Or, maybe it is. In reality, the answer is that all automation is scripting but not all scripting is automation. Automation is really a maturation or evolution of scripting. Calculators script the mathematical principles defined by Thales, Pythagoras, Euclid and Archimedes. To-do applications script the act of making a list of tasks on a piece of paper and scratching them off. The directions given by Google Maps on a road trip script the job normally performed by the person with a paper map sitting in the passenger seat.
Secure Tunnelled NTP Proof of Concept
Update 2018-Oct-03: This post has been updated within new information from NDcPP v2.1.
Recently, NIAP issued Technical Decision TD0321: Protection of NTP communications. It states that network time sources are critical pieces of information that must be protected. However, having no other agreed-upon mechanism to authenticate the source of, or ensure the integrity of NTP packets, NIAP requires vendors to use NTP over one of only a handful of acceptable trusted communications channels: TLS, DTLS, HTTPS*, SSH or IPSec.
This leaves many vendors in a bind since there are (a) no public-facing NTP servers that operate over any of these permissible channels; and, more importantly, (b) there are no widely available NTP server/client implementations that can be used to build such a solution.
NIAP TD0321: Protection of NTP communications
Update 2018-Oct-03: This post has been updated within new information from NDcPP v2.1.
NIAP has issued Technical Decision TD0321 against the Network Device Collaborative Protection Profile (NDcPPv2.0e) mandating the use of a trusted channel (IPsec, SSH, TLS, DTLS, HTTPS) for NTP (or non-NTP external entity used to set time). This will impact any in-flight and future NDcPP evaluations that are destined for the NIAP PCL.
Read More
Tutorial – Generating Test Vector Responses for CAVP Testing
In this short tutorial, we demonstrate how to generate the AES response files used in CAVP algorithm testing. The OpenSSL FIPS Object Module 2.0.16 is used for this demonstration.
Certification Head Start
Imagine having more than 60% of your Common Criteria evaluation completed in less than a week.
With Lightship’s Certification Head Start offering, we can make it happen.
Read More
Common Criteria Lab Accreditation
We are excited to announce that Lightship Security is a fully accredited Common Criteria laboratory. Prepare for warp-speed certifications! Contact us to find out how our experienced team uses Greenlight automation and Lightship’s industry first functional gap assessment methodology to transform your certification experience.
Full press release: Lightship Security completes accreditation as Common Criteria laboratory
Standards Council of Canada: Directory of Accredited Laboratories – Lightship Security
Communications Security Establishment: Common Criteria Evaluation Facilities
On the Road with Mobile Certifications
At Lightship Security, we are all about certifying at the speed of development. Therefore, we are proud to announce our new mobile certifications laboratory. With over 1200 cubic feet of interior high-tech laboratory goodness, we can handle even your most demanding certification needs. The 10-cylinder, 350 horsepower motor will have us rolling into your neighbourhood before the ink dries on the contract.
Look for Lightship Security Mobile Certifications near you. For more information about this amazing industry-first service, click here.
Building the OpenSSL FIPS 140-2 Object Module
In a short video tutorial, Lightship Security walks viewers through the basic steps to build the OpenSSL FIPS 140‑2 (2.0.10) object module in accordance with the OpenSSL FIPS 140‑2 Security Policy.
How to get on the NSA/NIAP Product Compliant List (PCL)
Many vendors seeking to sell hardware or software to the U.S. Government, particularly to defense and intelligence agencies, will find that cyber security product certification is mandated by federal procurement requirements (CNSSP 11) for these environments. We know, because many of our clients come to us for this very reason – fast, efficient, low risk evaluations that ultimately end up on the National Information Assurance Partnership (NIAP) Product Compliant List (PCL).
Lightship Security interview with Ottawa Business Journal
Our President Jason Lawlor talks with the Ottawa Business Journal to explain what Lightship Security is all about. Interview topics include:
- An introduction to Lightship Security… and why the name Lightship?
- Product certification and Common Criteria overview
- Certification at the Speed of Development using our Greenlight test automation platform
- Lightship Security innovation and growth strategy