Wednesday, April 26, 2006

GAO Hammers Common Criteria

I've written about Common Critera before. If you also think CC is a waste of money, read GAO: Common Criteria Is Not Common Enough by Michael Arnone. It summarizes and comments upon a report by cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 Government Accounting Office titled INFORMATION ASSURANCE: National Partnership Offers Benefits, but Faces Considerable Challenges. Mr. Arnone writes:

GAO also criticized cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 National Information Assurance Partnership (NIAP) for not providing metrics or evidence that cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 Common Criteria actually improves product security. In addition, cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 Common Criteria process takes so long to complete that agencies often find that cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 products cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365y need are not on cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 list of certified offerings or that only older versions have been accredited, GAO’s report states...

Pescatore said GAO’s call for increased education and awareness of NIAP’s function is overblown. Large vendors already know cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 process well and can afford millions of dollars for tailor-made product evaluations, he said.

Any education efforts should target smaller vendors — with $10 million to $50 million a year in annual revenue — that don’t know about cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 NIAP process, don’t know how expensive it is and have trouble affording it, Pescatore said. NIAP must do more than educate, he added. It must provide subsidies or reduce prices so smaller vendors can participate, he said.


It sounds like Common Criteria is becoming nothing but a hurdle to keep smaller companies from providing products to government agencies.

1 comment:

Anonymous said...

Why should any one single group of vendors be targeted for specialized education? There are plenty of folks who don’t know cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 process. Even companies who have been through evaluation before can struggle with understanding cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 CC. Why? Different business units, changes in roles, attrition, etc. They may not have someone (or multiple someones) responsible for educating cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365 organization.

Also, how can NIAP possibly provide evaluation subsidies when cá cược thể thao bet365_cách nạp tiền vào bet365_ đăng ký bet365y can’t even afford enough validators?