Is a Common Criteria evaluated/validated product secure?
The fact that a product appears on the Validated Product List does not by itself mean that it is secure. A product’s listing on any Common Criteria validated products list means that the product was evaluated against its security claims and that it has met those claims. The security claims are provided in a document called the product security target (which is available on the Validated Products List). In the security target, the vendor (or the sponsor of the evaluation) documents the security functionalities the product contains and the level of evaluation rigor (assurance) performed to determine if the product meets its claims. It is up to the purchaser to review the security target to determine if the security provided by the product is the appropriate level for the targeted application or system. For some technologies (e.g., firewalls, operating systems), NSA and NIST have collaborated to draft U.S. Government protection profiles. These U.S. Government protection profiles provide i
