Clarifying CRA Compliance in Cloud Native
28mFrom Manufacturer to Steward Red Hat’s Approach to CRA Readiness
37mHow To Approach InfoSec Like a Fed(eral Auditor)
25mRISC V and Meta framework Security Cert Approach for a Secure Connected World
34mEvolving Secure Development through FedRAMP Continuous Monitoring Trends