This week there were widespread reports that hardware-encrypted USB thumb drives from SanDisk, Kingston and Verbatim suffer a serious security design flaw, allowing them to be unlocked without knowing a user’s password.
Security guru Bruce Schneier posted an article about this, and dicussed in particular how the FIPS 140-2 Level 2 security validation that the SanDisk device had received from NIST would allow such a fatal security flaw.
Today there are been discussion that the affected device has undergone Common Criteria EAL2 certification. Common Criteria is thought to ensure a higher level of security than the FIPS 140-2 Level 2 validation.
However, blog posters were quick to point out that there is no government approved “protection profile” for hardware encrypted USB removable storage devices (though I am told that NSA is working on developing one). This means that the vendor, in this case SanDisk, is simply verifying that the device works as THEY specify, and is not actually validating their product against industry standard security requirements.
Effectively the security target document excludes the password authentication and trusted communication path between host PC and the device. This means that even though the product has “Common Criteria EAL2″ certification, the critically vulnerable component, password authentication, was not in fact part of that certification.
All this commotion is bringing to light that security certifications are important, but do not by themselves make a product secure. Buyers, and vendors themselves, need to understand exactly what components have been validated, and whether they are being validated against a standard set of security requirements, or are simply being “validated” to do what the vendor says they do, even if that implies security vulnerabilities.
No comments:
Post a Comment