arrows up for Lightship

Execution and Ambition – Year in Review

Jason LawlorLightship News

December marks the 3-year anniversary of the founding of Lightship.  As such, we’ve been taking stock to consider our progress, challenges and future plans.

First the good news.  In 2018, Lightship was able to successfully execute on the following: 

  • Became the 5th and only independently owned and accredited Common Criteria lab in Canada 
  • Completed our accreditation to become 1 of 22 FIPS 140-2 labs worldwide 
  • Completed one of the fastest formal NDcPP v2 end to end CC evaluations ever completed in North America 
  • Secured development funding from the Government of Canada for Greenlight test automation innovations 
  • Added more modules and utilities as part of the Greenlight platform to improve reporting, ease of integration and usability for us and our clients 
  • Added critical mass to our development and delivery team to support our growing client base
  • Earned the certification business of several new domestic and international industry leading security vendors through our modernized and automated Functional Gap Analysis offering and end to end expedited CC certification methodology

Read More

mother-of-common-criteria-pps-ndcpp

The Mother of All NIAP Protection Profiles – NDcPP

Lachlan TurnerCertifications, Common Criteria

We took a strategic decision early on at Lightship Security to focus our initial Greenlight development efforts on automating the tests specified by the Network Device collaborative Protection Profile (NDcPP). There are two main reasons for this:

  1. It is the most widely used Common Criteria Protection Profile in North America (given its generic applicability)
  2. It is the forerunner for most NIAP Approved Protection Profiles which re-use a large portion of the NDcPP Security Functional Requirements (SFRs)

Now, we have automated the testing not only for NDcPP but also several other Protection Profiles by virtue of this SFR re-use.  Below we present an analysis of the re-use of NDcPP requirements across NIAP Approved Protection Profiles (all but a few).

Read More

irap2018

Government of Canada Funding for Greenlight Conformance Test Automation

Jason LawlorCommon Criteria, Lightship News

As part of our continued commitment to develop innovative certification automation solutions, Lightship Security is pleased to announce that it has received additional development funding from the National Research Council of Canada Industrial Research Assistance Program (NRC IRAP).

The NRC IRAP support will be used by Lightship to provide advanced functionality of our industry first Conformance Automation Platform – Greenlight, specifically to support our growing list of clients with continuous certification readiness through automated functional pre-testing.

ndcppv2_1_changes

Notable NDcPPv2.1 Changes (from v2.0e)

Lachlan TurnerCertifications, Common Criteria

[March 12, 2019 Update] NDcPPv2.1 has been formally endorsed by NIAP.

NDcPPv2.1 is hot off the presses from the Network iTC.  It is yet to be officially accepted by NIAP for PCL usage however this is probably not too far off, perhaps with some minor tweaks (the new NTP SFR being something to watch).

Here are some notes from our initial review:

  • NTP. A new SFR has been added for NTP which we understand refers to mechanisms that are supported by commonly available NTP clients.  Vendors still have the option of specifying manual time configuration. If v2.1 is accepted by NIAP as is, this will remove the mandated use of a trusted channel for NTP which was causing problems for some vendors in v2.0e.
  • TLS. Administrators can now elect to ignore certificate validation failures. Support for 192-bit ciphersuites has been removed and a couple of new suites have been added.
  • X.509. Certificate revocation checking requirements have been ‘clarified’ by an application note. This may result in changes for implementations that meet the current requirements.
  • Audit Events. All generation/import/change of long-term cryptographic keys (i.e. not session keys) need to be audited, including those that are automatically generated by the TOE.

Read More

SSH Rekey Limits with OpenSSH

Greg McLearnCommon Criteria

Since this article was posted, the international Network Interpretations Team has issued RFI 201824 stating that the send and receive keys can be independently rekeyed.  Therefore, the requirement that the ‘aggregate’ traffic be counted is no longer mandated according to the iTC.  NIAP has yet to endorse RFI 201824, meaning that still, as of April 2, 2019, NIAP still requires the aggregate be counted.

Background

In the current version of the NDcPP there is a cryptographic Security Functional Requirement (SFR) called FCS_SSH*_EXT.1.8.  On the face of it, FCS_SSH*_EXT.1.8 is a fairly straightforward SFR with a relatively straightforward means to enforce it:

FCS_SSHS_EXT.1.8: The TSF shall ensure that within SSH connections the same session keys are used for a threshold of no longer than one hour, and no more than one gigabyte of transmitted data. After either of the thresholds are reached a rekey needs to be performed.

However, it is vitally important to read the application note (Application Note 102 in NDcPP v2.0+20180314) that follows this SFR element, because one small detail appears to be catching vendors by surprise:

For the maximum transmitted data threshold, the total incoming and outgoing data needs to be counted.
Read More

6 Tips to Help Avoid Surprises In Your Next Common Criteria Evaluation

Jason LawlorCertifications, Common Criteria

Undertaking a Common Criteria (CC) evaluation should not be an opaque process from a timing, process or cost perspective. In this post, the testing experts at Lightship provide 6 practical tips to ensure that you are getting the best value and outcomes for your certification dollar. The following is targeted primarily at Protection Profile (PP) based evaluations, but most also apply to Security Target (EAL) based projects.

Read More

lightship-iaea-cyber-risk-nuclear-supply-chain

Lightship at IAEA Meeting on Cyber Risk in the Nuclear Supply Chain

Lachlan TurnerCommon Criteria, Lightship News

Lightship Security Director of Consulting, Lachlan Turner, was nominated by the Government of Canada to participate in the International Atomic Energy Agency (IAEA) Technical Meeting on Reducing Cyber Risks in the Supply Chain which was held at IAEA’s Headquarters in Vienna, Austria, from 25 to 29 June 2018. Lachlan attended along with some 110 other delegates from around the world. Delegates included nuclear regulators, operators, suppliers and various other industry representatives.Read More

Don’t Call it a Bash Script: Automation is Not Scripting

Alex ThurstonCertifications, Common Criteria

Or, maybe it is.  In reality, the answer is that all automation is scripting but not all scripting is automation.  Automation is really a maturation or evolution of scripting.  Calculators script the mathematical principles defined by Thales, Pythagoras, Euclid and Archimedes.  To-do applications script the act of making a list of tasks on a piece of paper and scratching them off.  The directions given by Google Maps on a road trip script the job normally performed by the person with a paper map sitting in the passenger seat.

Read More

Secure Tunnelled NTP Proof of Concept

Greg McLearnCommon Criteria, Tools

Update 2018-Oct-03: This post has been updated within new information from NDcPP v2.1.

Recently, NIAP issued Technical Decision TD0321: Protection of NTP communications.  It states that network time sources are critical pieces of information that must be protected.  However, having no other agreed-upon mechanism to authenticate the source of, or ensure the integrity of NTP packets, NIAP requires vendors to use NTP over one of only a handful of acceptable trusted communications channels: TLS, DTLS, HTTPS*, SSH or IPSec.

This leaves many vendors in a bind since there are (a) no public-facing NTP servers that operate over any of these permissible channels; and, more importantly, (b) there are no widely available NTP server/client implementations that can be used to build such a solution.

Read More