Blog - Lightship Security

Canada Open for EAL4

Lachlan Turner October 17, 2019 Certifications, Common Criteria, Lightship News

The Canadian Centre for Cyber Security recently released its updated Common Criteria (CC) Program Instructions which state that they will consider accepting EAL3 and EAL4 evaluations on a case by case basis. Evaluations were previously restricted to those claiming an approved Protection Profile (PP) or EAL2.

Based on the updated instructions it’s clear that the Canadians want to make sure that there is a good business case for why they should deploy valuable resources to support a given EAL3/4 evaluation. This will include factors such as where the request for evaluation is coming from (i.e. Government of Canada, a Canadian critical infrastructure sector, or from another country), whether there is an applicable PP and whether the technology / evaluation will provide value to Canada.

Lightship named a Canadian Top New Growth Company

Jason Lawlor September 12, 2019 Lightship News

Canadian Business and Maclean’s today ranked Lightship Security No. 31 on the 2019 Startup 50 ranking of Canada’s Top New Growth Companies. Serving as a companion list to the longstanding Growth 500 ranking of Canada’s Fastest-Growing Companies and produced by Canada’s premier business and current affairs media brands, the Startup 50 ranks younger companies on two-year revenue growth. Lightship Security made the 2019 Startup 50 list with two-year revenue growth of 529%.

Read the full press release here.

This award is a great validation of our team, strategy and ability to execute. As an independently owned organization trying to disrupt a mature market, we are excited how the industry is embracing our modernized, automated process that is resulting in better, faster outcomes for our clients.

Lightship Security is an independently owned, ISO 17025 accredited cybersecurity laboratory specializing in standards based product security testing. We have offices in Ottawa, Vancouver and Austin, Texas which serve a growing global client base.

OpenSSL and ACVP Parsing

Greg McLearn August 14, 2019 ACVP, FIPS 140-2

OpenSSL is used in some part by an overwhelmingly large percentage of the enterprise vendor community. Those vendors which need to go through FIPS 140-2 or Common Criteria may find themselves needing to perform algorithm testing and may be presented with only being able to interact with the new ACVP-formatted test cases. Below, we talk about some practical options available to those vendors who have not yet bridged the gap.

Cyber Security Test Lab 2.0

Jason Lawlor July 19, 2019 Certifications, Uncategorized

Product certification providers like Lightship have been relatively insulated from the pace of change that other industries have been forced to adapt to over the past several years.

That is no longer the case. Increasingly technical, prescriptive test requirements, product complexity and new assurance demands mandated by governments mean that product certification labs are being forced to evolve and adapt.

game-of-certifications-common-criteria-requirements

Game of Certifications: A Song of Common Criteria Requirements

Alex Thurston May 27, 2019 Certifications, Common Criteria

If you’ve ever spent any amount of time delving into the world of Common Criteria (CC), you’ve no doubt come across the veritable Roman/biblical hierarchy of relationships between the various components. At times, it would make even Cersei Lannister blush. In support of the CC automation we are doing at Lightship Security, I took on the daunting task of modelling this complex family tree in software. Here’s what I learned about who begat whom in the family tree of CC requirements.

Ottawa’s Fastest Growing Companies – #2 for 2019

Jason Lawlor May 7, 2019 Lightship News

Lightship Security has been named as Ottawa’s second Fastest Growing Company for 2019.

Every year the Ottawa Business Journal (OBJ) recognizes 10 regional companies for their substantial, sustainable, and profitable growth.

Fueled by an industry first automated approach to product security certification, we have bootstrapped our way to substantial growth over a three-year period to earn the 2019 award.

Lightship’s mission to modernize the legacy approach to 3rd party product security certifications (like Common Criteria) through our automated test platform, Greenlight is proving a key differentiator and driver of sales growth. Our approach dramatically eliminates the risk of certification delays, product re-development and reduces time to market for a growing list of international clients.

Understanding the Scope of NDcPP Evaluations

Greg McLearn April 2, 2019 Common Criteria

When first exposed to the Network Device collaborative Protection Profile (NDcPP), vendors are often surprised by the extremely narrow scope. It is critical to realize that the Protection Profile (PP) refers to an abstract “network device” with required functionality that should appear in any good network citizen. It doesn’t look to any specific vendor or technology type. Rather, the PP refers to the minimalist ideal of security-relevant functionality focused almost entirely on how security administrators interface and interact with the device.

Challenges in Fuzzing RFC 1149

Greg McLearn April 1, 2019 Common Criteria, Humour

Conan Hoye and Greg McLearn contributed to this article.

At Lightship, we test a lot of NDcPP-compliant products. As part of those evaluations, we are required, as per Appendix A in the Supporting Document, to perform network fuzzing against the in-scope IP networking stacks. Recently we had a rather unique TOE which claimed conformance against RFC 1149 for one of their remote management interfaces.

Preparing for FIPS Validation Part 2 – Boundaries and Libraries

Jason Lawlor March 15, 2019 Certifications, FIPS 140-2

In part 2 of our multi-part Lightship Security video tutorial series geared toward vendors who are new to FIPS 140-2, we discuss the concept of cryptographic boundaries, cryptographic libraries and the design aspects required for FIPS 140-2 compliance. The previously published part 1 of the series can be found here.

NDcPP v2.1 endorsed by NIAP but which TDs apply?

Lachlan Turner March 12, 2019 Certifications, Common Criteria

[March 14, 2019 update] The NIAP list of TDs is now up to date with NDcPP v2.1 attribution.

NIAP announced their endorsement today of version 2.1 of the Network Device collaborative Protection Profile. We’ve previously described the changes in NDcPP v2.1. In this post, we look at which NIAP Technical Decisions (i.e. interpretations / minor edits) will still apply to this new version.