Where does the responsibility on security reside when a security module is built into a device; can the interests of the service providers be assured?
The responsibility for security is always a shared responsibility between the security service provider and the service user. Any security module can only offer assurance for the behavior and assets within its own domain. The behavior and the assurances of a security module include the protections employed to address the particular threats that exist in a specified environment. The interests of service providers are assured to the extent that they understand the protections offered by the module and their own responsibilities for its effective application.
