English (United Kingdom)

https://curated-unify.zendy.io/wp-json/zendy-region/v1/featured_content/oa?rat=en

https://curated-unify.zendy.io/wp-json/zendy-region/v1/highlighted_journal/

Global: Zendy Plus annual

Presents the access of premium content as premium feature

Premium Content

Presents the keyphrase highlighting as premium feature

Keyphrase Highlighting

Presents the summarisation as premium feature

Summarisation

Insights

Presents the pdf analysis as premium feature

PDF Analysis

Presents the zaia usage as premium feature

ZAIA

Global: Zendy Plus monthly

Global: Zendy Tools annual

Global: Zendy Tools monthly

Global: Zendy Free Plan

Products certified under security certification frameworks such as CommonCriteria undergo significant scrutiny during the costly certification process.Yet, critical vulnerabilities, including private key recovery (ROCA, Minerva,TPM-Fail...), get discovered in certified products with high assurance levels.Furthermore, assessing which certified products are impacted by suchvulnerabilities is complicated due to the large amount of unstructuredcertification-related data and unclear relationships between the certificates.To address these problems, we conducted a large-scale automated analysis ofCommon Criteria and FIPS 140 certificates. We trained unsupervised models tolearn which vulnerabilities from NIST's National Vulnerability Database impactexisting certified products and how certified products reference each other.Our tooling automates the analysis of tens of thousands ofcertification-related documents, extracting machine-readable features wheremanual analysis is unattainable. Further, we identify the security requirementsthat are associated with products being affected by fewer and less severevulnerabilities (on average). This indicates which aspects of certificationcorrelate with higher security. We demonstrate how our tool can be used forbetter vulnerability mitigation on four case studies of known, high-profilevulnerabilities. All tools and continuously updated results are available athttps://seccerts.org.

sec-certs: Examining the security certification practice for better vulnerability mitigation