In this episode I had a discussion in a tea house with Dr. Gao from the IT security department in Institute of Information Industry in Taiwan and Hungwei Chen previously from Winbond. They shared their stories with high assurance security evaluation and the difficulties in promoting security evaluation in an ecosystem. Security is generally considered a cost for the developer and I have yet to see a developer to do security evaluation/certification by freewill when it’s not necessary. As a country or a company you need to make the conscious choice if security is important for your existence on the long run and if investment is needed or worth it. While most people will say that security is important, most companies do not want to invest because it hurts the short term results (costs) and makes the price of the product higher (competitiveness). This episode is purely in Chinese and I know it will make people who only listen to the podcast and do not speak Chinese quite difficult. However, it is really important that people who I interview to feel comfortable to speak out their mind freely and precisely. On the YouTube version you are able to find the subtitles in different languages. Hope you gain some new insights from the conversation.

As usual, there is a blog associated with this episode and you can find it here: https://certcle.substack.com/p/the-economy-of-security-certification?r=3smzvo

My website: www.certcle.com

Instagram: @certcle

Welcome to the second episode of Assurance Unknown. My guest for this episode is Ernst Bovelander. Ernst was the CEO of Brightsight for many years and played quite an important role for both Brightsight and for my career. In the interview we went into his career from his first job at the hardware security group of TNO, which became Brightsight. And his return to Brightsight to take over one of the previous owners Jan Pieters as the CEO. He had two tasks, one is to make Brightsight more "professional", the other is to prepare the company for a sale. We can hear the whole process from his point of view, which if we purely look at the two tasks, he had quite good results. We also went into the process of the growth and expansion of Brightsight. Overall a very interesting story of the history of Brightsight and high assurance payment security.

When Ernst was talking about making Brightsight more "professional", I was already thinking what does "more professional" actually mean? I wrote a blog post about it as the complimentary content and I welcome you all to share your views and comments on that. You can find the blogpost here:

https://certcle.substack.com/p/what-is-a-professional-lab

Hope you enjoy this episode. I am keeping a monthly update cycle at this moment so the episodes are still in the long format. Feel free to leave your comments and join the conversation. Do not forget to subscribe and like the video if you do! Thanks!

Welcome to the first episode of Assurance Unknown podcast, a podcast about the untold stories of the high assurance security evaluation and certification industry. My guest of this episode is Martin Schaffer. We touched upon different topics in this episode including:

• The career path of Martin in this industry and how he created a dedicated security evaluation and certification department in NXP
• What was the strategy of NXP in choosing the evaluation labs for different products
• Why a faster CC evaluation and certification process was needed and how smart CC was born
• The creation of SESIP for the security evaluation of IoT products and how the idea of composition was applied
• The challenges for the future of security evaluation and certification in the era of AI

For a full experience of the podcast, please also check out the following channels:

blog: https://substack.com/@certcle

instagram: @certcle

my company website: www.certcle.com

Hope you enjoy the episode and feel free to comment, ask questions, and share your ideas with me. Special thanks to Narasimha for the cover art and Shiqi for the intro and outro music!