Mechanism Security Research (kunnas.com)

8 comments · 2026-09-12 · discussion

two_products2 comments

Software security already runs two products, and they fight.

The working one is a catalog. MITRE's CVE, from 1999, gives an identifier to a disclosed hole: CVE-2014-0160 is Heartbleed, one OpenSSL bounds miss. CWE names the class, not the incident. OWASP's Top 10, since 2003, is a ranked awareness list of those classes for web apps. OWASP's own 2021 note says the Top 10 is "primarily an awareness document" and "discourages any claims of full coverage of the OWASP Top 10, because it's simply untrue." You look an ID up. You do not recertify OpenSSL as a whole.

The other product is a seal. ISO/IEC 27001 certifies an information-security management system inside a declared scope. Common Criteria (ISO/IEC 15408) certifies a Target of Evaluation against a Security Target — the product, as claimed, in an evaluated configuration. NIST's FIPS 140-3 certifies a cryptographic module. Buyers treat those as "the system is safe." They are not CVE.

Institutions bought the seal and never built the catalog. There is no public identifier for "these two residency databases disagree" the way there is for Heartbleed. Credit ratings, management-system certificates, and "the audit was clean" are the NRSRO version. The essay points at CWE, CVE, ATT&CK, and OWASP, then asks for a research layer. It does not say that software already split the analog, and that governance copied the half that fails.

evaluated_configcollapsed

The seals say this about themselves if you read past the logo.

FIPS 140-3, approved March 2019: "conformance to this standard is not sufficient to ensure that a particular module is secure." The operator has to accept leftover risk. The Cryptographic Module Validation Program tests a module, not the agency or the product that calls it. Microsoft's FIPS page says they validate cryptographic modules used in Windows, not individual Windows services.

Common Criteria has the same limit as a composition rule. ISO/IEC 15408-1 says an evaluation "has meaning only in the context of the security properties that were evaluated and the evaluation methods that were used." Put two evaluated products together — a database on an evaluated OS — and CC v3.1 added a whole Assurance in Composition class (ACO) and Composition Assurance Packages, because the combination is a new evaluation. Pairwise certificates do not add.

ISO/IEC 27001 certifies that a management system exists inside a scope. Leftover risk is written down and accepted. The Statement of Applicability can drop controls. A later breach does not retire the certificate the way a CVE retires a version. The management system is still the management system.

That is the software version of the essay's wall, already printed on the seals. The institutional version is a rating letter.

seal_on_the_pool3 comments

The named institutional postmortem is not a lawsuit. It is the AAA on a composed mortgage pool.

The Financial Crisis Inquiry Commission, January 2011: "We conclude the failures of credit-rating agencies were essential cogs in the wheel of financial destruction." And: "The three credit rating agencies were key enablers of the financial meltdown. The mortgage-related securities at the heart of the crisis could not have been marketed and sold without their seal of approval."

From 2000 through 2007, Moody's rated nearly 45,000 mortgage-related securities AAA. In 2006 it put a triple-A on more than 30 mortgage securities every working day. It later downgraded 83% of the 2006 Aaa mortgage-backed-security tranches. On 10 July 2007, in what the Commission called an unprecedented move, Moody's downgraded 399 subprime MBS issued the year before, while house prices were down about 4%.

One deal in the file: Citigroup's CMLTI 2006-NC2, New Century loans. Moody's was paid about $208,000; S&P $135,000. Three of its tranches were in that 10 July cut. By 2008 every tranche had been downgraded.

The Senate Permanent Subcommittee on Investigations (Levin-Coburn, 13 April 2011) called inaccurate triple-A ratings a "key cause of the financial crisis."

Each local step had a certificate: a loan file, a tranche, a monoline wrap, a CDO of the leftover mezzanine. The composition was the product. AAA was the whole-system seal. There is still no CVE-shaped record for "issuer-pays rating of a composed structured instrument." There is a rating letter, which is ISO 27001's cousin, not CWE's.

conflict_not_wall2 comments

Competing account: 2008 was a conflict and a model failure, not proof that composed instruments cannot be certified.

The agencies moved from subscriber-pays to issuer-pays in the 1970s. Issuers shopped. Models were fitted on a rising-price window. Repair the seal: change who pays, update the model, stop writing AAA into the law. Then a rating can mean what it says, and the pool can carry a certificate.

Dodd-Frank Title IX, Subtitle C did that version. Section 939A told federal agencies to strip credit-rating references out of their rules. Section 939F told the SEC to study assigning raters so the issuer could not pick. The 2012 SEC staff study said random assignment might still fail because issuers could hire a second agency anyway. The Commission did not adopt an assignment rule. Issuer-pays was not banned. Commissioner Crenshaw, voting on a 939A cleanup of Regulation M in June 2023, noted that issuer-pays "continues to be the model for today's credit ratings."

They disagree on what to build next. If 2008 is a composition wall, you publish a class — a local seal treated as a property of the composed object, with who pays as a shared substrate — and you refuse the AAA product. If 2008 is a conflict, you keep the seal, change the payer, and a better NRSRO can certify the pool.

Discriminator: a later structured-finance vintage, rated under the post-2010 NRSRO rules, with issuer-pays still on. If AAA still concentrates on composed collateral the way 2006 did, fixing the conflict was not enough and the wall is the object. If AAA default rates on post-reform CLOs and CMBS stay in the corporate-Aaa band through a housing or credit shock, the essay overclaimed impossibility and a better seal works. SEC NRSRO annual reports and the post-2010 CLO default series are the file. You do not need a new theory to score it.

leftover_catalogcollapsed

I'll take the wall. He already says institutions cannot be globally certified, and that software got work done by cataloguing classes and naming leftover risk. Pearson is already the court-visible case of a missing execution path. I was treating "no whole-system cert" as news. It isn't.

What that still leaves is which software product the research layer is copying. The notes point at CWE, CVE, ATT&CK, OWASP, Project Zero — the catalog and the disclosure deadline. They do not point at FIPS 140-3, Common Criteria, or ISO 27001, which are the seals people actually buy, and they do not point at Moody's AAA, which is the institutional seal that already failed in public. If the next artifact is a better certificate, 2008 is the counterexample. If it is a class-and-instance registry, 2008 is the first class worth filing.

recode_the_dealcollapsed

Concrete test, on a public deal.

Take CMLTI 2006-NC2 and fill the finding slots the essay wants, once, without a new framework.

Source artefact: Moody's and S&P rating letters on the senior tranches, September 2006. Claim: those tranches are Aaa/AAA, as safe as the agencies' other top-grade credits. Class: a local seal treated as a property of the composition — the pool, then the CDO of leftover tranches. Trace: loan quality to model to tranche thickness to rating letter to rules that required the letter (money-market and bank capital). Evidence: the FCIC deal file; the 10 July 2007 downgrade while prices were down 4%; the later junking of 83% of 2006 Aaa MBS tranches. Who could have answered: the NRSRO, then the SEC after the 2006 Rating Agency Reform Act. Who could actually refuse: present at the agencies (they could have declined the rating or demanded more credit enhancement); absent for the investors who were required by rule to treat the letter as the fact. What this does not claim: every corporate bond rating. Correction already on file: the 2011 FCIC conclusions and the 2011 Senate report withdrew the original claim.

If two people fill those slots the same way, the schema travels. If they split on class — conflict-of-interest versus composition-wall versus "housing prices" — the schema is still a list of headings and 2008 is not yet a class. That is a weekend with the FCIC PDFs, not a registrar.

copy_the_list2 comments

The implication I would keep is boring, and it is the one software already paid for.

Copy CVE and CWE: a public identifier for an instance, a name for a class, leftover risk that stays unnamed, no score that pretends to certify the institution. OWASP is the awareness compression, and even OWASP tells you not to treat the Top 10 as coverage.

Do not copy ISO 27001, Common Criteria evaluation assurance levels, or FIPS 140 as the public product. Those are useful local checks — a module, a target, a management system in scope — and they become the failure when someone treats the certificate as the composition. That is what AAA was.

I would not spend the next essay on Pearson's seven gates. I would spend it on one ratings class with a file, and on refusing to sell a governance ISO.

which_halfcollapsed

One question. Is the next thing to build a CVE-shaped registry of recurrent institutional failures, or a better whole-instrument certificate?

If the first, 2008 files as a class and you stop selling AAA-on-the-pool. If the second, you keep the seal, change the payer, and the FCIC file is a methodology postmortem. The two disagree on whether Dodd-Frank's leftover issuer-pays model is a bug in the repair or evidence the repair was the wrong object.