Blog - Lightship Security

Comparing CAVP and ACVP – Test Harness Implications

Alex Thurston February 10, 2020 ACVP, Certifications, FIPS 140-2

As the legacy CAVP algorithm testing program is put to pasture and the newer automated testing program – ACVP takes its place, there are several questions, concerns and design considerations to think about. Foremost among them is how testing will work going forward and what it means for vendors and their existing implemented algorithm test harnesses.

One of the questions that often comes up here at Lightship is how does an existing test harness need to change to support the JSON formatted ACVP test vector sets and also to produce the needed response files. Because many vendors have an existing test harness based on the legacy program, they now have to redesign their harness for this new program which becomes mandatory on July 1, 2020.

What’s New in NDcPP v2.2?

Lachlan Turner February 5, 2020 Certifications, Common Criteria

The Network Device international Technical Community recently (in December 2019) published version 2.2 of the collaborative Protection Profile for Network Devices – aka – NDcPP. The NDcPP is the most often used Common Criteria Protection Profile to achieve listing on the NIAP Product Compliant List (PCL ).

NIAP are yet to formally endorse NDcPP v2.2 (UPDATE March 27, 2020: NIAP has now endorsed v2.2E which is basically the same as v2.2 but some front-matter changed) however it shouldn’t be too far off now – perhaps another month or so. With that in mind, it is useful to consider what has changed between v2.1 and v2.2 of the NDcPP. So, here are the main changes:

NIAP Requests for a Mitigation Plan

Lachlan Turner December 11, 2019 Certifications, Common Criteria

Vendors with products on NIAP’s Common Criteria Product Compliant List (PCL) may from time-to-time receive a request from NIAP for a mitigation plan addressing a given widespread vulnerability (e.g. Meltdown, Spectre etc.). This is in keeping with NIAP Policy 17 which is intended to “ensure products receiving a NIAP Common Criteria certificate do not contain known vulnerabilities”.

Happy Birthday – So What?

Jason Lawlor December 9, 2019 Lightship News, Uncategorized

Lightship Security is 4 years old this month. Since our founding, we have remained steadfast in our commitment to building a strong, profitable and growing platform to support our international client base. Why does this matter? Given the recent churn in the product certification industry, including evolving standards and the shuttering of multiple long-standing labs, Vendors are more than ever looking for a stable, committed and technically capable certification partner going into the next decade.

Lightship can be that partner:

Automated Algorithm Testing Tutorial

Jason Lawlor November 14, 2019 ACVP, FIPS 140-2

Lightship is ready to support our clients with their Automated Cryptographic Validation Program (ACVP) testing requirements. If you are curious about the program, here’s a short primer on how the process is going to work:

Canada Open for EAL4

Lachlan Turner October 17, 2019 Certifications, Common Criteria, Lightship News

The Canadian Centre for Cyber Security recently released its updated Common Criteria (CC) Program Instructions which state that they will consider accepting EAL3 and EAL4 evaluations on a case by case basis. Evaluations were previously restricted to those claiming an approved Protection Profile (PP) or EAL2.

Based on the updated instructions it’s clear that the Canadians want to make sure that there is a good business case for why they should deploy valuable resources to support a given EAL3/4 evaluation. This will include factors such as where the request for evaluation is coming from (i.e. Government of Canada, a Canadian critical infrastructure sector, or from another country), whether there is an applicable PP and whether the technology / evaluation will provide value to Canada.

Lightship named a Canadian Top New Growth Company

Jason Lawlor September 12, 2019 Lightship News

Canadian Business and Maclean’s today ranked Lightship Security No. 31 on the 2019 Startup 50 ranking of Canada’s Top New Growth Companies. Serving as a companion list to the longstanding Growth 500 ranking of Canada’s Fastest-Growing Companies and produced by Canada’s premier business and current affairs media brands, the Startup 50 ranks younger companies on two-year revenue growth. Lightship Security made the 2019 Startup 50 list with two-year revenue growth of 529%.

Read the full press release here.

This award is a great validation of our team, strategy and ability to execute. As an independently owned organization trying to disrupt a mature market, we are excited how the industry is embracing our modernized, automated process that is resulting in better, faster outcomes for our clients.

Lightship Security is an independently owned, ISO 17025 accredited cybersecurity laboratory specializing in standards based product security testing. We have offices in Ottawa, Vancouver and Austin, Texas which serve a growing global client base.

OpenSSL and ACVP Parsing

Greg McLearn August 14, 2019 ACVP, FIPS 140-2

OpenSSL is used in some part by an overwhelmingly large percentage of the enterprise vendor community. Those vendors which need to go through FIPS 140-2 or Common Criteria may find themselves needing to perform algorithm testing and may be presented with only being able to interact with the new ACVP-formatted test cases. Below, we talk about some practical options available to those vendors who have not yet bridged the gap.

Cyber Security Test Lab 2.0

Jason Lawlor July 19, 2019 Certifications, Uncategorized

Product certification providers like Lightship have been relatively insulated from the pace of change that other industries have been forced to adapt to over the past several years.

That is no longer the case. Increasingly technical, prescriptive test requirements, product complexity and new assurance demands mandated by governments mean that product certification labs are being forced to evolve and adapt.

game-of-certifications-common-criteria-requirements

Game of Certifications: A Song of Common Criteria Requirements

Alex Thurston May 27, 2019 Certifications, Common Criteria

If you’ve ever spent any amount of time delving into the world of Common Criteria (CC), you’ve no doubt come across the veritable Roman/biblical hierarchy of relationships between the various components. At times, it would make even Cersei Lannister blush. In support of the CC automation we are doing at Lightship Security, I took on the daunting task of modelling this complex family tree in software. Here’s what I learned about who begat whom in the family tree of CC requirements.