Hi Dmitri, > This question is not only about platforms - I want to ask for your > experience in certification of such system (hardware, OS, OpenCA) by > Common Criteria EAL-X standart. Have anyone complited such steps?
I was envolved in preparations for such an evaluation. I advised against it but my customer wanted it nevertheless. Evaluation does not prove a system is secure, it only provides evidence that certain aspects of design and implementation have been documented and found to be OK. In fact you might find yourself in the absurd situation that you cannot fix a newly found security problem without sacrificing the eval level. If you can spare a *lot* of money and manpower for the evaluation and you have a strong regulatory reason for doing to, you are on the right track. Please keep in mind that evaluating such a system always refers to a particular software version. It is not possible to change the software (fixes, improvements) after the evaluation without losing the eval level or re-evaluating it. In terms of OpenCA it would only be useful for a proven stable release that has a track of successful production use in *your* environment, and you will not be able to benefit from newly developed features or bug fixes. Just my thoughts. Martin ------------------------------------------------------- This SF.net email is sponsored by: IT Product Guide on ITManagersJournal Use IT products in your business? Tell us what you think of them. Give us Your Opinions, Get Free ThinkGeek Gift Certificates! Click to find out more http://productguide.itmanagersjournal.com/guidepromo.tmpl _______________________________________________ Openca-Users mailing list [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/openca-users
