The Hacker's Encyclopedia 1998/hackers_encyclopedia.iso/hacking/general/greenbk.txt

Internet Message Format | 2003-06-11 | 210.6 KB

Date:    Mon, 30 Aug 1993 19:44:46 +0059
From:    Roland Hueber <[e-mail]>
Subject: Green Book, Draft 3.6
Message-Id: <[e-mail]>

Draft 3.6


Green Book on the Security of Information Systems - Draft 3.6

Table of Contents
1.    Preface                             1
2.    Introduction                         3
3.    Scope                             5
4.    General issues                         6
4.1.    Globalisation of the economy and mobility         6
4.2.    Internal Market ("four freedoms")             6
4.3.    Human Rights and the protection of communications     7
4.4.    Social acceptance of identification methods         8
4.5.    Human Rights and the safety of systems             9
4.6.    Management of openness and protection            10
4.7.    Common concerns of commercial and national security    11
4.8.    Security and law enforcement on international scale    12
4.9.    Economics of the security of information systems    12
4.10.    Social recognition of information crime            13
4.11.    Safety critical environments                14
4.12.    Embedded systems                    15
5.    Demand related issues                    16
5.1.    Agreement on security requirements for enterprises    16
5.2.    Agreement on security requirements for individual users    17
5.3.    Security objectives for enterprises            18
5.4.    Sectoral specifics                    19
5.5.    Security methodologies                    19
5.6.    Security domains                    20
5.7.    Data labelling                        21
5.8.    Access control and authenticity issues            22
5.8.1.    Access control                        22
5.8.2.     The individual right to signature            23
5.8.3.    Consistency of legal principles                24
5.8.4.    Signature schemes                    25
5.8.5.    Key usage                        26
5.8.6.    Universal acceptance                    27
5.8.7.    Security of electronically stored  information        27
5.9.    Privacy enhancement issues                28
5.9.1.    Perception of requirements for privacy enhancement    28
5.9.2.    The case for the provision of public confidentiality
    services                        30
5.9.3.    Interworking of autonomous confidentially services    32
5.10.    Motivation to acquire evaluated solutions        32
5.11.    Consistency of procurement practices            33
5.12.    Information Valuation                    34
6.    Supply related issues                    35
6.1.    Supply related Issues - Trusted Third Parties        35
6.1.1.    Role of Trusted Third Parties                35
6.1.2.    Operating principles of TTP                37
6.1.3.    Accreditation and audit of TTPs                38
6.1.4.    Use of names and certification of credentials        38
6.1.5.    Key management service                    40
6.1.6.    Management Services for Names and Credentials        42
6.1.7.    Legal services                        43
6.1.8.    Guaranteed date and time stamping            44
6.1.9.    Negotiable document transaction                45
6.2.    Supply related issues - Evaluation of trusted solutions    47
6.2.1.    Perceived Requirements for trusted solutions        47
6.2.2.    International harmonisation and mutual recognition    47
6.2.3.    Vendor declarations                    49
6.2.4.    Evaluation of applications                49
6.2.5.    Evaluation of communication services            49
6.2.6.    Trusted network management                51
6.2.7.    Modifications to evaluated products and re-evaluation    52
6.2.8.    Performance reporting for trusted products        53
6.2.9.    Rationalisation of evaluations                53
6.3.    Supply related issues - technological change        55
7.    Liability related issues (Consequences of Security
    and Safety Incidents)                    57
7.1.    Framework for international law relating to IS        57
7.2.    Legal provisions for liability in global services    57
7.3.    Insurance issues                    57
7.4.    Monitoring of compliance                58
7.5.    Metrics for loss assessment                58
8.    Spectrum of Measures                    60
8.1.    Common Framework and Consensus                60
8.2.    Awareness, education and training            61
8.3.    Agreements                        62
8.4.    Common Practices and Codes of Conduct            63
8.5.    Specifications                        65
8.6.    Standards                        66
8.7.    Products and Services                    67
8.8.    Technology                        68
8.9.    Regulation and Legislation                70
8.10.    Accreditation                        72
8.10.1.    Accreditation of Services                72
8.10.2.    Accreditation of TTPs                    72

Annex: Recalling the Action Lines from the Council mandate    73
    Action line I - Development of a strategic framework
    for the security of information systems            73
    Action line II - Identification of user and service
    provider requirements for the security of information    74
    Action Line III - Solutions for immediate and interim
    needs of users, suppliers and service providers        74
    Action line IV - Development of specifications,
    standardisation, evaluation and certification in
    respect of the security of information systems        75
    Action line V - Technological and operational
    developments in the security of information systems    76
    Action line VI - Provision of security of information
    systems                            77

Draft 3.6/Version: July 14, 1993

1.    Preface

The Council adopted in May 1992 a Decision in the field of the security
of information systems comprising the development of overall strategies
for the security of information systems (action plan) and setting up a
Senior Officials Group (SOG-IS) to advise the Commission on action to
be undertaken. The action plan having as objective the development of
overall strategies aiming to provide users and producers of
electronically stored, processed or transmitted information with
appropriate protection of information systems against accidental or
deliberate threats.

The scope of the Decision foresees the following lines of action:
I.      Development of a strategic framework  for the security of
    information systems
II.     Identification of user and service provider requirements for
    the security of information systems
III.    Solutions for immediate and interim needs of users, suppliers
    and service providers
IV.     Development of specifications, standardisation, evaluation, and
    certification in respect of the security of information systems;
V.      Technological and operational developments in the security of
    information systems; and
VI.    Provision of  security of information systems.

The action plan is implemented by the Commission, in close association
with related actions in Member States and in conjunction with related
Community research and development actions.
As a step towards the formulation of the "Action Plan" identified in
the Council Decision and in accordance with the opinion of SOG-IS a
"Green Book on the Security of Information Systems" is being prepared,
which addresses, in accordance with the Annex of the Decision,  an
overall view of the issues involved, and the spectrum of measures that
result from an analysis of the issues.

The present document sets out the background to the development of a
consistent approach to Information Security in Europe taking into
account common interests with other countries.

The intention of the Commission Services in preparing the present
document is to encourage a better understanding with the sector actors
in the Community on Information Security issues and to develop a
consensus on the requirements to be considered.  It therefore does not
necessarily represent the views of the Commission Services, or of the
Senior Officials Group for Information Security, on the subject, but
rather provides a basis for reflection and concertation with sector
actors and Member States.

The "Green Book" represents an intermediate step towards the
formulation of the Action Plan foreseen in the Council Decision. It is
to state the main issues related to the security of information systems
in its context.  A deliberate effort has been made to present the
subject matter in as objective a fashion as possible. By progressively
widening the consultation in the preparation of the document the wish
is, to obtain a representative and balanced view of the issues and the
nature and implications of the options for action one may wish to
consider. In its presentation the document is intentionally avoiding to
voice an opinion on the framework or organisation which might be
adopted to address a given issue or requirement. Such recommendations
are to be included in the Action Plan.

Note on Draft 3
    The preparation of the document includes four successive phases
    including iterative steps in the preparation of the document:
    Phase I: Preparation of an Outline and Collection of material
    Phase II: Drafting
    Phase III: Informal Consultation
    Phase IV: Formal Consultation
    In its present form it relates to the result of Phase II of the
    preparation of the Green Book.

The present draft document is the result of numerous contributions
received from experts, working in the framework of IBAG, SRI, the
Security Investigations and SOG-IS members (over 60 contributions
received).  To develop the thinking on specific groups of issues, the
Advisory Group reinforced by other experts were consulted and
contributed to the development of the document:

G. Axelsson
F. Iribarne Navarro
F. Piau
C. Blatchford
C. Jansen
E. Pimentel Saraiva
L. Cabirol
M. Jones
R. Pizer
D. Cerny
M. King
K. Presttun
B. Collins
S. Kowalski
M. Purser
M. De Soete
H. Kurth
K. Rihaczek
A. Eriksen
P. Landrock
G. Roelofsen
S. Geyres
O. Leiberich
R. Rueppel
A. Hallan
R. Moses
G. Ruggiu
G. Hardy
P. MAller
M. Tuset
S. Herda
A. Parondo
P. van Dijken
E. Humphreys
A. Peralta
D. Willis

Their contribution and valuable advise is gratefully acknowledged.

2.    Introduction

Individual, corporate and national wealth is increasingly in the form
of information. The growth and performance of an estimated 2/3 of the
economy relies on manufacturing or services heavily dependent on
information technology, telecommunications and broadcasting, and
therefore depends critically on the accuracy, security and
trustworthiness of information. This is of as great importance and
interest for individuals as for commerce, industry and public
administrations. Correspondingly, the protection of information in all
its aspects, here referred to as Information Security , has become a
central policy issue and a major concern world-wide.

The Council Decision of March 31, 1992 in the field of information
systems recognises this situation and calls for the "development of
strategies to enable the free movement of information within the single
market while ensuring the security of the use of information systems
throughout the Community".

A consistent approach at European level could help to promote the
interoperability of systems, lower existing barriers and avoid the
formation of new ones between the individual Member States and with
other countries Therefore, there is an urgent need to address
requirements and options for action in the field of security of
information systems at national, Community and international level in
close collaboration with sector actors and national governments. Any
action must take into account both national and international
commercial, legal and technical developments.

The key issue is to provide effective and practical security for
information held in an electronic form to the general users, the
business community and administrations without compromising the
interests of the public at large.

Since information security is involved in the protection not just of
property and people, but even of society itself, Member States regard
it as a topic which, like defence, touches on national sovereignty.

Structure of this document

The core of the document is describing issues and requirements for
action. These issues are grouped under the following headings:

    General issues. Here some of the basic issues relating to the
    security of information systems are described. These place
    security into a fast evolving world economy and treats issues
    like rights and obligations, human rights, openness and
    protection.

    Demand related issues. Issues under this section are concerned
    with requirements, security objectives, Codes of Practice, and
    the needs for digital signature and privacy enhanced
    communications.

    Supply related issues. The subjects discussed cover possible
    answers to the demand for security and include Trusted Third
    Parties, evaluation and R&D.

    Liability related issues. Under this heading issues relating to
    the consequences of security breaches are dealt with. These
    include civil law and insurance.

The diagram below depicts this structure.

3.    Scope

4.    General issues

4.1.    Globalisation of the economy and mobility

Issue

The internationalisation, diversification, pluralisation and
popularisation of the use of communications and information systems.

Discussion

The unprecedented increase in mobility and the provision of global
communications has resulted in manufacturing, trade and leisure
activities extending world-wide. Distributed manufacturing, publishing,
and financial operations form the back-bone of the modern economic
system. Travelling and communications for business or pleasure are
common place. This is being supported, and sometimes driven, by a
spectacular development in the field of communications and by the
proliferation of affordable and easy to use information systems. In the
last decade the cost-performance of long-distance transmission has
improved by 5 orders of magnitude. This change is providing the basis
for a rapid diversification of world-wide services customised to
provide access to a full range of information services and utilities
wherever and whenever required. Terrestrial, satellite and mobile
networks provide the physical infrastructure and an unrestrained number
of service applications provide the customised applications.

The nature and scope of provision of Information Security in this new
world of open, multi-service and multi-media communications with a
multitude of alternatives to routing, management and access has
profoundly changed the requirements and options for Information
Security (IS).

Requirements

    Revision of the scope and approach to information security to
    reflect the new conditions, challenges and requirements brought
    about by globalisation

    Adaptation of the respective policies and regulations.

4.2.    Internal Market ("four freedoms")

Issue

Alignment of the national conditions relating to Information Security
with the conditions of the Internal Market

Discussion

The Internal Market provides for the "four freedoms " within the
Community, ie free movement of goods, capital, services and people. The
legislation of Member States provides for the internal needs for
Information Security, however the requirements in the case of
trans-European communications remains to be addressed. Inconsistent or
incomplete provisions of information security represents a technical
obstacle to the working of the Internal Market.

Requirements

    Verification of the existing provisions with respect to their
    conformance to the Internal Market Policy of the EC implying
    the removal of existing internal barriers and the avoidance of
    the formation of new technical barriers due to divergent
    application of IS rules, regulations and legislation

    Provision of IS to business and the public of solutions freely
    applicable throughout the Community and on a preferential basis
    at the international level.

4.3.    Human Rights and the protection of communications

Issue

To reconcile the human right to privacy and the obligations of law
enforcement to protect public order.

Discussion

Privacy and the protection of private information is considered one of
the fundamental human rights of citizens and is protected to varying
degrees in Member States. The European convention on Human Rights
states "Everyone as a right to respect for his private and family life,
his home and his correspondence". Citizens have the legitimate
expectation that this right is respected and that solutions are made
available to him that ensure the safeguard of this right. This applies
to conversation in the home and to a lesser degree when
telecommunications is being used. However, prevailing national
solutions do not, at present, provide for trans-European services and
communications and this lack can be exploited, inter alia, by organised
crime. With the rapid growth and diversification of communication
services the rights and duties of citizens and law enforcement are
being reviewed and redefined, eg FBI supported legislation and the
proposal of the government to provide US business and citizens with
cryptographic devices including explicit provision for intercept by law
enforcement agencies.

In this context, it should also be noted that the Maastricht treaty
establishes a citizenship of the Union, and that every person holding
the nationality of a Member State shall be a citizen of the Union.

As the safety and security of the citizen provided by the process of
law and order is also related to human rights, reconciling these
objectives represents a delicate political issue.

The diagram below gives an overview of international, Community and
national responsibilities for different application categories.


Requirements

    Definition of a common approach defining rights,
    responsibilities and duties of citizens and business on the one
    hand, and that of the authorities on the other hand.

4.4.    Social acceptance of identification methods

Issue

To reconcile the human right to privacy and protection and the use of
identification methods to control human access to systems, buildings,
offices and other physical environments.

Discussion

The use of biometric methods is becoming more technically feasible and
cost-effective as an identification technique for access control. Such
methods rely on a system of machine recognition of a set of personal
characteristics to verify the identity of an authorised user in order
to allow access to some physical environment. Such personal
characteristics include hand-written signatures, fingerprints, voice
prints, machine phrenology, lip prints, response of the skeleton to a
physical stimulus, hand geometry and retinal patterns.

Many other different personal characteristics and recognition
techniques are being investigated by researchers. Some of these effect
the human right for privacy more than others and some are socially
unacceptable.

As an example, the retinal blood-vessel pattern of a human eye (retinal
vasculature) is highly characteristic of the individual. A typical
system might work as follows. The individual is required to look into
an optical device and through a process of optical adjustment fixate on
a crosswire whereby the recognition machine will locate the fovea of
the individual, and scanning with a low intensity infra-red beam detect
the nodes and branches of the retinal pattern falling within the
scanned area. The measured pattern is compared with the stored pattern
of the individual and access is granted or denied depending on the
result of the comparison. This method of machine recognition may or may
not be considered sociably acceptable on the grounds of hygiene, due to
the type of information being stored about the individual (a record of
which may be built up which may reveal other information relating to a
persons health condition) or the general problem of protection of
medically relevant information.

There are systems under trial for the recognition of human profiles eg
the human face. Again these systems may not in general be socially
acceptable and the issue of privacy and human rights may come into
play.

Progress in bio-technology raises new questions as to the definition of
privacy and as to the rights of the individual over information
relating to his person and the assurances required for its use.
Information relating to genetic defects are of obvious sensitivity and
implies corresponding measures for protection. Work may need to be
undertaken to set out a clear definition between things that are
biometric and things that are medical.  At the present time there is
low confidence by the general public in the honesty of commerce or
government in the field of bio-technology.

Requirements

    Clarification of the ownership and privacy issues surrounding
    biometric data

    Development of an agreed classification of biometric data and
    conditions requiring secure handling of such data

    Development of a common approach defining the rights of and
    responsibilities of citizens, business users, corporations and
    administrations using biometric techniques.

4.5.    Human Rights and the safety of systems

Issue

To reconcile the human right to an expectation of the supply of goods
and services that are not life threatening with the vendors commercial
needs to supply goods and services that exploit information systems in
safety critical functions.

Discussion

Security critical systems differ from security critical ones in that if
they fail death or serious injury to people may result. The law treats
the liability of suppliers in this situation differently from that
where information is lost or property damaged. Suppliers are held
strictly liable. Codes of practice for the development of safety
critical systems exist in order to reduce the chance of failure and
design techniques are invoked to analyse all possible hazards.
Nevertheless risks remain.

At a community level, harmonisation of such codes of practice and
design techniques would enable citizens to have greater expectations of
their own safety in any member nation, and it would reduce the costs of
development of codes of practice and design techniques in each nation.
Furthermore, pan-community procurement would be facilitated, as would
the development of safety critical systems by community wide
consortia.

Requirements

    Review of current design practices and codes of conduct with
    the aim of generating a community wide standard for such
    processes

    Study the legal environment within which vendors and users of
    safety critical systems work, with the objective of harmonising
    that environment.

4.6.    Management of openness and protection

Issue

Openness and protection are partially contradictory user requirements,
which need to be reconciled depending on the specific circumstances.
The user must be able to define the security controls based on need,
consistent with national, international and regulatory constraints.
These controls need to managed in a way that provides protection in an
open environment.

Discussion

In considering management, one must introduce the concept of a user of
an Information System, and the role that they perform in using that
system.  At any time the user of an Information System will be
performing a role, which could be one of: system owner, administrator,
auditor, investigator, data provider, reviewer/collator. It is quite
possible for the requirements of these roles to be logical in conflict
with each other. Openness of access may be in conflict with protection
from general availability. There may also be national, international or
regulatory constraints which impose role requirements beyond those
needed to satisfy the operational use of the Information System.  An
Open environment must be provided with controls that are capable of
providing protection without technical limitations.

A single, isolated computer may be effectively protected, as far as
confidentiality is concerned, against threats from outside by physical
separation and human administration. This does not apply in the context
of telematics. Telecommunications and telematics applications are
increasingly being designed for maximum openness and inter-operability
since the utility of ITT&B-based services and applications depends
largely on the possibility of users world-wide being able to freely
inter-operate over communication links. Major international efforts are
underway to establish standards permitting this, in particular through
OSI (Open System Interconnection), (ODP) Open Distributed Processing
and ONP (Open Network Provision).

The acceptance and use of telematics services depends on meeting the
justifiable interests of all parties: in particular to be able to chose
trade-offs between "openness" and "protection".

In recognition of this, increasing attention is being given to the
provision of Information Security Services and Techniques.

The comparison with the way this dilemma is traditionally addressed
leads to some observations which most likely will also apply when
information is handled electronically. These include, for example

    The User/Originator requires the freedom to decide over the
    degree of openness/protection depending on his appreciation of
    the requirement or the applicable rules of conduct for the
    given activity.

    Profiles exist setting out the needs of both openness and
    protection that need to be supported.  A single level profile
    will not support the requirements of all the users involved,
    and there may need to be mechanisms which allow for negotiation
    between profiles to determine temporarily agreed common
    profiles.

    Infrastructure, services, applications and organisation have to
    be adapted to provide the openness/protection.

    To the role holders, both the visibility of and the
    transparency of the degree of openness/protection is crucial.

    Accountability for the application of appropriate levels of
    openness/protection require objective records, which are
    themselves protected.

    The management of the openness and the protection of
    Information Systems requires the definition of security
    domains.  These correspond to the security policies which are
    in force for the Information Systems in use, as modified by the
    constraints of the role holders.  It should be remembered that
    computers which are not directly under human supervision may
    form part of the security domains involved.

Requirements

Development of a generic framework for the management of open and
protected communications in a user/business oriented environment:

1.    Reinforcement of the options to define security domains
    Terminal users, servers and other computer based resources link
    into business processes to provide information domains which
    require corresponding security domains.  Such facilities must
    not only promote the correct degree of openness , but must also
    provide filters against unauthorised access. This needs to be
    possible not only at one site eg on LAN-Based applications, but
    also via MANs and other communication-links. The definition and
    management of such security domains needs to be possible either
    from within the user group or provided by a trusted third
    party. Virtual Private Networks have some of the features, but
    these would also need to be available in the context of public
    network based applications.

2.    User Interface for the management of openness/protection

    The normal usage requires the ability to communicate either
    with specific correspondents, a select group, an open group or
    indiscriminately. The choice being determined by the nature of
    the information, its function and the applicable rules. The
    user-interface needs to cater for this as well as the
    underlying services and applications.

3.      Objective records and procedures for the accounting of
    open/protected transactions

    Processes must be available that provide non-refutable evidence
    of the origin of, and delivery of, information to all involved
    partners.

4.7.    Common concerns of commercial and national security

Issue

Information Security is a common concern of business, administrations,
citizens, law enforcement and defence.

Discussion

Though not to the same degree, commercial and personal information
security shares many aspects with the defence and other classified
governmental affairs. This provides an opportunity for commercial and
personal applications to build on experience and expertise from the
defence and classified government area.

The reverse is also true. As commercial security advances and becomes
available at a large scale, governments and defence organisations are
well advised to take into account this body of experience. In addition
governments themselves are, of course, in the need of adequate
protection of their non-classified information and will wish to make
use of public services of this kind.

Requirements

    Concerted effort to address the common requirements of
    business, citizens and authorities to adequately protect
    commercial and personal information and its communication

    definition of common rules and procedures distinguishing the
    handling of classified and commercial and personal
    information.

4.8.    Security and law enforcement on international scale

Issue

Crime is exploiting weak information security to further its ends.
Strong information privacy may also be used to escape investigation by
law enforcement.

Discussion

Crime, and here organised crime and terrorism in particular, are
relying on weak information security to prepare and execute their
operations. As quite powerful means for information security have been
published and are freely available, their increased use in protecting
such operations is a growing problem. Public authorities have in the
past used legal and regulatory powers to restrict the use and
dissemination of related technologies. With the growing availability of
computing power and open networks, this approach is getting less
effective, as organised crime, contrary to the legitimate user, is not
concerned with the use of products that are not authorised. The overall
result is that business is seriously constrained in meeting its
security requirements, particularly in international communications and
in its relations with other organisations. If business requires the
legal and regulatory powers to relinquish total control over these
security related technologies, business has a "duty of care" to manage
and control their use for their commercial and business purposes,
including the policing and auditing of management environments.

Requirements

    An effective, internationally agreed, economic, ethical and
    usable solution to meet business, administration and personal
    needs including mechanisms for authorised interception and
    reporting of incidents and crimes adjusted to the conditions of
    the Internal Market, and to include the necessary equipment and
    software, but also an infrastructure of Trusted Third Parties.
    This will discourage "home-made" or other solutions.

4.9.    Economics of the security of information systems

Issue

The use of information security impacts on costs, performance and
availability.

Discussion

The cost of security is an integral part of cost of ownership of an
information system, ie namely that without security the users system is
at risk. The cost of protection against breaches of security needs to
be commensurate with the costs (both direct and indirect) that may be
incurred from a breach in security. A security breach may have short
term (and perhaps, localised) implications such as loss of sales and
revenue or fraud or theft. It may also have longer term (and wider)
impacts on business communities through loss of confidence and
consequential loss of business.

The costs of detection, resistance and recovery can be both tangible
and high, and although there are techniques available to quantify risks
there are no generally applicable methods for estimating the potential
costs arising for example from denial of service or loss of integrity.
The provision of security measures may also make it harder to use and
may constrain overall performance. However, where the security risk is
high enough to cause an unacceptable level of compromise, leading to
considerable commercial and financial loss, then security measures must
be given high priority commensurate with the nature and value of the
business in question.

If IS is to expensive, clumsy, not effective in the context of actual
usage or not available in time its use is avoided and high risks are
taken until something drastic happens. The issue for IS is therefore,
not only to be effective but also to address other requirements which
impact the acceptability and application of IS.

In particular, countermeasures may have to be put in place that meet
specific regulatory or legislative requirements, with associated
mandatory assurance needs.

To a business, securing information can be thought of as being like an
insurance policy - the cost of protection must be balanced against the
likely consequences of the perceived threat occurring. This cost is
made up of a number of elements, including:

    the life-cycle costs of implementing the countermeasures in
    relation to likely and worst case

    impact on business performance

    liability of management for incidents and relationship with
    customer confidence.

Requirements

    Development of an approach to a "cost of Security" model for a
    business and the private user. This includes, among other
    potential costs, the cost of installation, operation,
    maintenance, up-grade and insurance premiums as well as direct
    financial losses due to breaches of security.

    Definition of IS as business and marketing factor.

    Codes of practice and other recognised regulatory norms need to
    be developed which identify to a level acceptable to both
    insurers, regulators and the commercial courts specific duties
    and responsibilities of the parties to the use of Information
    Systems and their security requirements.

4.10.    Social recognition of information crime

Issues

Negligence, ignorance and recklessness are the some of the causes of
many security events and create the opportunity for information
crimes.

Discussion

IS-incidents, like failures to observe safety rules, can in many
instances be attributed to a lack of motivation. This is compounded by
the fact that the loss of immaterial goods, for example information, is
not considered as serious as the loss of material goods. This is due in
part to the fact that electronically stored information can be
reproduced at close to zero costs without the loss of the original.
Stealing information is therefore often considered as a gain for the
thief without a loss to the owner. It is perceived by many to be a game
rather than a real problem because people are unable to relate the
electronic world to the real one. This has the double effect of
enciting negligence by the owner of the information and little concern
for the illegal acquisition of information. Because of the widely
practised back-up of information resources, this applies even to the
intentional or accidental destruction of information.

There is much work in establishing and reinforcing "ethical principles"
as applied to specific actions of information ownership, creation,
dissemination, etc. These need to be related to sector actors, their
control perspective and the assets over which they exercise either
explicit or implicit authority. This needs to be related to codes of
practice and conduct, legislation and regulation to establish the
extent to which protection is dependent upon a formal or informal
control environment or can rely on the enhancement of ethical and
professional standards. At the moment there are no effective
professional standards in IT, anyone can do IT by buying a PC and
taking a bulletin board subscription.  Changes to traditional
programming techniques have made it possible for non-IT professionals
to deliver programming and systems analysis methods.  In many SMEs such
work would often be done by non-IT professionals.]

Two examples of computer crime illustrate the diversity of situations
which may arise:

Example 1
In a German company (belonging to the "Association for Security") a
programmer - unsatisfied with his salary - caused damage by a specific
computer-programme. This program modified the data of a data bank by
randomly controlled accesses. The programme was intricately hidden
among other programme-parts. Within two years the data-bank became more
and more defective and damaged. The costs of damages and of
reconstructing the data bank were about 500 000 ECU.

Example 2
In an office of the German Government a huge computer-system,
comprising various storage means and terminals was installed. Suddenly
the computer-execution-times and the response times became much longer
than expected. After a difficult investigations it turned out, that a
programmer, who had founded together with his wife a shop for sending
out photo-equipment, has done his complete accounting, mailing, etc.
for his shop on the computer in a hidden area. He had camouflaged or
suppressed the protocolling of this programme. He caused damage of
about 100 000 ECU.

Requirements

    Development into basic education of the Information Security
    requirements and concepts needed to operate safely in the
    Information Age

    Clarification of "Info-Ethics" for the professional and
    individual user in its relationship to Information Security

    Clarification of responsibilities of the sector actors in
    general and in their relations within each other, with
    particular reference to open and distributed applications.

4.11.    Safety critical environments

Issue

Protection of information in safety critical environments.

Discussion

Safety is defined in terms of hazards and risk. A hazard is a set of
conditions (a state) that can lead to an accident, given certain
environmental conditions. The analysis of the safety environment
involves identifying the hazards within a safety critical environment
and then either verifying that hazardous states cannot be reached or
that the risk is acceptable. Risk is defined as a function of the
probability of a hazard occurring, the probability that the hazard will
lead to an accident, and the worst potential loss associated with such
an accident. You can diminish risk by reducing any or all of these
factors, and there are environmental-safety techniques that focus on
each.

There is an increase in the use of information systems within various
areas of application which are considered as part of a safety critical
environment. For example in the area of healthcare (eg medical
databases), air traffic control, transportation of hazardous and
dangerous goods, industrial processes etc. The increased reliance on
electronic information in these various areas of application
specifically related to the control and management of safety, has
resulted in an increased need for the protection of the information
system supplying such information. Therefore the protection of
information systems used in safety critical environments is factor to
be addressed when considering hazards and associated risks in such
environments.

Consideration needs to be given to the common requirement of security
and safety, common methods for analysing the threats, vulnerabilities
and hazards, and the role of security evaluation for safety-critical
systems.

Requirements

    Development of a common approach to the handling of security
    and safety critical requirements

    Development of a common methodology for threat, vulnerability
    and hazard analysis for the protection of information systems
    used in safety-critical environments

    Generation of common methodology for the design, development
    and procurement of safety critical systems, covering project
    management, development environment, auditing of process,
    configuration management and change control

    Development of a common approach to security evaluation of
    information systems in safety-critical environments.

4.12.    Embedded systems

Issue:

Increasing use of computers and information processing is occurring in
a manner that incorporates information/computers into other products to
make those products more usable, flexible, etc. These embedded systems
depend upon the accuracy of the programs they contain and the
information inputs/outputs to preserve the usefulness of the products
in which they are placed. Failure of the processor or corruption of the
programs or information contained may cause failure or destruction of
the device or hazard to the user.

Discussion:

Embedded systems are already being used in automobiles for controlling
ignition and carburetor systems or braking systems, in television sets
and VCRs, in microwave ovens, and so on. As embedded systems
proliferate they create potentials for physical hazard to users beyond
simple loss of the functionality of the devices in which they are
embedded. The potential will also exist that such embedded systems
could constitute a hazard to the well-being of bystanders or property.
For example, one scenario of embedded systems would have them in
household appliances and include the capability to communicate
potential failure information to maintenance providers. The potential
exists that such a device could fail in a mode that would put household
or service providers' telephone systems at risk.

To some extent, liability laws will cover product failures which create
damage to users. However, there may need to be some added means of
ensuring the reliability of embedded systems and the integrity of the
systems as they leave the factory. These means may include:

Requirements

    Development of methods of testing that enable standards of
    reliability to be ensured, including tests to destruction where
    appropriate

    Development of an approach for the certification of samples

    Definition of requirements for fail-safe system architectures
    and implementations

    Definition of anti-tampering and protection specifications and
    standards.

5.    Demand related issues

5.1.    Agreement on security requirements for enterprises

Issue

Identification of real world security requirements and objectives for
business and administration.

Discussion

The protection of information systems must be all embracing.
Consideration must be given to requirements from the view point of the
enterprise, taking into account corporate and organisation plans, goals
and strategies of the business or administration. Requirements at this
level can be then translated into "Security Objectives" - why the
security functionality is required as it applies to the operation of
the business or administration environment.

These security objectives need then to be supported by a definition of
the security functionality and related services required necessary to
support the user/business.

The security model has not included legal, accounting or regulatory
requirements which may be imposed upon enterprises rather than forming
any integral part of the Enterprise requirements.

Given the complexity and diversity of user/enterprise requirements for
such protection it is necessary to classify the requirements in some
structured way consistent with real world business and operational
environments.

The protection of information systems needs to consider the enterprise
requirements of the "business". These requirements not only include
functionality that is "owned" by the enterprise but must include
inter-enterprise requirements as well. It must consider the
functionality and assurance of IT building blocks, end user
applications, integration enablers (such as electronic mail), operating
systems, communication services and protocols, and basic hardware and
software platforms.

The balance of functionality (what it does) and assurance (how well it
does it), both generic and application specific, will determine the
extent to which electronic information systems are accepted as an
integral part of both the public and corporate IT infrastructure to
underpin business actions.

The prime requirement for any secure system must be a set of
architectural principles that can be effectively translated into an
overall design framework. Secure systems must be created at different
"grades of assurance" from a set of policies, standards and
procedures.

Specific security requirements relating to open systems will come from
a threat assessment and risk analysis which will form part of the
overall system security policy process.

The cost of security is an integral part of the cost of ownership of an
IT system ie namely that without security the users system is at risk.
The cost of protection against breaches of security needs to be
commensurate with the costs (both direct and indirect) that may be
incurred from a breach in security. A security breach may have short
term (and perhaps, localised) implications such as loss of sales and
revenue or fraud. It may also have longer term (and wider) impacts on
business communities through loss of confidence and consequential loss
of business.

The costs of detection, resistance and recovery can be both tangible
and high, and although there are techniques available to quantify risks
there are no generally applicable methods for estimating the potential
costs arising for example from denial of service or loss of integrity.
The provision of security measures may also make it harder to use and
may constrain overall performance. However, where the security risk is
high enough to cause an unacceptable level of compromise, leading to
considerable commercial and financial loss, then security measures must
be given high priority commensurate with the nature and value of the
business in question. Sectoral requirements vary widely, as do
requirements by size of enterprise within a sector.  Sectoral
requirements may be varied by regulation, bilateral international
agreements, general trading agreements or conventions.

Increased demand for Electronic trading from all kinds of businesses,
both public and private sector, will place requirements for security on
the communal service infrastructure that provides the capability for
such business activities. The regulatory and legal environment within
which such service organisations work will become a factor for economic
growth in the community, and security of service provision an element
of such services.

Requirements

    Development of a taxonomy and directory of user requirements
    and security objectives derived from real world business
    applications.

5.2.    Agreement on security requirements for individual users

Issue

Identification of security requirements and objectives for individual
users.

Discussion

The individual user, in their role as a private citizen or as a member
of a liberal profession (eg a lawyer or medical doctor), has a natural
interest, and sometimes a legal requirement, to protect some of their
information. Unlike in the case of the enterprise, the individual user
will not normally go through a systematic process of establishing
goals, definition of security objectives, etc, unless they are subject
to professional standards of conduct.

The individual normally has at his disposal a PC (or small network of
PCs) and some communication links, eg telephone, fax, e-mail. Physical
security is likely to be weak.

Most liberal profession work under some codes of practice or conduct.
These codes are of a general nature and do not normally specify
particular security arrangements.

The common and specific requirements of individual users, with regard
to the protection of their computer installation (physical and
electronic), the protection of their data (against accidental and
deliberate loss) and the protection of their communications (eg signed
communications, privacy enhanced communications) must be established.

Requirements

    Development of user profiles identifying standard types of
    users together with typical requirements.

5.3.    Security objectives for enterprises

Issue

Definition of Security Objectives for enterprises.

Discussion

Security objectives are related to confidentiality, integrity,
availability, legality and auditability. Controls are related to
segregation of duties and methods for obtaining independent audit of
the achieved results of an Information System.  Controls may also
relate to the reasonableness or plausibility of information or an
activity.

A security objective is a description of what security the enterprise
is trying to achieve eg why this security control/function is wanted.
It is a mission statement of the user/enterprise which describes why an
aspect of security is needed. It is a user/business target or purpose
to which security is being addressed. For example, consider the subject
of data integrity and the objective "Prevent unauthorised modification
to data". The security objective has the objective "Appropriate
mechanisms should exist to preserve the integrity of data". For example
this may be related to data held on a medical database, on a company
financial database, in airline reservation system or a geography
information system.

Security objectives are thus concerned with the preservation of
information with regard to its utility, availability, authenticity,
integrity and confidentiality within the enterprise and between
enterprises or concerned with some user environment. These are
dependent upon more detailed definitions of business control being
made. The structure and organisation of the specialist accounting
functions in a business are examples of business controls.

The organisation of security within enterprises in terms of business
control structures or in the case of some user environment (eg legal,
accounting, audit etc) and functions (eg IT, human resources,
insurance) needs to be integrated with a set of security policies,
standards (both public and in-house), and made compliant with laws and
regulations (eg computer crime manual), guidelines and codes of
practice etc.

The process of producing a security policy requires the use of a set of
security methodologies, tools and evaluation criteria. For example risk
analysis methods, baseline controls, and evaluation criteria (eg ITSEC,
Federal Criteria etc.).

Security objectives thus encompasses a set of objectives (and possibly
sub-objectives) and a set of related issues that reflect specific
points of concern, problems, questions relative to business
requirements, controls and applications.

The diagram below shows the relationship between Security objectives,
Security organisation, and Security methodologies. Laws apply to the
user environment directly.  Their presence generates some of the
security objectives.  Standards may be both mandatory and
discretionary, and may incorporate methodologies.  The final box covers
security methods and techniques.

5.4.    Sectoral specifics

Issue

Beyond the normal requirements common to different business sectors and
user environments there may also be additional requirements and
priorities specific to the operational nature and commercial mission of
a particular business. These specific requirements can be normally
expressed in terms of codes of practice and baseline controls.

Discussion

Legal and regulatory provisions can be supported by Codes of Practice
to achieve due care and diligence. There are those of general
application and those that are industry specific. A general Code of
Practice may achieved by  the establishment of a security management
handbook, maybe based upon the approach taken for achieving a Quality
code of practice (ISO9000). The application of IS is a prerequisite for
the successful conduct of business for particular sectors, especially
when these sectors a highly interactive. The most prominent among them
are:
    Finance
    Trade
    Medical
    Telecommunications
    Administrations.

Requirements

    Development of a set of codes of practice and baseline controls
    addressing specific business sector requirements.

5.5.    Security methodologies
Issue

Selection of security requirements analysis methodologies (eg risk
analysis methods, codes of practice etc.) and related safety hazard
analysis methods relevant and applicable to the user/enterprise
business policies and controls.

Discussion

Any security policy formulation must derive its requirements statement
from an assessment of the potential threats against the business and
the supporting service infrastructure of the IT and telecommunication
processes. This will allow an eventual implementation with clearly
understood trade-offs, administrative and technical measures against
human malefactors, and a balance between security cost and level of
operational fitness; these are components of a Risk Management
strategy. The risk management strategy on a European level should be
based on a rigorous and consistent approach to the analysis of the
threats to and vulnerabilities of the system and its components, and
where appropriate safety hazards. This approach should be based as far
as possible on existing, and, possibly, standardised, risk/hazard
analysis modelling techniques and products. The issues include:

    adequacy of present risk assessment techniques

    awareness about current trends, and modelling

    awareness of the responsible security officers about security

    security breach incidents

    safety hazards as they impact on or are related to the security
    of a system and vice versa.

Requirements

    Development of evaluation criteria and guidelines applicable to
    the selection of security requirements analysis methodologies
    (eg risk analysis and management methods, products etc)

    Harmonisation and standardisation of a European and
    international approach

    Integration of security and safety methodologies where
    appropriate to provide a coherent framework for the analysis of
    assured systems.

5.6.    Security domains

Issue

Openness and protection.

Discussion

In practice, the level of IS is dynamically adapted to a given
situation. This leads to the concept of Dynamic IS Management and the
need to be able to define domains, in which IS is applied
homogeneously.

Security Domain Concept

Domains are user groupings sharing some of their functions and support.
For some activities they operate as virtually closed user groups, but
have the possibility to interwork with other domains as long as certain
minimum requirements ensure no loss of trust or a transparent
downgrading.

The notion of a security domain is therefore important for two reasons.
Namely,
    It can be used to describe how security is managed and administered, and
    It can be used as a building block in modelling security
    relevant activities that involve elements under distinct
    security authorities.

Examples of domain activities are:

    accesses to elements (eg a database for network management)
    a communications link
    operations relating to a specific management function
    non-repudiation operations involving a notary.

Security Policy

The organisation of security within enterprises in terms of business
control structures or in the case of some user environment (eg legal,
accounting, audit etc) and functions (eg IT, human resources,
insurance) needs to be supported by a set of security policies,
standards (both public and in-house), laws and regulations (eg computer
crime manual), guidelines and codes of practice etc.

The security policy defines what is meant by security within the
domain, the rules by which security may be obtained to the satisfaction
of the security authority, and the activities to which it applies. The
security policy may also define which rules apply in relations with
other security domains in general, and in relations with particular
other security domains.

Requirements

The management of inter-domain openness and protection may be different
depending on similarities in purpose, and agreements will be needed to
achieve appropriate levels of assurance. Mechanisms by which TTPs
achieve efficient, coherent management of policies, procedures and
controls between domains need development:

    generation of guidelines for domain creation, management and
    control

    development of a common framework for domain interworking

    agreement on management, TTPs, accreditation, auditing and
    relations with law enforcement agencies.

5.7.    Information labelling

Issue

Transfer of information between domains requires agreement on the
syntax and semantics of information labels, and of the procedures and
mechanisms for handling labelled information.

Discussion

The information label is a short hand way of expressing the protective
measures that should be applied to the labelled information.

Information labelling is an essential part of ensuring that information
objects receive the appropriate level of security protection both
within and between security domains.

Trust between organisations depends on the assurance that information
will be handled in a way consistent with its security requirement in
terms of confidentiality, integrity, availability and non-repudiation.

The need for comprehensive labels has become acute because of the
increasing degree to which organisations interoperate electronically.
This has led to increased reliance on technical measures to achieve
adequate security. It is quite feasible for trusted systems to switch
on or off technical measures automatically providing that the label
adequately expresses the security requirement associated with a piece
of information. Labels could then be used to make decisions on
information routing, transmission enveloping, requirements for
confirmation and so on.

Organisations have to agree on the range of options that do meet any
particular security requirement. Part of the solution to the handling
of labelled information lies in the development of Codes of Practice
specifying procedures and mechanisms. There is also a need for
accreditation and audit of communicating partners. The introduction of
independent third parties avoids the pairwise interactions that would
otherwise be necessary to establish trust.

Requirements

    Code of Practice for information labelling.

5.8.    Access control and authenticity issues

5.8.1.    Access control

Issue

Access control procedures to many systems are not standardised or well
managed.

Discussion

Computer systems and services impose control procedures on persons (or
other systems) attempting to access them directly or over local or
wide-area networks. These access control procedures apply to
"connections"; that is, they determine whether or not a connection,
association or session is allowed to be established. These control
procedures have been often primitive and relatively insecure, as the
occurrence of "hacking" demonstrates. For example, the only protection
afforded may be by a password, transmitted over the network "in clear"
so that any wiretapper with physical or electro-magnetic access can
read it.

The requirement for secure access control is not confined to access to
host computers by persons at terminals. Reciprocal (mutual) access
control is often needed between two (or sometimes more) systems. Access
control can apply across general telecommunication networks,
determining (for example) who may call whom by telephone; or who may
receive which programme on a cable TV network. In addition to applying
to end-to-end (trans-network) communications, access control also
applies to users and (even more importantly) operators accessing the
network and to access by human users to terminal devices.

Although the importance of access control is widely recognised, the
practical application of security techniques to solving the problem is
more limited. This is for a variety of reasons including technical
complexity, lack of agreed standards, lack of user acceptability and
lack of supporting infrastructure (such as TTPs).

Secure access control relies on a mixture of:

    identification mechanisms (authentic naming) identifying the
    remote person or system

    authorisation mechanisms, determining the authority of the
    remote person or system to carry out different types of actions

    random (unpredictable) components, affording protection against
    the re-use of once-valid access control messages under invalid
    circumstances (replay)

    cryptographic techniques to protect the above from
    modification, copying, etc.

Without some analysis of access control scenarios, followed by some
outline standardisation work, users and systems are going to find
themselves having to implement and use (depending on their current
application) a range of incompatible techniques, which in turn rely on
only partially interoperable infrastructures (such as naming and
identification authorities, certification authorities, key management
systems, directory services, etc.).

Requirements

There is a need for widely accepted solutions to the most common access
control scenarios. There is a need to:

    identify and group access control scenarios, to determine
    levels of commonality

    identify techniques, products, specifications and standards
    addressing access control, and associate them with the
    identified scenarios

    identify parameters common to most or all of the above
    techniques, products, specifications and standards and
    investigate the feasibility of establishing common formats for
    them

    identify the key features for coherence in the supporting
    infrastructure

    define a limited number of basic access control mechanisms for
    pilot implementation.

5.8.2.     The individual right to signature

Issue

Individuals have the right to sign any information.

Discussion

Like with hand-written signatures, anybody is entitled to use a digital
signature. Therefore, the distribution of keys for the purpose of
signature must be non-discriminatory and non-restrictive. Separate from
the signature is the question of authority, ie if a certain person is
entitled to sign a certain element of information, document or
transaction.

Signature verification is therefore a two step process: formal
verification of the signature and verification of the authority of the
sender. This process is depicted below.

It is assumed in this simple model, that the sender adds his
certificate (name plus his public key) to the signed document. The
formal verification then establishes that a person with a certain name
has correctly applied his signature and that the document has not been
modified in transfer. Verification of authority checks that the name
has the legal authority to sign a particular document.

Note that as a consequence, the authority given to a person should not
be included in the attributes of the certificate, otherwise any change
in authority would invalidate the certificate.

The situation maybe further complicated by the fact that several
signatures maybe required for certain documents, eg husband and wife
plus notary, two company directors.

Requirements

    Clarification of the right to signature and the attached authority.

5.8.3.    Consistency of legal principles

Issue

The legal functions have to be clearly identified for the authority of
digital signatures, before a code-of-practice can be developed and
introduced.

Discussion

In legal practice security and functional requirements for hand-written
signatures differ widely. In some cases a hand-written signature is
only to indicate that the signer has concluded his train of thought or
his expression of will; under the given circumstances its authenticity
may be obvious and need not be provable. In other cases, for evidence,
the signature must be provably authentic. In yet other cases
authenticity requirements may demand attestation or even ask for more
than one person's signature or for public notification.

The spectrum of legal requirements can be matched by the spectrum of
technical realisations which may differ with respect to security
provisions just as widely as legal requirements. Yet the signing
process must be transparent to the signer. For this reason it must
follow standardised rules; specific man-machine interfaces must be
familiar to the signer; i.e. they must follow a standardised layout
principle.

For ease of transition (in judicial thinking) from hand-written to
digital signatures traditional functional requirements for hand-written
signatures should be met by the technical implementation of digital
signatures as closely as possible.

A particular problem is the validity period of a digital signature. One
must distinguish the validity period of the signature itself and the
validity period of the authorisation.

The validity period of the digital signature itself may have to be
limited for technical reasons. These reasons include:

1.      Insufficient key length. One may discover that some years from
now, new progress in mathematics and technology makes it plausible that
keys of the originally chosen limited length can be broken. (For
instance, several European banks have introduced remote banking with
RSA keys of length 512 bits. One cannot guarantee that this will be
safe in 10 years, or even less, from now.)

2.      Poor key generation. One cannot be sure that programs at the
desired quality level will be used by all key management centres. Hence
users of those key management centres may find that their keys are
breakable, and they have to cancel their certificates.

3.      Weak protection of workstation. The secret key of a user may be
compromised accidentally or through negligence. It may also be possible
to tap the password of a user through a Trojan horse on his PC and
subsequently get access to the secret key. (Fraudulent users may even
claim this happened, and give away their key on purpose, in order to
dispute that a certain signature did originate from them.)

Taking the necessary precautions, and taking a differentiated approach
to the validity period of signatures, then most digital signatures
would fall inside the scope of applicability of hand written signatures

The authority attached to a signature normally changes much faster. The
authority given to a person should therefore not be included in the
attributes of the certificate, otherwise any change in authority would
invalidate the certificate.

However, in all the work that has been carried out so far, there is no
solution offered to the following problem: If messages have been signed
with a key and needs to be kept for a number of years, and that key is
denounced by the user as being compromised, how can the value of the
already calculated signature be left intact? One possibility might be
to use a TTP for time stamping, but further study into this problem
seems in place. An example may illustrate this point.

If a user A signs a message in 1993, which has legal consequences to
user B until 2003, and A then cancels his certificate in year 1995,
claiming that his key has been compromised, he will probably claim that
the signed document from 1993 was falsified in 1995 by B, who could
have bought a copy of A's secret key. However, if B upon receipt in
1993 had gone to a TTP and had the signature of A time stamped and
signed by the TTP, or even registered, he can prove that A in fact did
produce the said signature back in 1993.

For some sectors and/or applications the granularity of the time
stamping will be critical. It is conceivable that trusted time down to
one second accuracy will be needed.

Requirements

    The legal functions of signatures need to be agreed
    EC-wide/internationally. Once this is achieved, it is possible
    to determine to what extent a code-of- practice will suffice.
    One issue to be addressed is the intended use of the digital
    signature, and the legal responsibility and liability of the
    signing entity with regard to the signed information.

    Clarification of the conditions of acceptance of the authority
    of an digital signature, eg for legally binding purposes, ie as
    substitute for hand-written original signatures.

    Recommendation for the implementation for a public digital
    signature scheme for use by business, administrations and the
    general public.

    Legislative rules and, where appropriate, liabilities, for
    keys, certificates and TTPs need to be developed to cover
    revocation of any or all the entities involved in the "chain of
    proof" needed in the signature technique.

5.8.4.    Signature schemes

Issue

Introduction of an international digital signature and identification
schemes.

Discussion

Open communication requires standardised publicly available algorithms.
It is possible, however, to develop a scheme for digital signatures, to
get laws, regulations or directives in place, to develop supporting
profile standards and to develop fully implementable models for TTPs,
without specifying in detail the underlying algorithms.

The characteristics required of a digital signature mechanism include
that it

     is practically unbreakable

    has a sufficiently large key space, performance (time and space
    requirements for signing and verification), reasonable size of
    key, etc.

    includes key generation.

In order to allow for world-wide, unrestricted use of a digital
signature scheme, the mechanism should not be usable for the
concealment of message content.

The minimum requirement should include

    an estimate of error probability if probabilistic methods are used

    an estimate of probability of occurrence of weak keys (perhaps
    completely improbable)

    a guarantee of sufficiently high degree of uniform
    distribution.

In so-called identification schemes (for access control), which do
require public key techniques rather than conventional schemes,
practical zero-knowledge protocols must be developed and standardised
that fit a corresponding digital signature standard.

Requirements

    Development of specifications and standards along the lines
    described above

    Development of specifications and standards for application
    oriented integration

    Development of a general application programming interface
    (API) for integration of security services which could be
    easily integrated into most application (This could as well
    include codes which explain the intention of the applied
    signature.)

    Development of transaction-oriented multiple signature schemes

    Solution to the specification, standardisation and licensing
    problem of cryptographic algorithms.

5.8.5.    Key usage

Issue

Digital signatures imply the specification of a full set of procedures
dealing with the three phases of key management - user enrolment, key
and certification distribution, and operational maintenance
(revocation, blacklist, destruction), which must be agreed and
accepted.

Discussion

In order to apply security to any message or process, four logical
layers are relevant:

1.    Legal intentions and implications

2.      The definition and identification of the relevant security
    service to be applied.

3.    The underlying mechanisms.

4.    The algorithm and protocols.

Without standardising or agreeing on the 4th layer, it will not be
possible to communicate.

In order to adopt electronic versions of negotiable and
quasi-negotiable documents, such as bills of lading, new security
services have been identified to meet business requirements, in
particular claim of ownership for exchange of values. This needs to go
through a standardisation process.

But also for more " classical" services, the current standards do not
reflect the granularity of eg non-repudiation needed by business
requirements. ISO 7489-2 only addresses non-repudiation of origin and
delivery (sometimes called receipt). However, one needs at least
origin, submission, delivery and receipt, where submission and delivery
would correspond to the services required when a registered letter is
mailed.

For hand-written signatures , a person typically knows what he is
signing, which is important for legal implications. This is not so easy
to achieve with electronic data. In particular it must be clarified to
what extent the system must indicate to the user what he is actually
signing.

Requirements

    Develop standards and profiles as described above, especially
    the development of profile - or functional - standards to
    support CCITT X.509.

5.8.6.    Universal acceptance

Issue

For digital signatures to become a full alternative to hand-written
signature universal acceptance is required.

Discussion

All functions of the hand-written signature should also apply to
digital signatures.

Where legal functions are carried out by digital signature, consensus
with the legal profession is essential.

Requirements

    Development, together with the legal profession, of
    recommendations for the practical use of digital signatures as
    a full equivalent to hand-written signatures in legal
    transactions

    Demonstration, through pilot projects, that digital signatures
    can be used as equivalent to hand-written signatures

    Inclusion in the curriculum of relevant educational institutes
    (eg engineering, law and business schools) the use of digital
    signature.

5.8.7.    Security of electronically stored  information

Issue

As legally and commercially significant information is transferred and
stored electronically, the implications of this on long-term (10's of
years) secure storage and retrieval must be properly understood.

Discussion

Industry is moving increasingly towards electronic trading in all its
aspects. Governments are encouraging the use of electronic
communication of commercially and legally significant information. As a
result, there is a need both to establish irrefutably the origin of,
and the delivery of, such information and, particularly, that the
information has been signed and stored in an unforgeable way. This
unforgeable electronic signature must be trusted for at least 10's of
years for some information, and the associated information must be
retained in a secure manner that is capable of human interpretation at
any time during that period. Any system proposed for electronic
signature storage must be as secure and robust as that currently used
for hand-written signatures.

Any such system must allow for not just technical evolution, but also
social change and other factors (e.g. the continued existence of
trusted public key directory centres, or the way businesses merge,
change or collapse).It is not currently clear that the way this can be
achieved is yet accepted legally, or the full implications are even
properly understood.

Requirements

    Build on the digital signature experience to consider the
    long-term implications of the unforgeable secure storage and
    retrieval of legally and commercially significant information,
    with access by any authorised person or organisation
    internationally.

5.9.    Privacy enhancement issues

5.9.1.    Perception of requirements for privacy enhancement

Issue

Confidentiality is, at times, essential for the good functioning of
administrations, business and human relations.

Discussion

Business user of telecommunications and information systems cannot
obtain full business benefit without confidentiality services being
available. There is a clear need for confidentiality services in the
exchange of information in the business as well as in the private use.
Today the exchange of sensitive information requiring confidentiality
is often done in non-electronic form because for electronic
transmission "confidentiality" is either not available or its use not
permitted. With the increasing demand for fast exchange of all kind of
data, demand for "confidentiality" will become pressing.

Most business and private users of communication systems are aware of
the conflict between their confidentiality requirements and national
security issues which require the possibility to intercept the
communication in a way regulated by national laws. They accept the
national authorities ability for this interception provided there are
adequate safeguards to prevent unauthorised interception even by
government employees.

Expectations of confidentiality of electronic message services can
currently not be met in the absence of international standards or
internationally accepted methods. Uptake of these services by
commercial users to support business processes will therefore have a
natural limit, ie to those messages that someone usually writes on a
postcard. Examples of commercially sensitive information includes
pricing and bidding strategies, mergers and take-overs, or from a
privacy point of view (transmission of personnel and medical data).

User needs for confidentiality

In analogy with confidentiality offered by existing physical mail and
archiving services, ie envelopes, registration, courier services, etc.,
there is a need for confidentiality in the situation of electronic
interchange and storage of data. Even more so because electronic data
can much more easily be copied or disclosed in its usual form, eg only
channel coding and formatting as the "envelope", than its physical
counterpart.

At present certain unclassified but sensitive information on physical
media such as paper, microfilm, or photograph, of business enterprises
or medical centres are protected against unauthorised disclosure by
physical and procedural methods.

Today the trend is towards more electronic communication and storage of
data and hence there is a need for appropriate confidentiality services
in an agreed or standardised form to be readily available for all users
of electronic information systems.

Service provision

The extent to which confidentiality services are provided for a
specific business or citizen could depend on a system of licenses or
certificates.

A particular business might qualify for a confidentiality license
depending on its internal procedures and activities. A general
(minimum) level of confidentiality could be provided to all users.

It should be possible for certain user groups or businesses to use
other confidential services (egproprietary) than the standard ones
provided.

There are strong indications of emerging "bottom up" solutions for
these needs (eg the Pretty Good Privacy offering on Internet, beginning
1993).

Other initiatives (eg the announcement of the "Clipper Chip", 16April
1993) illustrate the growing awareness of governments of the needs of
their citizens for confidentiality services.

Awareness

In general users of electronic data processing systems are not aware of
the threats involved in using those systems. Only after they have
noticed (the consequences of) an unwanted or unauthorised disclosure of
their information will they start to think of the inherent
vulnerability of the system they are using. In view of this one should
try to create more security awareness. Users, service providers,
operators and authorities should achieve a certain minimum level of
awareness of the issues involved in using confidentiality services
before embarking on their use.

Granularity (meeting differentiated needs)

Confidentiality services at different granularity and for different
types of telecommunication services are needed. Based on his risk
analysis the user can then decide which level of confidentiality he
needs and then use the services which provides this required level.

Some users may want a range of services of different assurance levels
(analogy of courier services, registered mail, ordinary mail). Some
users may want visibility of assurances to different extents.

Impact of loss of information and Impact of theft of information

By its nature, actual risks and impacts of disclosure are hard to
quantify. But the absence of a baseline of protection of
confidentiality will undoubtedly have a negative impact on commercial
(and other) usage of international electronic communications in a wide
range of business processes.

Actors and roles

Individuals may have a number of roles in more than one organisation -
these need defining or clarifying. Their "role" as a private citizen is
an important case. The organisations that act as custodians of roles
need to be classified also. These are essential ingredients for domain
management.

Mutual confidence and TTPs

Users and mechanisms to ensure that they get assurance of compliance to
agreed "rules of procedure" from their trading partners, or other
private citizens, with whom they are interacting using confidentiality
services. TTPs are one mechanism for achieving this, but other lower
assurance, lower cost solutions may also need to be considered.

Requirements

    Proposal for a frameworks and architectures which are accepted
    as well by the business users as by the national security
    agencies and the service providers

    Standards for services and service provision. Ensure that the
    confidentiality services are compatible with existing
    communication standards and practices where possible

    Verification of practicability of proposed solutions through
    suitable pilot projects

    Model contracts for confidentiality services

    Awareness of sector actors of the potential losses due to the
    absence of confidentiality services.

5.9.2.    The case for the provision of public confidentiality services

Issue

The provision of public confidentiality services have to reconcile the
needs of the business sector and general public with the obligation of
public authorities to provide adequate protection while at the same
time maintaining its capability to fight organised crime, maintain
public order and national security.

A well developed public confidentiality service would provide for the
obligations in a transparent manner.

Discussion

Business operates increasingly in an international and open
environment. The communications take place via private and public
networks. Modern network management techniques use alternative routing
depending on traffic conditions. This implies that the physical
communication is under the control of a variety of intermediaries
working under different regulatory and legal conditions for data
protection and privacy, and therefore one must consider the network as
inherently risky. This means that end-to-end protection is required.
This applies also to the general public using international public
telephone networks.

It is a fact that business and the general public have been addressing
their needs with public domain solutions (published algorithms and
freely available software). However, the approach is awkward and its
utility therefore limited, since, for example, there is no public
directory and he has to manage the keys himself. A public solutions
open to all users requiring electronic signature and confidentiality
would remove the need for the use of ad hoc solutions. It would also
provide for a transparent solution to the need for legally authorised
intercepts.

If a public confidentiality scheme is offered, organised crime could
also subscribe to such a scheme, but as it would include provisions for
legal intercept, it would hardly be attractive. One would expect that
such users would continue to find their own solutions as will the
classified domain.

An open and public service offering a credible level of confidentiality
would therefore provide for the honest user, while not worsening the
situation with respect to public order or national security.

The combination of international communication and national security
regulations require a common framework for confidentiality services,
which on the one hand interoperate within all Community Member States
as well as with countries outside the Community which themselves may
establish their confidentiality services. This requires either an
overlay approach or gateways which link the different national or
regional services. These gateways are only required where multinational
agreements for co-operation on national security concerns is not yet
established. In this case these gateways may provide at least an
interim solution.

In order to fulfil its function and eliminate the need for "home-made"
solutions, the public confidentiality service must be open to
world-wide use and provide its service in a non-discriminatory way.

Confidentiality services should ensure that

    Users are protected and obtain assurance against non authorised
    interception and disclosure.

    The confidentiality service is of high (technical, procedural)
    quality and evaluated as such by all Member States.

    Authorised disclosure of the protected user information (undo
    the confidentiality service) is under certain well-defined
    circumstances possible, eg by secret-sharing.

With this approach, confidentiality mechanisms details (description) do
not need to be published or disclosed to the public in general.

While the use must be largely unrestricted, the systems and sub-systems
or equipment for the independent implementation of aforementioned
confidentiality services can be made subject of export controls, eg
export is possible if:

    The users comply with the rules of the exporting nation
    (end-user declaration) with respect to the disclosure
    mechanism.

    Multinational business users form EC countries with "central"
    organisations.

    Other countries on a bilateral agreement liaise with EC if they
    comply with the rules.

Export restrictions are, inter alia, based on the concern that
cryptography may be used by hostile governments or other organisations
for the concealment of subversive information. The same concern does
not apply to the use of cryptography for integrity and authenticity
enhancing service.

There are technical solutions to provide only integrity, integrity plus
signature, and integrity, signature and confidentiality.
Confidentiality enhancement is de facto only meaningful in
communications with also the two other functions being provided.

The problem remains that organised crime and hostile governments are
not restrained from adopting public domain solutions or from developing
"home-made" mechanisms. Furthermore they are able to exploit legitimate
users of systems and solutions to their own ends by use of
"traditional" criminal mechanisms of bribery, blackmail or threats to
personal safety. Legislation could discourage non-authorised use, but
cannot be expected to prevent it, particularly in the case of organised
crime. Restrictive legislation impacts the "law-abiding user" much
stronger than others.

Choice versus interoperability

The users and service providers may feel the need to choose solutions
to achieve the assurance levels they require. But interoperability will
dictate a limited set of possible choices being available, and costs of
service provision will also focus debate onto efficient solutions.

Advice and instruction / prohibition

This may vary from country to country, however certain minimum-rules
will need to be adhered to between parties offering interworking public
schemes which includes beyond simply usage also systems and sub-systems
or equipment for the independent implementation of such confidentiality
services

Requirements

    Choice of architecture that minimises service vulnerability
    (The confidentiality that users enjoy will depend upon the
    robustness of the service that is offered. This in turn will
    depend upon the robustness of the architectures available to
    perceived threats: key theft, masquerade, deliberate denial of
    service, inadequate disaster recovery are examples of threats
    the vulnerability to which may be different for alternate
    architectures.)

    framework for the provision of trans-domain confidentiality
    services (Mechanisms are needed that provide for a defined way
    to pass from one domain to another. This will require
    collective or multilateral agreements for interoperation.)

    Guidelines for pan-European confidentiality service providers

    Model contract for relationship between service providers
    across national boundaries

    Assurance criteria for service providers and operators

    Accreditation process for mutual recognition.


5.9.3.    Interworking of autonomous confidentially services

Issue

Till such time that a universal service is being offered, interworking
between autonomous confidentiality services is likely to be the normal
situation because of the differentiated requirements. This implies the
need for generally accepted rules for the relationship between these
services.

Discussion

For quite a time the conflict between national security issues and the
business need for international communications has blocked significant
progress in the area of confidentiality services in telecommunications.
With the recent US initiatives, pressure from European companies will
grow to have access to equivalent services. But within Europe we have
the situation that neither the legal situation in the different EC
countries nor their national security policies are harmonised enough to
have a single confidentiality service scheme with a single algorithm
established within the foreseeable future. Therefore it is necessary to
have a framework, which enables user-transparent interoperability
between different national or regional schemes and which do not block
the way for a single scheme which may be established in the far future.
Interoperability is also required with non-European schemes like the
US. scheme. To provide this interoperability the way information is
passed from one national security domain to another has to be specified
and the national schemes have to be compatible with this specified way.
The establishment of such a framework for interoperability is therefore
a subject which needs international harmonisation. Aspects related to
this are requirements for the cryptographic algorithms and for key
management issues.

Requirements

    Definition of minimum requirements to ensure interoperability,
    including standards, specifications, rules of procedure and
    operating practices

    Demonstration of trans-European confidentiality services using
    a suitable application , eg the realisation of administrative
    telematics applications.

5.10.    Motivation to acquire evaluated solutions

Issue

The advantage of the use of evaluated/certified solutions is not
generally accepted for commercial applications.

Discussion

Formal security evaluations have been carried out at a national level
by a comprehensive, costly and time consuming process. The investment
in the evaluation process by the vendor has resulted in higher prices
for the resulting secure IT product. The duration of the evaluation
process, has resulted in many secure products falling behind the
technical state of the art.

Up to now, this has detracted from their broader relevance in the
commercial market. Users have often preferred lower cost, more
functionality rich products unless forced to purchase evaluated and
certified products through some public procurement policy.

Vendors, historically, had products evaluated separately by each
national market and their supporting criteria. The resulting limited
revenue opportunity did not justify the high cost of getting products
evaluated.

It is necessary to change this view by convincing users of the
advantages of purchasing evaluated/certified solutions. Rapid adoption
of Common evaluation and certification criteria is essential to reduce
cost and speed-up mutual recognition of the resulting certificates.

Requirements

    Rapid adoption of common criteria

    Rapid agreement on common evaluation method

    Portability of test results and mutual recognition

    Work sharing between vendors, test centres and users to speed
    up the evaluation process

    Establishment of the "value-added" for the use by
    administrations and business, eg in terms of liability
    protection

    Consistent use in public procurement.

5.11.    Consistency of procurement practices

Issue

National procurement guidelines for the purchase of
evaluated/non-evaluated products are not consistent throughout the EC,
nor is there a general agreement on when there is an obligation to use
evaluated products, and when it is recommended but discretional.

Discussion

Some security evaluated IT and communications products are purchased as
a result of a risk analysis where it is determined that the evaluated
communications product better suits the organisation's security needs
than a non-evaluated product.

However, a survey conducted of over 200 organisations indicated that,
to a large extent, evaluated products are purchased today by
organisations in the EC because of the expectation they will be
required by law to use certified products. This type of legislated
market is occurring especially in those Member States that were
involved in the development of ITSEC.

Unless common procurement policies are established in the EC, the IT
market will become a patchwork of evaluated and unevaluated products.
This may create new barriers to the efficient flow of information.

Requirements

    Identification of categories of application for evaluated
    solutions

    Alignment of national procurement policies concerning evaluated
    products

    Investigation of to assist those member states not involved in
    the early stages of ITSEC to develop and test procurement
    policies that are based on evaluated communications products.

5.12.    Information Valuation

Issue:

For insurance purposes and for tort law cases a common means of
valuation of information and information processing resources is
needed.

Discussion:

In the case of information processing resources, the valuation may be
as straightforward as estimating the replacement value of computers or
the value of computer time in the case of denial of service (eg:
through virus attacks or other penetration). However, in the case of
destruction or theft of information, the problem is less
straightforward.

Obviously, it is not possible to set a standard for the value of
information, so what appears to be a potential solution is to establish
standards for valuation.

Requirements

    Definition of the classes of information used and the types of
    damage that could be caused to the information owners

    Definition of the rights and duties of information ownership

    Development of guidance for owners of information as to the
    actions that they would have been expected to take to protect
    their assets and avoid negligence charges

    Development of the methods and procedures that should be used
    to establish information value.

6.    Supply related issues

6.1.    Supply related Issues - Trusted Third Parties

6.1.1.    Role of Trusted Third Parties

Issue

The public and generalised use of digital signature and of
confidentiality services and the conformance with the needs of law
enforcement implies the availability of Trusted Third Party (TTP)
services to provide essential functions.

Discussion

TTPs will have to inter-communicate internationally and thus form a
network of Trusted Third Parties , based on an international framework
for their operation.

Trusted Third Party services can be considered as value-added
communication services available to users wishing to enhance the trust
of the services he uses. Therefore TTPs have to be able to offer value
added with regard to availability, integrity, confidentiality and
assurance. Although TTPs may be set up on a national basis within
national law, they must be trusted internationally.

There are different types of functions which may all or in part be
fulfilled by TTPs. The exact nature and extend to which these functions
are provided by TTPs will be dictated by practical considerations and
may vary considerably.

In general the TTPs operate on the basis of information provided by the
user. Certification of information is carried out on the basis of
evidence of correctness provided by the user or generated by the TTP
itself, eg the keys.

The major services a TTP may offer include some or all of the following:

    Name assignment, ie the function of assigning individuals' and
    enterprises' unique names and addresses. Individuals may
    possess several different distinguished names, according to
    their role, eg as private citizen and as employee of a
    corporation.

    Certification, ie the function to validate that a name and
    address has certain credentials, eg a public key for
    signature.

    Key Management for signature, ie the generation, distribution,
    establishment, and administration of public and private keys.

    Key Management for confidentiality, ie the function to
    generate, distribute and administer keys used for confidential
    communications.

    Management Services for Names and Credentials, ie the function
    to establish, administer and make available registers with the
    names of individuals and their certified credentials.

    Legal services, ie functions usually performed by the legal
    profession, mostly concerned with non-repudiation.

    Guaranteed Date and Time Stamping, ie the function to provide
    exact date and time on request, to support non-repudiation.

    Management of Negotiable Document Transactions, ie unforgeable
    non-personalised tokens (eg electronic Bills of Lading,
    electronic shares).

    Storage of Electronic Information for clients with appropriate
    guarantees of confidentiality and integrity.

Common to Trusted Third Party service providers is that they have to be
accredited and audited, and that they have to operate under the law of
the country using common guidelines. The figure below provides an
analysis of the different functions involved in the establishment and
operation of TTPs.

The diagram identifies four functions in this process. The functions are:

    the provision of the required good practices, rules and
    regulations for the accreditation and operation of TTPs

    the accreditation, re-accreditation and audit of TTPs

    the TTP functions themselves

    the use of communications and of the TTP.

This diagram does not imply any particular allocation of responsibility
for the functions indicated.

The information flow contains the following major elements:

    National Laws. The operation of TTPs will take place within the
    laws of the country in which they are located. It is
    conceivable that some legislation has to be updated to allow
    TTPs to operate in an international environment.

    Good practices, rules and regulations for the accreditation,
    operation and audit of TTPs.

    Standards for communications.

    Good practices, regulations and laws for the use of
    communication services.

6.1.2.    Operating principles of TTP

Issue

The need for common operating principles for TTPs.

Discussion

To be effective, TTPs must:

    operate securely

    operate within a consistent legal framework across the Community

    offer a range of services, with a defined minimum

    conform to European or international standards, where available

    follow accepted good practice

    allow for independent arbitration, without compromising security

    be monitored by a supervisory board

    be independent in its operation within accreditation rules

    have a public policy on service refusals, if applicable

    assume responsibility of liability within defined limits for
    availability and quality of service.

The key questions include:

    Has the TTP a contractual obligation of results in terms of
    availability, integrity and confidentiality?

    How and by whom are the loss and penalty determined in cases of
    fraud, negligence or failure of the TTP?

    What assurance to the final user is offered by the
    accreditation of the TTP?

Requirements

    Harmonised legislation to provide an appropriate framework for
    arbitration, supervision and litigation

    Model for TTPs meeting the requirements of users and
    authorities.

    Baseline for accepted good practice including a study of the
    level of availability, privacy and security required for the
    TTP by the final users and how much they are ready to pay for
    it

    Definition of quality of service, including availability,
    confidentiality, response-time, rules of disclosure to law
    enforcement agencies

    Operational guidelines, including descriptions of minimum set
    of services and standards to conform to

    Standard clauses for the contract between the TTP and the user,
    concerning the liability of the TTP.

6.1.3.    Accreditation and audit of TTPs

Issue

The need for harmonised procedures for the accreditation and audit of
TTPs.

Discussion

Although the accreditation and audit of TTPs may be a local or national
responsibility, the procedures to be followed must be harmonised and
have a common basis in order to ensure mutual trust.

It is assumed that national governments will be responsible for
approving accrediting bodies. This may require to create new national
laws or to adapt existing laws.

From the TTP point of view, timely and fair responses to requests for
accreditation will be important.

From the user point of view, the agreed terms of the accreditation need
to be properly documented and inspectable.

To maintain public trust in TTPs, an audit process must be put in place.

Other issues are related to the

    requests for accreditation from service providers in other EC
    and non-EC countries

    certification of certificates

    authority and accreditor signatures.

Existing Community rules for accreditation (eg of test centers) should
be used as a basis for this work.

Requirements

    Development of international guidelines for the accreditation
    and audit of TTPs

    Adaptation of applicable legislation or regulations to provide
    an appropriate legal framework for use throughout the Community
    and in the relations with third countries.

6.1.4.    Use of names and certification of credentials

Issue

Use of names and of credentials (eg the public key) in international
communications.

Discussion

Name Assignment and Certifications Authorities are Trusted Third
Parties. They have been defined and, to some degree, specified by CCITT
X.509 "Directory - Authentication Framework". Their purpose is to allow
for individual and authentic addressing of communication system users
by means of their authenticated Distinguished Names. A user may ask a
Naming Assignment Authority for a Distinguished Name. The Naming
Authority will give him a Relative Distinguished Name and supplement it
by its own Distinguished Name to the user's Distinguished Name. Thus,
although a person may ask several Naming Authorities for the same
Relative Distinguished Name, each of his Distinguished Names will be
unique, because the Distinguished Names of the Naming Authorities, by
definition, will be unique. The concept of an agent that handles the
interfaces between the end-user and the naming authorities is important
in providing a user friendly interface to this process.

The two functions of name assignment (or identification) and
certification are "binding" operations. Name assignment binds a
particular name to an entity (a person or device), and certification
binds certain credentials to a name. The diagram below shows the double
binding process.

A Distinguished Name and a unique cryptographic Public Key are made
part of the user's Credentials. The Public Key can be used to verify a
(ciphertext) signature which has been effected by the user's
complementary Secret Key (not contained in the Credentials).
Credentials are signed/certified by the Certification Authority. Thus
the user's Certificate consists of the Credentials, their signature by
the Certification Authority and, if necessary, the Certification
Authority's own Certificate. The user is given his certificate,
preferably in a tamper resistant chipcard.

After signing a message with his Secret Key the user concatenates his
Certificate to the message and its signature. The receiver of the
signed message can use the Certification Authority's widely available
Public Key to verify the signer's Certificate and Public Key. With the
latter the authenticity and integrity of the message can be verified.

The security services related to name assignment and certification need
further standardisation as well as legal recognition, both preferably
on an international level.

The United States have already begun to apply relevant US national
standards. Therefore, corresponding standardisation action should be
started on a European level. Its results should be made the basis for a
European contribution to international standardisation. At the same
time an interface toward a legal usage of naming and certification
services should be defined to ease the adaptation to and to provide for
the compatibility of the various EC legal systems.

Other related issues are pseudonyms and anonymity, for which a business
requirement has been identified. Different degrees of anonymity should
be provided for according to the specific needs in digital cash,
tele-shopping, registration in data bases for statistical purpose etc.

As described above, the ability to sign a piece of data is to be
distinguished from the authority an entity possesses.  This
relationship is depicted below:

Requirements
    Development of guidelines covering the use of names, by specifying:

    o naming principles (hierarchy of naming authorities)
    o format of Distinguished Name/Relative Distinguished Name
    o requirements to meet by naming authorities
    o requirements to meet by the user
    o requirements for the protection of the name against changes
    o handling protocol between naming authorities, user and
      certification authority
    o change of names
    o recording of information pertinent to de-referencing of names
      (by the Directory).

    Development of guidelines covering the  use of certificates, by
    specifying:
    o certificate semantics and format
    o certificate handling (production, issuance)
    o signature and its certification (method, process)
    o authentication of certificate owner (method, process)
    o expiry dates
    o renewal of certificates (periodical)
    o renewal of TTP public key (periodical)
    o handling compromises of secret information (secret keys, PIN etc.)
    o revocation of certificates and notification
    o black listing and execution of certificates
    o security requirements to meet by certification authorities.

6.1.5.    Key management service

Issue

Key management services for signed and privacy enhanced communications
between organisations and individuals.

Discussion

General

    Definition of responsibilities and obligations for services
    that provide trust in the integrity of communications and those
    that provide confidentiality.

    Development of codes of practice for the generation,
    distribution and storage and destruction of keys for both
    purposes (integrity and confidentiality) in environments that
    have varying levels of assurance.

    Definition of escrow services. Some of the secrets may be of
    paramount importance and may have to be distributed among
    trusted parties (distributed-secret-escrow agents) so that none
    of the parties know the complete secret and not less than a
    defined minimum of those trusted parties must contribute their
    part of the secret in order to produce the complete secret.

    Mechanisms and criteria for assessing applicants suitability
    for the use of TTP services. Not all potential users of TTPs
    may have the necessary attributes (eglegal status, financial
    viability, etc.). This essentially applies to TTP services for
    closed user groups.

Integrity and digital signatures

    Relationship between the key management functions, directory
    management and certification needs to be clarified.

    Timeliness of issuing signatures when an application is made -
    verification of "signature worthiness" of applicant - periodic
    review of "worthiness" of existing constituency of signature
    holders.

    Removal of signatures from "active list" and initiation of
    "attempted illegal use" audit. This is a "certificate
    management" - "key management" interface management issue.

Privacy Enhancement

    Management of the domain within which the confidentiality keys
    are valid. The identity of authorised subjects within the
    domain: Key distribution to those authorised subjects (people
    and automated processes.).

    Should the TTP define the domain as well as manage it: if not
    should another TTP hold the definition (ietable of authorised
    subjects).

    Assessment of the assurance level of the domain within which
    the confidentiality keys are to be used, ranging from vetted,
    cleared people with physical and logical access controls to
    un-cleared people in open environments.

Domains are an important concept in confidentiality provision. The
following questions require an answer:

1.      What is the scope of validity of a domain for certification and
the scope of validity for a confidentiality mechanism? Who manages the
domains? Who manages inter-domain issues? Does each domain need a
different TTP?

2.      Who determines the scope of a domain? Who is authorised to
change it? (for both certification and confidentiality.) Is a domain a
"contract", and under which circumstances?

3.      What are the assurance criteria for domain management? Who
audits a domain manager? Who maintains the principles of domain
management as technology changes?

4.      Should domains for certification and confidentiality be
different in view of the fact that a confidentiality domain will be
transitory and that therefore key management principles are different?

5. When should the use of escrow services be mandated to ensure domain
integrity.

Requirements

    Single digital signature mechanism and specifications
    preferably consistent with other leading countries

    Adoption of a confidentiality algorithm standard and
    specification, and a key distribution mechanism based on an
    asymmetric public key algorithm

    Establishment of "domain assurance" levels and criteria for
    TTPs to use for confidentiality key management purposes

    Codes of practice for TTPs engaged in key management
    activities, and the provision of escrow services and the
    methods by which those codes of practice would be audited

    Set of criteria for mutual recognition between TTPs acting on
    behalf of organisations who wish to communicate securely.
    Merging of signature directories and secure inter-domain
    communications are fundamental issues.

6.1.6.    Management Services for Names and Credentials

Issues

Whenever parties engage in bi- or multi-lateral electronic
transactions, they need beforehand some non-transient information on
their partners (such as identity, legal representatives or any other
kind of credentials eg public keys). This does not imply permanent
recording of such information.

Discussion

Management Services for Names and Credentials are established to
facilitate access to this type of information, whereby service
subscribers are provided with up-to-date data pertaining to the parties
listed in there. Because partners may conclude the transactions on the
basis of the information (at the minimum, the authenticated identity of
their partners) they are provided with, and because some of the
information stored by such a service may be protected by privacy
legislation, the service itself must be trustworthy and the data it
provides correct.

Management Services for Names and Credentials keep objects which are
referred to by "Distinguished Names". A Distinguished Name is unique to
a communication subject. A subject may have a number of (unique in the
above sense) "Alias Names". It is required that the service can
reference Alias Names to their subject's natural names. An Alias Name
may be a pseudonym. Whether or not the service is allowed to reference
a pseudonym and let inquirer know the result will depend on the
subject's data privacy rights.

If, as is likely going to be the case, there is more than one provider
and certifier of information, the Management Services for Names and
Credentials must be part of a network of information suppliers. Network
can be organised according to either geographical distribution or
business sector or information taxonomy or all three of them. Users may
have to subscribe to more than one such service or service type (eg
"Public Key directory for the banking sector"). Users may have a number
of different roles in an enterprise, each of which needs access to a
set of different services. In the case of a multiple service and
network of providers, one can speak of a system of Management Services
for Names and Credentials.

Because of the damages that could be caused by the distribution of
false information, the Management Services for Names and Credentials
must apply due care in its operations. In the case of proven negligence
the service could be held liable if inaccurate information were
provided. The creation, update and destruction (eg in the case of
certificate revocation) of information is either mandatory or
forbidden. In critical cases (eg; certificate revocation), the update
may have to be notified to subscribers without request.

The management of the Management Services for Names and Credentials
must thus be accountable. There must be legislation, rules and
regulations governing it.

Obviously, the service must cover and be available on an international
level.

Obviously there is the issue of standardisation of the service at the
user end (external interface) and between service providers (internal
interface).

Since international Management Services for Names and Credentials are
akin to internationally distributed data bases, they face the same
legal questions: who is legally responsible for the information
(between the creator, the storer, the distributor)?

Market pressures are bound to promote the advent of sectorial
Management Services for Names and Credentials, and possibly their
subsequent interconnection or integration into larger network. In order
to avoid fragmentation among proprietary services, there may be a need
to lay down base rules for naming, binding, certificates and the
associated IPR rules.

Requirements

The basic issue is the provision of efficient Management Services for
Names and Credentials, supplying various types of information is a
requirement that needs rapid and efficient satisfaction.

    Provision of Management Services for Names and Credentials, to
    include:

    o Identity (cf. issues on name authentication and referencing
      of Alias Names)
    o Name information (to enable the correct forwarding of
      messages (eg static digital network or GSM communications)
    o Credentials such as public keys or any signature-verification
      data.

    Interoperability specifications and standards.

    Harmonisation of legislation , rules and regulations concerning
    Management Services for Names and Credentials, intra-Community
    and extra-Community.

6.1.7.    Legal services

Issues

Legal TTP services are offered essentially to prevent disputes, or
resolve them in a structured, efficient, accepted by all parties
involved and non-controversial way.

Discussion

Prevention of disputes arises essentially from the very ability of
legal services to assign responsibility and fault, should one occur.

    Thus, legal services must essentially be able to verify the
    application or non-application of rules and the evidence
    pertaining to them.

    Legal services may or may not generate the evidence itself. In
    other words the question is whether a third party offering a
    trusted service also arbitrates litigations pertaining to its
    principal service. For example, does a signature generation
    service also provides signature-verification services?

Two issues arise in this topic:

    What is the legal status of evidence generated by TTPs ? Does
    it imply liability? What is the legal status of decisions made
    par legal services when they are not judicial but private(and
    corollary, what are the rules of appeal)?

    If evidence is not generated by the arbiter, how is the
    evidence acquired and authenticated and how is responsibility
    assigned? One is faced with the general problems of TTPs :
    operating rules and legislation, standardisation,
    inter-operability and accreditation.

Requirements

In addition to the ones concerning operation legislation,
standardisation, inter-operability and accreditation, Community actions
specifically aimed at legal TTP services could focus on

    the harmonisation of legislation on the legal status of
    evidence generated by any TTPs and especially on the intra- and
    extra- community recognition thereof. This probably implies the
    settlement of the accreditation question

    the promotion of community-level information technology
    litigation services modelled after existing international
    bodies such as the International Chamber of Commerce

    Essentially focus on - and restrict actions to the problems
    created by the fastest-growing services based on Public Key
    cryptography, eg verification of signatures, certificates,
    etc.

6.1.8.    Guaranteed date and time stamping

Issue

Guarantee of unambiguous date and time of submission and receipt.

Discussion

In electronic communications, a digital equivalent is required for the
date and time stamp in the paper world. Such a time stamp must be
issued by an organisation that is trusted. If time stamps are simply
attached internally by the sender or receiver of a message, then, in
case of litigation, it will be difficult to establish if these were
erroneous or have been forged.

In direct communications, both parties may agree on a mutual time
reference, but in store-and-forward type communications time stamping
by a third party is particularly important.

Depending on sectoral differences, different granularities of time
stamps may be needed. Some sectors may be content with the date, some
with the nearest second.

The third party must be trusted by both parties, or at least the
dispute resolution mechanism, for the correctness of the date and time
supplied, but also for the confidentiality with which they handle the
contents of the correspondence.

The time stamping schemes proposed so far are impractical, because they
require the recording of the time stamp and the document (or at least
its digest).

Requirements

    Development of an approach to date and time stamping for
    time-critical transactions and applications, including a range
    of granularities of timing.

    International harmonisation of rules and services for time
    stamping, with the objective of achieving general recognition
    and acceptance of time stamps and their provision by suitably
    accredited service providers.

    International harmonisation of rules and services for time
    stamping, with the objective to achieve general recognition and
    acceptance of time stamps issued from different service
    providers.

6.1.9.    Negotiable document transaction

Issue

Some conventional physical documents, such as eg the bill of lading and
the bill of exchange, must be negotiable. The possession of the
document must allow to give title to anybody who can present it. The
electronic equivalent is also needed.

Discussion

Negotiable documents entail that their physical uniqueness must be
protected against duplication; it must be easy to distinguish a copy
from its original. This is the case with hand signed paper documents;
the hand-written signature cannot be copied such that the copy could
not be distinguished from the original. True, a digital signature does
protect the integrity of the signed electronic document; however, it
can be easily copied so that the physical original cannot be discerned
from its copies.

This impedes the usage of electronic communication eg in maritime
trade. The sender of a cargo produces a unique document, the bill of
lading, hands a copy to the shipper and sends the protected original to
the receiver. The receiver may trade the original and its title or keep
it. Whoever presents the original to the shipper will be handed over
the cargo.

The shortcoming of the paper bill of lading is the fact that it takes
time to transport it, particularly as it is a piece of value and must
be well protected. Therefore, an electronic substitute should be found
that protects its originality and can be transacted in
telecommunication systems.

The Document originality can be provided by the use of chipcards. A
chipcard can store a secret and protect it. The secret is essential to
authenticate the signature of the document. As the chipcard cannot be
explored, the secret cannot be transacted into another chipcard. Thus
it is practically impossible to duplicate the original chipcard. Such a
chipcard can be made a substitute of the negotiable paper document.

In order to produce and to transact chipcard documents via
telecommunication trusted equipment is needed. It Should be operated by
trusted third parties, eg by public notaries. They may be bestowed with
the responsibility to produce chipcard documents and to transact and
receive them by means of their trusted equipment. Transaction may be
performed by depleting the original chipcard at the sending end,
securely transmitting its information and feeding it into another
chipcard at the receiving end. This process must be protected for its
integrity and confidentiality. Not even the "public notary" must be in
a position to alter the information.

Beside issuing negotiable documents there are other ways of securing
correct title to property. Instead of a person proving his claim by the
presence of a token, the claim may be addressed to a distinct person
who then is expected to prove his identity.

This - continuing with the above example - is the case with the freight
bill, which is another way to deliver a cargo to the authentic
receiver. However, the freight bill cannot be traded as effectively as
the bill of lading, although, by omission of additional chipcards and
other trusted equipment, it makes it easier to design the electronic
substitute process.

One should expect that, unless proper electronic documents will be
available, the use of paper for negotiable documents will be continued
at the expense of effectivity and more paper.

Requirements

    Development of techniques for the establishment, handling and
    recording of Electronic Negotiable Documents.

6.2.    Supply related issues - Evaluation of trusted solutions

6.2.1.    Perceived Requirements for trusted solutions

Issue

Need of users for trusted components, products, systems, services and
applications

Discussion

The trustworthiness of a given information system and its use imply an
evaluation process. Depending on the needs of the customer, either
vendor declarations or formal certification procedures may be needed.
The choice of either of these mechanisms will depend, inter alia, on
costs and delays involved in formal certification processes. A major
factor is also the recognition of certificates in other markets and
their utility, eg in protecting the user or vendor against liability
claims, where it is possible to do so. In the safety related area, the
trustworthiness of the development process and its execution are also
critical factors and need not only evaluation but also auditing. The
qualifications and experience of project managers and safety auditors
are also factors which affect the resultant level of trust in the
system.

Requirements

    International agreement on criteria and evaluation methods, and
    mutual recognition of test results

    Clarification of the commercial value of "certified products",
    eg in terms of liability limitation

    Clarification of the status and implied liability of vendor
    declarations

    Development of principles for liability definitions for
    multi-level, distributed services

    International agreement on the methods for evaluating safety
    critical system development processes, and the qualifications
    and experience needed for individuals to become managers and
    auditors of such activities.

6.2.2.    International harmonisation and mutual recognition

Issue

At the moment different evaluation criteria and evaluation schemes are
in use. These are especially the US, TCSEC, the European ITSEC and the
Canadian CTCPEC. Other countries like Japan have first drafts of
criteria. This situation is not acceptable to international
manufacturers who would have to perform different evaluations against
different criteria and schemes for a single product. This will
unnecessarily increase the cost of the product without enhancing the
security features.

Discussion

Different activities have already been taken or are currently on the
way to harmonise evaluation criteria and evaluation schemes. The ITSEC
and ITSEM are a result of such a harmonisation process within Europe,
and the United Kingdom, France, Germany and the Netherlands are
discussing the mutual recognition of each other's certificates based on
ITSEC and ITSEM, with the intention of achieving agreement in 1994.

In North America, the US and Canada co-operated in the production of
the first draft of the Federal Criteria. Following publication of the
Federal Criteria in early 1993, it has been decided to make all effort
to align the ITSEC and the Federal Criteria to produce a joint
European/North American set of Criteria compatible with existing
practices in both North America and Europe in 1994. This is the first
step towards international harmonisation between the two groups.

Based on these activities, ISO/IEC JTC1/SC27, Working Group 3 is
working on an ISO standard for evaluation criteria.

But harmonisation of the criteria is only the first step to reach
mutual recognition of evaluation results. It will need to be
accompanied by agreement on methodology, schemes and certification
bodies. Only then will mutual recognition between North America and
Europe be possible.

Even within the European Community mutual recognition has turned out to
be an arduous task and mutual recognition of certificates is not yet
achieved, mainly for legal reasons. This indicates that world-wide
mutual recognition of certificates requires many, yet unknown, problems
to be solved.

Some activities for international harmonisation of evaluation criteria
and evaluation processes are currently in progress but only one result
of such a process which seems to be stable and widely accepted has
until now been achieved. This is the ITSEC. But even in Europe the
subject of harmonising the evaluation process turns out to take much
more time than the harmonisation of the criteria. The reason for this
is that the ITSEC could be adopted by different countries quite easily
without significant changes to their existing evaluation processes (and
almost no changes to the certification schemes). The real changes to
the established practices come up when you try to harmonise these two
topics, since this results in significant changes to evaluation and
certification practices and may even have legal consequences.

Looking into the international arena, the only evaluation process and
certification scheme in the area of communications-security which is in
place for a significant time is (beside the European one) the US TCSEC
evaluation scheme. But the focus of this scheme is mainly to evaluate
and certify commercial operating system products suitable for
government applications. Currently the US are trying to widen this
scope with the Federal Criteria and the accompanying trust technology
programme of NIST whose main goal is to establish a more commercially
oriented evaluation and certification scheme with industrial evaluation
facilities like the ITSEF's in Europe. Both the Federal Criteria as
well as the trust technology program look like a much better basis for
international harmonisation but nevertheless a considerable amount of
work is necessary to achieve this goal. But since both the new criteria
as well as the commercial evaluation process are not yet established in
the US there is an opportunity to influence this process. The fact that
the US sponsors two parallel ITSEC evaluation of their TMach operating
system show clearly that the US side watches the European activities in
this area very carefully and tries to get as much information as
possible (both positive and negative!) about the European evaluation
process.

Even for the old TCSEC evaluation scheme the US showed great interest
in comparing this scheme with the European ones. Joint tasks between
the CEC and the US side represented by NIST and NSA material about the
various evaluation processes was presented. This shows a will for
co-operation which is clearly based on the fact that US manufacturers
sell more communications-products in Europe than vice versa. Other
countries like Sweden, Australia and Japan watch this process very
carefully.

Requirements

    Establishment of conditions and procedures for mutual
    recognition of evaluations

    Establishment of conditions and procedures for
    EC-wide/international evaluations

    International and EC standardisation of evaluation criteria and
    methods.

6.2.3.    Vendor declarations

Issue

For applications that need security, but not the kind requiring formal
evaluations, vendor declarations are used. These are, however, at
present not defined in terms of what they cover and what assurance they
offer compared to formal evaluation.

Discussion

Between the requirements of governments for formally evaluated
solutions and no evaluation at all, there is a large part of
applications used by business and the general public. Vendors do
address security and provide some level of assurance, but its
significance, particularly in an open environment is not obvious.

Requirements

    Development of an agreed definition of scope and liabilities of
    vendor declarations for secure solutions.

6.2.4.    Evaluation of applications

Issue

The user interest is finally with the security of his application. The
use of secure products and services is a necessary but not a sufficient
condition to meet the user requirements for the protection of the
application.

Discussion

At present, evaluations and certification schemes address primarily
products and systems. Communication services are only partially
addressed and applications running on the products and via networks (in
particular public networks) are left to the user to address. However
with the restrictive handling of confidentiality mechanisms and
opposition against end-to-end encryption, the user is left exposed.

Requirements

    Extension of ITSEC criteria and methods to cover services and
    applications.

6.2.5.    Evaluation of communication services

Issue

With the ITSEC and ITSEM Europe has already a scheme for the
independent security evaluation of IT-products and (to some extent)
IT-systems. At the moment this scheme does not fully cover the aspect
of the evaluation of telecommunication services, but extensions to this
scheme seem possible which are able to address the items not yet
covered by the current ITSEC/ITSEM scheme.

Discussion

The main item where communications security is considered in the public
is in the area of telecommunication services. Especially when people
send sensitive information to others using telecommunication services
they are interested that this information

    gets to the intended recipient(s) in time

    is not altered by the service

    it not received by anyone else than to the intended recipient(s).

Not all these aspects are of the same importance for each kind of
communication. The level of importance is highly dependent on the kind
of information one wants to transfer.

The use of telecommunication services grows rapidly as more powerful
equipment and services become available. A lot of companies and
especially administrations have policies which forbid the use of
specific telecommunication services for highly sensitive information
since they do not trust the communication services providers that some
of the above mentioned security issues are enforced adequately. They
use conventional techniques for the exchange of sensitive information
with conventional security measures (eg sending sealed letters by
registered mail or by courier).

In a time where industrial success depends on the fast exchange of all
types of information these conventional techniques become more and more
unacceptable. So the service providers will incorporate security
provisions within their services. But nevertheless a lot of companies
(and the national governments) will continue to use the conventional
techniques since they do not trust those security services unless they
are under their own control or being verified by independent experts.

Providing a security service as part of a telecommunication service
will normally result in all entities involved in the provision of the
telecommunication service being involved in providing the security
service. Additional entities may even be necessary (like eg a trusted
third party for key management issues or authentication services).
These entities use systems and products to provide their part of
telecommunication (and security) service. The total service is
therefore provided by an interaction of all the entities.

The current ITSEC/ITSEM scheme is aimed at the technical evaluation of
security measures within products and systems. It does not cover
organisational, personnel, administrative or non-IT related physical
security measures. Still many security services for telecommunication
will heavily rely not only on IT-security measures but also on the
above mentioned other security controls. For example a trusted third
party will surely need extensive organisational, personnel and non-IT
physical control. So it is clear that an extension to the ITSEC/ITSEM
evaluation scheme is necessary to cover these aspects. The following
section tries to identify how this can be done and which areas are not
yet covered.

Looking at communication services one can easily identify several
different types of communications-products and systems which have to
co-operate to provide the service. This includes for example

    the end user equipment (telephone, modem or even his computer)

    digital dialling switches

    data concentrators

    conventional computer systems with databases for eg user
    profiles, directory information

    conventional computer systems providing mailbox services

    the communication media

    gateways etc.

For a specific telecommunication service one can identify the task each
of these products or systems has to fulfil to provide this service. The
same is true for security services. Each component involved contributes
for one aspect of the security objectives or functions. These will then
differ significantly in the functionality as well as in the assurance
level required. Various topics regarding this may lead to problems, for
instance:. assumptions on the security provisions to be taken in the
environment of the product or system. Some of the security measures
will heavily depend on hardware features. Evaluation of non-IT security
features, like effectiveness of personnel and administrative security
measures has to be established. The integration of all security
measures has to be checked for consistency, completeness and
effectiveness. For the evaluation of a communication service,
therefore, different evaluations of systems involved in providing the
service are necessary before the whole service can be evaluated.

Requirements

    Extension of ITSEC to cover more explicitly evaluation of
    hardware security features

    Establishment of a formal accreditation scheme for secure
    communication services

    Development of accreditation guidelines for the
    telecommunication sector

    Trial service evaluations for existing telecommunication
    services

    Articulation of the requirements of service evaluation.

6.2.6.    Trusted network management

Issue

Trusted Network Management systems need to maintain a given assurance
level while optimising the use of communication assets to achieve good
economics and quality of service.

Discussion

There is a growing dependence in the security of network management
systems for managing and controlling the provision of
telecommunications. This is due to an increased reliance on distributed
systems, the provision of new value added services and operations, and
on the increased sophistication and richness of network and service
functionality. Such dependency is placing greater demands on
performance and quality of service. Tomorrow's electronic highways
should be managed networks that should ideally interoperate in a
seamless way to ensure efficient "self-healing" network operations and
flexible creation and provision of a broad range of services, including
those supplied by third party suppliers. The management of
telecommunications systems security is thus growing in complexity
commensurate with the growth in communications systems and the
associated services and business use.

The major network management issues involve the protection of
electronic information in storage, in transmission and being processed.
Information used and applied to the controlling and maintenance of
networks and services. Information that is used as input to the process
of decision making and operational support, and which is also used as
input to the emerging new wave of intelligent systems and
communications. The provision of appropriate and effective network
management solutions is fundamental to the success of the future
telecommunications infrastructure for Europe.

Given the complex telecommunication systems that are evolving, the
interrelationships that are needed for multi-domain working, grade of
service requirements against a future European framework for
legislation and regulation needed to maintain multi-domain working, the
provision and maintenance of network management security the question
of security evaluation is a key issue. What is the alternative if
evaluation of network management security is not carried out ?

There are a number of constraints imposed by end users, service
providers and network operators on the provision of security for
network management eg concerning the employment of intelligence in
networks and the idea of securing shared resources, dealing with
different threat analysis and the responsibility for service
liability.

Requirements

    Methods for network management evaluation

    Extension of ITSEC to cover the evaluation of network
    management systems

    Definition of Functionality Classes (or Protection Profiles)
    suitable for systems, products and services used in network
    management systems

    Accreditation guidelines for the trusted network management

    Trial evaluations for existing network management systems.

6.2.7.    Modifications to evaluated products and re-evaluation

Issue

The shortening life cycle of products and the rapid evolution of
services and applications due to competitive pressures implies the need
for frequent adaptations and therefore re-evaluation.

Discussion

The impact of Open System, with its emphasis on portability and
interoperablity, has resulted in many new products being incremental
releases of existing products, for new operational platforms,
applications, etc.  There may be multiple releases or versions of a
hardware or software solution in a short period of time. The
maintenance issues of many similar and homogeneous configurations
making up a product line is being understood.

The evaluation and certification of the product may take longer than
the period between releases or updates to the solution. A certificate
currently applies to a specific release or version. Changes may
invalidate the certificate.

There is a need to devise a method to cope with these product or system
changes so that the certified status of a product may be maintained.

Particular concerns include:

    Scope of the evaluation - Is an evaluation necessary for every
    single platform-dependent configuration of a product already
    certified?

    Assurance - Is it necessary to have an entire new release
    evaluated again in which only a small modification occurred (eg
    a spelling mistake in the user interface)?

    Re-use of previous evaluation work and results - Must the
    evaluation of sensitive and relevant but unmodified components
    of a product be repeated?

ITSEC and ITSEM have created a good basis on which to identify the key
issues of re-evaluation and subsequent re-certification.

Practical experience of re-evaluation is limited but the problem may be
mitigated by identifying key requirements. One approach is to
categorise code in the security Target of Evaluation (ITSEC-TOE). This
"Traffic Light" approach includes:

a)      GREEN code that has no bearing on the security functionality of
the product or system and that may be modified in future releases
without impact on the security of the product or system.

b)      YELLOW code that might impact the security of the product or
system and that must be inspected by an independent party (such as an
INSEF) before re-certification can be considered.

c)      RED code that is critical to the security functionality of the
product or system for which may modifications may require re-evaluation
of the whole product or system.

This structure will assist developers, evaluators and certifiers in
containing the level of necessary re-evaluation commitment following
any modifications.

Experience is available on the parallel field of quality evaluation of
software products. A framework for re-evaluation is outlined in ISO9126
and associated processes. It is likely that the impact of software
quality on "operational" correctness of security products will force
alignment of the various processes.

Requirements

    Effective feedback from existing Community schemes, both
    national and ITSEC related, on the problem of re-evaluation

    Product-line structuring, understanding the current strategic
    development of IT products and how this is likely to change
    product cycles

    Closer harmonisation of the evaluation process of all system
    and product "qualities" (performance, reliability, security)
    and how these may re-enforce each other in any re-evaluation
    actions

    Development of criteria for re-evaluation decisions

    Development of "critical event" approach to re-evaluation

    development of self-diagnostic techniques and procedures for IS
    maintenance.

6.2.8.    Performance reporting for trusted products

Issue

Obligation to take corrective action in the case of faults found in
evaluated products.

Discussion

Despite the successful evaluation and certification of a product or
system, there is a small chance, smaller with the higher assurance
levels, that a security related fault will be detected. The Developer
is likely to have this fault reported to him and ought to take steps to
correct this fault as quickly as possible and issue a new release of
the software or hardware. The Certification Body needs to be informed
of the fault and the steps the Developer intends to take to correct the
fault. The Certification Body and the Developer need to discuss the
need for any re-evaluation work and agree a timescale for this. Where a
Developer is unwilling to correct the fault, the Certification Body
needs to decide whether to withdraw the certified status and publish
the fact that a fault exists, although not necessarily the details of
the fault.

Requirements

    Incident reporting system for Certification Bodies

    Definition of user and supplier obligations to report incidents.

6.2.9.    Rationalisation of evaluations

Issue

Speeding up and lowering cost of evaluation and thereby improve
attractiveness of security evaluations.

Discussion

Two key factors to the success of a security market enhancement are
that evaluations are approachable and that the products or systems are
developed in a way that is meant to meet the ITSEC requirements
beforehand. It must also be understood that in many industrial cases,
security, while indeed an important feature of a product or service, is
only one aspect of an even larger target which is product quality or
the quality of service.

Considerable work has been carried on in the broad field of software
quality and its engineering which might be valuable to the security
community.

Three standards address quality through an evaluation and certification
approach, namely ISO 9000, SEI CMM and ISO 9126, at the organisation
level, at the process level and at the product level, respectively.
Those standards are well established and the demand for certificates
based on them is growing rapidly.

There is an urgent need to consider the harmonisation of the ITSEC and
ITSEM contents, to take into account to a much larger and clearer
extent the benefits brought by those standards to security and to help
reduce costs and needs of several, disconnected or even conflicting
evaluations and certificates. The ITSEC approach seem to be
sufficiently well accepted today to consider its integration into a
broader context.

A closer technical look at quality standards and ITSEC/ITSEM taken
together shows that, although they are all basically based on the same
fundamental ideas and principles, there are residual conflicts when
evaluations are to be carried out, either due to different requirements
or to different evaluation approaches.

There are many ways in which the ITSEC could be turned more compatible
with the quality certification domain. The following steps seem
relevant:

    While preserving the current technical principles and
    requirements, a better distinction between specifically
    security related requirements and more quality related should
    be made so that it becomes clearer, if not explicit, what the
    various other evaluation systems and associated requirements
    can cover or contribute to.

    As all standards evolve, the ITSEC and ITSEM will have to be
    updated, at the level of the actual required deliverables for
    instance, to be directly compatible with what the other domains
    require, while still keeping its specificity.

    As the certification bodies of the quality fields become
    Trusted Third Parties for the ITSEC community, parts of the
    current ITSEC requirements might eventually be replaced by
    requirements for relevant quality certificates, and hopefully
    vice versa.

This plan suggests that the first step is one to consider directly today.

Few people involved today in security and its evaluation have a
software quality background, which has impeded until now the
harmonisation of the ITSEC with the other standards. Awareness raising
actions on this topic should be considered with a fairly high priority
level.

Requirements

    Alignment of security evaluation criteria and methods with
    those for quality and safety

    Establishment of portability of results between quality of
    service, safety and security evaluations.

6.3.    Supply related issues - technological change

Issue

Changes in the way in which technology is used throughout society will
result in demands for new  technological approaches to information
security.

Discussion

Over the next decades it is to be expected that the macro economic
climate will change dramatically.  This is mainly driven by the shift
in geographic location of the generation of the worlds GDP from North
America  and Europe to a more even spread, with the Pacific rim
countries producing a larger share. The health and nutrition problems
that will face the developing world will become more acute as a greater
fraction of their population enters adulthood.

Information underpins these processes in a number of ways. The
financial aspects of global businesses will become vital to their
survival and the timely, accurate and where appropriate private
communication of  financial information on a global and adaptable scale
will be critical. Health care information will need to be routinely
available as health carers deal with the health problems of an
increasing number of mobile people. Transportation of food to areas in
need will require logistic information to be available in remote and
underdeveloped parts of the world quickly and accurately.

The developed world will make increasing use of their less structured
employment patterns to earn money in a variety of ways and in
performing a range of tasks, less and less to do with manufacturing.
Success will only be possible by the exploitation of mobility and wide
bandwidth telecommunications services. It has the potential to provide
quality of life together with high productivity. The effectiveness of
this approach, in providing a method of revenue generation, will
depend, inter alia, upon the performance, reliability and security of
the information and transportation infrastructures.

Driving technologies within this scenario are:

    Wide bandwidth telecommunications, including
    o Multi media applications and communications
    o Global teleconferencing

    Mobile services for all applications

    Gigabyte storage in portable systems

    Robotically controlled transportation mechanisms.

It will be essential for a range of security and safety features to be
embedded as a matter of design in all infrastructures, services and
applications for them to deliver the benefits that are expected by
their users.

Requirements

    Wide bandwidth telecommunications.

    Bandwidth will become a commodity on telecommunication systems.
    The added value in using it comes from the quality of service
    provided. One aspect of such quality is that of security. To
    provide security on wide band  public switched networks,
    investment is needed that is  focused on those aspects of
    security that are required by a) the telecoms service provider
    for his own purposes and b) the end user to support his
    application. Community wide and international specifications on
    security in ATM, SDH and associated signalling structures will
    be necessary.

    Multi media applications and communications

    Multi media applications will integrate all known
    representations of information into files, documents, messages
    and displays. Representations such as voice, audio, still
    image, text, video and graphics will become interchangeably
    available from a range of equipments that users interact with,
    including mobile telephones, personal computers, television
    sets and personal communicators. All aspects of security must
    be incorporated for potential implementation an all of these
    systems in order that a user may implement a level of security
    service appropriate to the application and the environment.

    A key issue is to maintain the "veracity" of the information
    transmitted. Veracity is the feature of a piece of information
    (eg a video sequence) to be true.  Veracity is a wider concept
    than integrity which is only concerned with the protection of
    information during transmission and storage.

    Another issue is concerned with the protection of information
    through copyright.  Without suitable technical means to
    safeguard the interests of the information owner, the evolution
    towards the information society will be seriously hampered.

    Global teleconferencing

    Teleconferencing is becoming the substitute for travel. In
    order to make it really cost effective all the above
    applications, multimedia, mobility, access to mass data and if
    necessary access to  one or more parties who are travelling in
    private vehicles need to be incorporated within the
    teleconferencing application. True geographic independence will
    come only if such an application works on a global scale and
    provides all the security services that are needed by the
    community of users. Such an application will demand the
    integration of the security services provided for each of the
    sub-applications alone. Specifications to allow such
    integration should be defined and the technology to provide the
    security functionality developed.

    Mobile services for applications.

    Mobility provides the end user with geographic independence.
    The price paid for this independence is infrastrucural
    information and process that allows his demands on the
    infrastrucural services to be met wherever he is. Such
    information and process has to, by design, have security
    features incorporated. At the community level extensions of the
    GSM concepts to allow all applications to function securely in
    the way telephony does on GSM will require significant
    technological investment.

    Mass data storage and communications in portable systems.

    Access to huge amounts of data from a mobile terminal will be
    essential. Such data needs to be communicated  securely,
    whether it be held in volatile memory, in the form of
    mechanically read ROM or transmitted over a network.
    Specifications for securing such data need to be developed as
    do the necessary bulk encryption services for huge data volumes
    . The technology components of such services will be a major
    challenge and need to be defined now.

    Robotically controlled transportation mechanisms.

    Human involvement in controlling mass transportation mechanisms
    is already decreasing as technology becomes more reliable. If
    human involvement  for individual transportation is to shrink
    in the same way then mass production of cost effective safety
    assured technologies will be essential. Collision avoidance ,
    guidance and navigation systems will be essential parts of
    every domestic vehicle and the requirements for the information
    safety and security critical elements of such systems need to
    be defined, standardised and developed .


7.    Liability related issues (Consequences of Security and Safety Incidents)

7.1.    Framework for international law relating to IS

[tba]

7.2.    Legal provisions for liability in global services

Issue

Liability is a difficult issue under the best of conditions, but in the
context of global telematics services it remains a matter of great
concern but so far few advances have been accomplished.

Discussion

Liability is dealt with normally by a mixture of laws, regulations,
conventions and counselling reinforced by risk sharing arrangements, in
particular insurances. Legislation has so far evolved slowly and is
still far from the point where it can deal effectively with the issues
on a national level. When it comes to deal with liability under
international law things become even more difficult. The same applies
to regulations. It is only the insurance industry which has started to
cover some of the risks. With the rapid increase in the use of
telematics clearly there is a need to come to a better understanding of
liability in the context of world-wide networking of services.

Requirements

Development of international framework for private law, especially liability

    Application of "Verursacherprinzip"

Under this kind of liability the source of the information has the
responsibility to assure the proper use, its accuracy and the
compliance with the law and regulations. In the case of intermediaries
adding value the principle would be carried forward since the quality
of the information may have been significantly changed.

    Application of "User Principle"

In this case the user is made liable for the what is done with the
information and its consequences. He has to take all necessary steps to
ensure that the information is correct and applicable to its use.

7.3.    Insurance issues

Issue

[tba]

Discussion

For the public safety risks are addressed by the Insurance Industry
with the premiums calculated on the basis of the assessment of risks
reflecting past experience. For the risk associated with information
systems there are only the beginning of an extension to cover this kind
of risks. As the taking out of insurance policies is a natural, or
partial alternative to IS measures, an improved methodology for the
assessment of risks is important in adopting the most economic and
practicable solution. Of course, there are some application areas where
this approach is not or only partially acceptable.

Requirements

[tba]

7.4.    Monitoring of compliance

[tba]

Development of framework for the monitoring of compliance to
regulations, recommendations and good practices

7.5.    Metrics for loss assessment

Issues

There is a fundamental need for guidance of any kind on how to access
the loss and damages an organisation might face and how much of this
might be addressed by evaluation and certification. Such metrics would
increase the perception of the value of a formal evaluation scheme.

Discussion

Action is necessary to ensure the effective international exploitation
of the security product evaluation and certification scheme. There must
be a competitive business advantage of developing, implementing and
using certified security products, and there must be a well understood
correlation between a certified security product and the problems that
it can solve.

Progress is hindered by lack of independent measures of the business
relevance of the certified product.

Measures can be obtained by:

    vendor/user studies (from actual risk assessment)

    product comparisons (using loss reduction models)

    insurance contracts (both direct and consequential damage
    assessment)

    vendor cost/benefit profiles (market penetration, Software
    engineering costs, etc.).

Such studies would prove invaluable to the SMEs who cannot justify
extensive Security controls yet are probably the most vulnerable to the
consequences of information abuse.

The ITSEC actions should reflect a balance between the product based
concepts of security objectives (codes of good practice) and
quantitative risk/loss assessment.

This should result in measured, affordable controls as a prerequisite
to developing a European and international security market.

Requirements.

Such a quantitative approach must address:

    mapping, certified product features to specific security incidents

    common, product independent risk analysis processes

    insurance processes recognising the advantages of certified products

    security incidents are the recognition by the legal, regulating
    and financial community.

A short term approach would be to raise awareness of the security
exposures of using poorly complying (non-assurance, non-certified)
products.

8.    Spectrum of Measures

8.1.    Common Framework and Consensus

Objective

To provide a minimum framework for trusted information and
communications services on an international scale and to establish a
multi actor consensus on essential requirements and options for the
provision of information security and related issues.

Background

Information and its exchange via global networks is inextricably
associated with all public and private activities involving the
citizen, service providers, operators, vendors, administrations and
authorities in numerous ways for all kind of purposes. With the
increasing globalisation of the economies an agreed framework for the
protection of information either associated with intellectual property,
privacy, internal security and other legitimate reasons is needed.
While there are several conventions and recommendations, the rapid
evolution of technology and services implies the need to reflect on a
common framework which could assist countries and regions to maintain
interworking and avoid technical barriers to trade and communications
without compromising their priorities in the protection of information
assets.

Solutions for open communications between a variety of parties on a
global scale do exist. They differ in detail and convenience in usage.
However, the ability to use them depends critically on a broad
consensus on the use of one or the other option. Nationally constrained
solutions, such as DES, RSA in the USA are of little utility if they
can not be used by US business in the pursuit of their global business
interests and vice versa if others can not make use of these techniques
for their communications with US partners.

To achieve agreement and reasonably general acceptance by the users
concerned is as important as the technical performance of the solution
in question.

Tasks

Development of a Common Framework to address the following issues:

    Revision of scope and approach to information security to
    reflect the new conditions, challenges and requirements brought
    about by globalisation (4.1.)

    Verification of the existing provisions with respect to their
    conformance to the Internal Market Policy of the EC implying
    the removal of existing internal barriers and the avoidance of
    the formation of new technical barriers due to divergent
    application of IS rules, regulations and legislation (4.2.)

    Definition of a common approach defining rights,
    responsibilities and duties of citizens and business on the one
    hand, and that of the authorities on the other hand (4.3.)

    Development of a common approach defining the rights of
    citizens and business users on the one hand and that of
    corporations, organisations and authorities using biometric
    techniques (4.4.)

    Development of a generic framework for the management of open
    and protected communications in a user/business oriented
    environment (4.5.)

    Concerted effort to address the common requirements of
    business, citizens and authorities to adequately protect
    non-classified information and its communication (4.6.)

    Common approach to the assignment of responsibility and
    liability (4.9.)

    Clarification of "Info-Ethics" for the professional and
    individual user in its relationship to Information Security

    Clarification of responsibilities of the sector actors in
    general and in their relations within each other, with
    particular reference to open and distributed applications
    (4.10.)

    Concerted effort to address a common approach to the handling
    of security and safety critical requirements (4.10.)

    Development of a common approach to security evaluation of
    information systems in safety-critical environments (4.11.)

    Common framework for domain interworking (5.6.)

    Clarification of the right to signature and the attached
    authority (5.8.2.)

    Common approach to the security of electronically stored
    information (5.8.7.)

    Proposal for a frameworks and architectures which are accepted
    as well by the business users as by the national security
    agencies and the service providers (5.9.1.)

    Framework for the provision of trans-domain confidentiality
    services . Mechanisms are needed that provide for a defined way
    to pass from one domain to another. This will require
    collective or multilateral agreements for interoperation
    (5.9.2.)

    Adoption of a confidentiality algorithm standard and
    specification, and a key distribution mechanism based on an
    asymmetric public key algorithm (6.1.5.)

    Develop an approach to date and time stamping for time-critical
    transactions and applications (6.1.8.)

    Establish conditions and procedures for mutual recognition of
    evaluations (6.2.2.)

    Development of an agreed definition of scope and liabilities of
    vendor declarations for secure solutions (6.2.3.)

8.2.    Awareness, education and training

Objective

Improved awareness of the issues of information security by specific
actions and a greater emphasis in the education and training of related
professions.

Background

In the end it is the human factor which decides the level of
information security, irrespective of the technical and operational
measures one may wish to deploy. In this sense awareness and the
teaching of appropriate skills in the context of the information
professions, is an important measure to be considered. This may entail
the creation of special training schemes and curricula, but most of all
the appropriate inclusion of information security related issues in the
teaching of information professions in general. This is in many cased
essential, since information security is very closely related to the
way information is used in a given context, ie often it has to be
embedded in the application and management procedure and can not be
added on as an external procedure.

Tasks

    Inclusion in the curriculum of relevant educational institutes
    (eg engineering, law and business schools) the use of digital
    signature (5.8.6.)

    Awareness of sector actors of the potential losses due to the
    absence of confidentiality services (5.9.1.)

    Initiate investigation to assist those member states not
    involved in the early stages of ITSEC to develop and test
    procurement policies that are based on evaluated communications
    products (5.11.)

8.3.    Agreements

Objective

International agreements on a minimum set of features and operational
concepts as required for trusted and open service provision.

Background

While a common framework and general consensus may go a long way, there
is the need to get formal agreement on certain aspects. These may, for
example, relate to issues surrounding liability, accreditation and
certification and the fighting of organised crime..

Tasks

Development of a Common Framework to address the following issues:

4.4.    Human Rights and biometrics

4.6.    Management of Openness and Protection

4.7.    Common concerns of commercial and national security

4.8.    Security and Law enforcement on international scale

5.6.    Security domains

5.8.    Signature issues

5.8.2.     The individual right to signature

5.8.3.    Consistency of legal principles

5.10.    Motivation to acquire evaluated products

5.11.    Consistency of procurement practices

6.1.4.    Use of names and certification of credentials

6.1.5.    Key management service

6.1.6.    Directory services

6.1.7.    Legal services

6.1.8.    Guaranteed date and time stamping

6.1.9.    Negotiable document transaction

6.2.1.    Perceived Requirements for trusted solutions

6.2.2.    International harmonisation and mutual recognition

6.2.3.    Vendor Declarations

6.2.4.    Evaluation of applications

8.4.    Common Practices and Codes of Conduct

Objectives

Development of Codes of Practice to

    support the development and harmonisation of sectorial practices

    support the development of a standardised approach to the
    development of baseline controls

    support the development and harmonisation of baseline controls.

Background

Codes of practice are found in many industries and disciplines. They
encapsulate the collective wisdom and experience of the practitioners
of a trade or profession or of an industry. For example codes of
practice for the building trade. To the practitioners of a trade or
profession, the need for codes of practice is self evident.

Codes of practice are not always obvious because they are often given
other names. In some situations they may be called standards manuals in
others requirements specifications. The property that sets them apart
and makes them recognisable as codes of practice is the encapsulation
of collective wisdom. The collective wisdom represents the means by
which all parties to a transaction are protected from harm. In legal or
business management terms this may be called a "standard of due care."

Any professional discipline needs to have a vehicle to encapsulate the
collective wisdom of its practitioners. They help to ensure consistency
across the wide spectrum of practitioners. That has to be true of
something as important as information processing.

We have mentioned elsewhere the move towards empowerment and
distributed systems. Empowerment means that the person responsible for
an operating unit of an enterprise is free to obtain its services and
resources anywhere. Where once information processing was done
in-house, it is now just as likely to be out-sourced.

When information was once processed centrally the computer centre was
well protected, both physically and logically. Indeed the protection of
computer centres was the trigger for the development of corporate
information security programmes. With information processing spread
throughout the enterprise, the need for a central site vanishes. With
it goes the ease of justifying the costs of high levels of security.

These two factors taken together mean that responsibility for
information security is fragmented and put in the hands of people who
have other responsibilities. Their mind set does not contain the same
awareness of the need for security. Neither do they understand the
interdependence of security and control measures.

The growth of legal, regulatory and contractual requirements for
security create the need for a generally accepted set of controls and
security measures. Words like due diligence and compliance with best
practice can be satisfied by compliance with codes of practice. They
provide the baseline needed for any comparison of actual with best
practice.

Looking to the future we can see that information processing will
become a basic skill for any skilled worker or manager. Where
industries have their own codes of practice governing the way they
operate, information security should become a sub-set.

Codes of practice must be formulated in such a way that audits can be
performed to establish compliance.

Tasks
Development of:

    Review of current design practices and codes of conduct with
    the aim of generating a community wide standard for the safety
    of systems (4.5.)

    Codes of practice for the handling of non-classified
    information, as opposed to classified information.  This should
    include rules for labelling of information. (4.7.)

    Guidelines to establish "cost of security" (4.9.)

    Assignment of responsibility and liability in global services (4.9.)

    Sector-specific codes of practice and base line controls, eg for:
    o finance
    o insurance
    o trade
    o medical
    o telecommunications
    o electronic service providers (including rules for
      inter-operation)
    o administrations

    (5.4.)

    Guidelines for the selection of security methodologies (5.5.)

    Code of Practice for data labelling (5.7.)

    Model contract clauses for contracts between service providers,
    TTPs and users, especially confidentiality service providers
    and services operating across national boundaries (5.9.1.,
    5.9.2., 5.9.3)

    Good practices for the operation of TTPs, specifically
    regarding availability, confidentiality, response times, rules
    of disclosure (6.1.2.)

    International guidelines for the accreditation and audit of
    TTPs (6.1.3.)

    International guidelines for
    o naming and certification
    o key management
    o directory services
    o legal services
    o time stamping
    o negotiable document transactions
    (6.1.4., to 6.1.9.)

    Rules for vendor declarations, as to the security of their
    products (6.2.3.)

    User and supplier obligations to report incidents (6.2.8.)

    Guidelines for the monitoring of compliance to codes of
    practice (7.4.)

    Rules for loss assessment (7.5.)

8.5.    Specifications

Objectives

To develop specifications for the application of security, in order to
ensure interworking, interoperation and mutual recognition.

Background

Functional specifications for products or services are documents that
are to be used as parts of purchase specifications. They specify the
functions of a solution and the required performance characteristics.
Implementation aspects are only dealt with if they are particularly
important for the fulfilment of a specific function. Specifications
call up standards and profiles, as far as available.  Options in the
standards are resolved in specifications.

Common specifications for methodologies, eg evaluation, serve as a
basis for mutual recognition.

Tasks

Development of:

    Specifications for solutions to confidentiality and integrity
    services (4.8.)

    Methodologies for the assessment of threats, vulnerabilities,
    and hazards for safety critical systems (4.11.)

    Development of methods of testing that enable standards of
    reliability to be ensured, including tests to destruction where
    appropriate (4.12.)

    Definition of requirements for fail-safe system architectures
    and implementations (4.12.)

    Specifications of security evaluations for safety critical
    environments

    Taxonomy of user requirements for enterprises, individuals and
    citizens (5.1., 5.2.)

    Identify and group access control scenarios, to determine
    levels of commonality (5.8.1.)

    Identify techniques, products, specifications and standards
    addressing access control, and associate them with the
    identified scenarios (5.8.1.)

    Identify parameters common to most or all of the above
    techniques, products, specifications and standards and
    investigate the feasibility of establishing common formats for
    them (5.8.1.)

    Identify the key features for coherence in the supporting
    infrastructure (5.8.1.)

    Define a limited number of basic access control mechanisms for
    pilot implementation (5.8.1.)

    Specification of a signature scheme (5.8.4.)

    Specification of application oriented integration of the
    signature scheme (5.8.4.)

    Specification of an Application Program Interface (API) for the
    signature scheme (5.8.4.)

    Specification of the use of multiple signatures (5.8.4.)

    Specification of key usage for integrity and confidentiality
    (5.8.5.)

    Specification for the practical use of digital signatures as a
    full equivalent to manual signatures (5.8.6.)

    Specification for the handling of electronically stored
    information (5.8.7.)

    Specification of an approach to confidentiality (5.9.1.)

    Assurance criteria for confidentiality service providers and
    operators (5.9.2.)

    Specification for the inter-operability of confidentiality
    services (5.9.3.)

    Specification for date and time stamping (6.1.8.)

8.6.    Standards

Objective

Development of standards for IS.

Background

European security standards developed over the next decade will have a
decisive influence on the technological structure of the entire
European market and will change the conditions of trade in export
markets and national markets.

The standards making infrastructure for the development of IT and
telecommunication standards has become increasingly complex. The number
of groups, the range of work items and the  overall process at
different levels of international, regional and national
standardisation is a complex maze. Security standardisation is no
exception to this situation. In general there is a reoccurring problem
which is that of coordination between groups developing standards
similar in nature and scope. Such coordination is necessary to avoid
duplication of work and the unnecessary waste of resource, and to
ensure that the standards that are developed are consistent and  they
form a coherent set.

At the European level the establishment of the Advisory Expert Group
ITAEGV has provided an ideal mechanism for the coordination of security
standards work within Europe. In addition, ITAEGV is in the process of
developing a European Memorandum, M-IT-06, which is a Taxonomy and
Directory of European Standardisation Requirements for Information
Systems Security based on market driven requirements. This memorandum
also contains a future work programme for security standardisation.

Hence Europe is now demonstrating through this action a clearly defined
strategic stance on security standardisation. One that is demonstrating
effective coordination, leadership and a market driven focused approach
to standardisation.

Traditionally the principal contributors to standards making have been
suppliers, designers and professionals. The end user of products and
services has only been peripherally interested or involved. The end
user has been concerned that standards have been used in relation to
the products he buys but not greatly interested in what they are.

There is a need for a more effective mechanism and framework through
which user interest is able to collectively express their requirements
and priorities so that they can contribute to the standardisation
process in a way which will balance the very strong interest of the
supply industry.

This mechanism should be used to provide greater user input into the
development of the European Memorandum, M-IT-06 (The Taxonomy and
Directory of European Standardisation Requirements for Information
Systems Security). This memorandum also contains a future work
programme for security standardisation.

The long-term benefits of security standardisation requires investment
by companies and users and as such they must be prepared to organise
themselves more effectively to participate in the standards making
process.

Tasks

    Define a solution to the specification, standardisation and
    licensing problem of cryptographic algorithms(5.8.4.).

Develop standards for:

    identify and group access control scenarios, to determine
    levels of commonality (5.8.1.)

    identify techniques, products, specifications and standards
    addressing access control, and associate them with the
    identified scenarios (5.8.1.)

    identify parameters common to most or all of the above
    techniques, products, specifications and standards and
    investigate the feasibility of establishing common formats for
    them (5.8.1.)

    identify the key features for coherence in the supporting
    infrastructure (5.8.1.)

    define a limited number of basic access control mechanisms for
    pilot implementation (5.8.1.)

    Digital signatures, including for application oriented
    integration and a general application programming interface
    (API) for integration of security services which could be
    easily integrated into any (almost) application (5.8.4.)

    Profile - or functional - standards to support CCITT X.509 (5.8.5.)

    Services and service provision. Ensure that the confidentiality
    services are compatible with existing communication standards
    and practices where possible (5.9.1.)

    Minimum requirements to ensure interoperability of procedure
    and operating practices for confidentiality services (5.9.3.)

    Evaluation criteria and methods (6.2.2.).

8.7.    Products and Services

Objective

In order to facilitate a harmonious development of the provision of
security of information systems in the Community for the protection of
the public and of business interests, it will be necessary to develop a
consistent approach as to its provision of security. Where independent
organisations will have to be mandated, their functions and conditions
will need to be defined and agreed and, where required, embedded into
the regulatory framework. The objective would be to come to a clearly
defined and agreed sharing of responsibilities between the different
actors on a Community level as a prerequisite for mutual recognition.

Background

At present, the provision of security of information systems is well
organised only for specific areas and limited to addressing their
specific needs. The organisation on a European level is mostly
informal, and mutual recognition of verification and certification is
not yet established outside closed groups. With the growing importance
of the security of information systems, the need for defining a
consistent approach to the provision of security for information
systems in Europe and internationally is becoming urgent. The most
urgent needs identified relate to digital signatures and
confidentiality services.

Tasks

    Verification of the existing provisions with respect to their
    conformance to the Internal Market Policy of the EC implying
    the removal of existing internal barriers and the avoidance of
    the formation of new technical barriers due to divergent
    application of IS rules, regulations and legislation (4.2.)

    Provision of IS to business and the public of solutions freely
    applicable throughout the Community and on a preferential basis
    at the international level (4.2.)

    An effective, internationally agreed, economic, ethical and
    usable solution to meet business, administration and personal
    needs including mechanisms for authorised interception and
    reporting of incidents and crimes adjusted to the conditions of
    the Internal Market, and to include the necessary equipment and
    software, but also an infrastructure of Trusted Third Parties.
    This will discourage "home-made" or other solutions (4.8.)

    Recommendation for the implementation for a public digital
    signature scheme for use by business, administrations and the
    general public (5.8.3.)

    Development of a general application programming interface
    (API) for integration of security services which could be
    easily integrated into most application (This could as well
    include codes which explain the intention of the applied
    signature.) (5.8.4.)

    Development of transaction-oriented multiple signature schemes
    (5.8.4.)

    Framework for the provision of trans-domain confidentiality
    services (Mechanisms are needed that provide for a defined way
    to pass from one domain to another. This will require
    collective or multilateral agreements for interoperation.)
    (5.9.2.)

    Demonstration of trans-European confidentiality services using
    a suitable application , eg the realisation of administrative
    telematics applications (5.9.3.)

    Trial service evaluations for existing telecommunication
    services (6.2.5.)

    Incident reporting system for Certification Bodies (6.2.8.)

8.8.    Technology

Objective

Systematic investigation and development of the technology to permit
economically viable and operationally satisfactory solutions to a range
of present and future requirements for the security of information
systems.

Background

Work on security of information systems would need to address
development and implementation strategies, technologies, and
integration and verification.

The strategic R&D work would have to cover conceptual models for secure
systems (secure against compromise, unauthorised modifications and
denial of service), functional requirements models, risk models and
architectures for security.

Verification and validation of the security of the technical system and
its applicability would be investigated through integration and
verification projects.

In addition to the consolidation and development of security
technology, a number of accompanying measures are required concerned
with the creation, maintenance and consistent application of standards,
and the validation and certification of IT and telecommunication
products with respect to their security properties, including
validation and certification of methods to design and implement
systems.

The fourth RD&T Community Framework Programme might be one of the tools
to foster co-operative projects at precompetitive and prenormative
levels.

Tasks

    Demonstration, through pilot projects, that digital signatures
    can be used as equivalent to hand-written signatures (5.8.6.)

    Development of techniques for the establishment, handling and
    recording of Electronic Negotiable Documents (6.1.9.)

    Adapt to technological change:

    Wide bandwidth telecommunications.

    Bandwidth will become a commodity on telecommunication systems.
    The added value in using it comes from the quality of service
    provided. One aspect of such quality is that of security. To
    provide security on wide band  public switched networks,
    investment is needed that is  focused on those aspects of
    security that are required by a) the telecoms service provider
    for his own purposes and b) the end user to support his
    application. Community wide and international specifications on
    security in ATM, SDH and associated signalling structures will
    be necessary.

    Multi media  applications and communications

    Multi media applications will integrate all known
    representations of information into files, documents, messages
    and displays. Representations such as voice, audio, still
    image, text, video and graphics will become interchangeably
    available from a range of equipments that users interact with,
    including mobile telephones, personal computers, television
    sets and personal communicators. All aspects of security must
    be incorporated for potential implementation an all of these
    systems in order that a user may implement a level of security
    service appropriate to the application and the environment.

    A key issue is to maintain the "veracity" of the information
    transmitted. Veracity is the feature of a piece of information
    (eg a video sequence) to be true.  Veracity is a wider concept
    than integrity which is only concerned with the protection of
    information during transmission and storage.

    Another issue is concerned with the protection of information
    through copyright.  Without suitable technical means to
    safeguard the interests of the information owner, the evolution
    towards the information society will be seriously hampered.

    Global teleconferencing

    Teleconferencing is becoming the substitute for travel. In
    order to make it really cost effective all the above
    applications, multimedia, mobility, access to mass data and if
    necessary access to  one or more parties who are travelling in
    private vehicles need to be incorporated within the
    teleconferencing application. True geographic independence will
    come only if such an application works on a global scale and
    provides all the security services that are needed by the
    community of users. Such an application will demand the
    integration of the security services provided for each of the
    sub-applications alone. Specifications to allow such
    integration should be defined and the technology to provide the
    security functionality developed.

    Mobile services for applications.

    Mobility provides the end user with geographic independence.
    The price paid for this independence is infrastrucural
    information and process that allows his demands on the
    infrastrucural services to be met wherever he is. Such
    information and process has to, by design, have security
    features incorporated. At the community level extensions of the
    GSM concepts to allow all applications to function securely in
    the way telephony does on GSM will require significant
    technological investment.

    Mass data storage and communications in portable systems.

    Access to huge amounts of data from a mobile terminal will be
    essential. Such data needs to be communicated  securely,
    whether it be held in volatile memory, in the form of
    mechanically read ROM or transmitted over a network.
    Specifications for securing such data need to be developed as
    do the necessary bulk encryption services for huge data volumes.
    The technology components of such services will be a major
    challenge and need to be defined now.

    Robotically controlled transportation mechanisms.

    Human involvement in controlling mass transportation mechanisms
    is already decreasing as technology becomes more reliable. If
    human involvement  for individual transportation is to shrink
    in the same way then mass production of cost effective safety
    assured technologies will be essential. Collision avoidance,
    guidance and navigation systems will be essential parts of
    every domestic vehicle and the requirements for the information
    safety and security critical elements of such systems need to
    be defined, standardised and developed .

8.9.    Regulation and Legislation

Objective

Adjustment of national regulations and legislation to permit seamless
interworking of trusted services.

Background

The provision of information security is seen to related in some areas
closely to public order and defence issues. The related national
regulations and legislations vary considerably. In order to avoid the
creation of technical barriers to trade and communications outside the
domains of internal order and national security, adjustments of
legislation and regulations may be required in some countries.

Tasks

Development of a legal framework to address the following issues:

    Verification of the existing provisions with respect to their
    conformance to the Internal Market Policy of the EC implying
    the removal of existing internal barriers and the avoidance of
    the formation of new technical barriers due to divergent
    application of IS rules, regulations and legislation (4.2.)

    Clarification of the ownership and privacy issues surrounding
    biometric data (4.4.)

    Study the legal environment within which vendors and users of
    safety critical systems work, with the objective of harmonising
    that environment (4.5.)

    Need to provide business and the general public with an
    effective, economic and usable security solution to meet their
    needs including a mechanism for authorised interception (4.8.)

    Establishment of a network of Trusted Third Parties to provide
    user support and manage directories (4.8.)

    Clarification of responsibilities of the sector actors in
    general and in their relations within each other, with
    particular reference to open and distributed applications
    (4.10.)

    Agreement on management, TTPs, accreditation, auditing and
    relations with law enforcement agencies (5.6.)

    Clarification of the right to signature and the attached
    authority (5.8.3.)

    The legal functions of signatures need to be agreed
    EC-wide/internationally. Once this is achieved, it is possible
    to determine to what extent a code-of- practice will suffice.
    One issue to be addressed is the intended use of the digital
    signature, and the legal responsibility and liability of the
    signing entity with regard to the signed information (5.8.3.)

    Clarification of the conditions of acceptance of the authority
    of an electronic signature, eg for legally binding purposes, ie
    as substitute for hand-written original signatures (5.8.3.)

    Solution to the licensing problem of cryptographic algorithms
    (5.8.4.)

    Definition of minimum requirements to ensure interoperability,
    including standards, specifications, rules of procedure and
    operating practices for autonomous confidentiality services
    (5.9.3.)

    Alignment of national procurement policies concerning evaluated
    products (5.11.)

    Definition of the classes of information used and the types of
    damage that could be caused to the information owners (5.12.)

    Definition of the rights and duties of information ownership
    (5.12.)

    Development of guidance for owners of information as to the
    actions that they would have been expected to take to protect
    their assets and avoid negligence charges (5.12.)

    Development of the methods and procedures that should be used
    to establish information value (5.12.)

    Introduce or harmonise legislation to provide an appropriate
    framework for arbitration, supervision and litigation (6.1.2.)

    Adapt applicable legislation or regulations to provide an
    appropriate legal framework for use throughout the Community
    and in the relations with third countries (6.1.3.)

    Harmonisation of legislation on the legal status of evidence
    generated by any TTPs and especially on the intra- and extra-
    community recognition thereof. This probably implies the
    settlement of the accreditation question.

    Promotion of community-level information technology litigation
    services modelled after existing international bodies such as
    the International Chamber of Commerce (6.1.7.)

    Framework for international law relating to IS (7.1.)

    Development of international framework for private law,
    especially liability (7.2.)

8.10.   Accreditation

8.10.1. Accreditation of Services

Objective

Evaluation of communication services.

Background

Common criteria for security evaluation are mainly focused on IT
products and IT systems.  However, there is a perceived need for
criteria to support the evaluation of communication services.  This
later criteria may be considered as an extension to the current
criteria or there may be a need to develop separate criteria.

The evaluation of a service and its subsequent accreditation will be a
critical requirement in many user applications, in particular those
that need to use trans-European communication services. The
consistency, completeness and effectiveness of the security
enhancements of communication services needs to be checked for an
overall fitness for purpose. Hence there is a need for a framework for
accreditation of communications services.

Tasks

    Establishment of a formal accreditation scheme for secure
    communication services (6.2.5.)

    Development of accreditation guidelines for the
    telecommunication sector (6.2.5.)

    Accreditation guidelines for the trusted network management
    (6.2.6.)

8.10.2. Accreditation of TTPs

Objective

Procedures for the accreditation and audit of TTPs.

Background

TTPs will need to interwork and communicate internationally to provide
a service infrastructure to support a range of security services such
as digital signature and confidentiality.  TTPs will thus need to
process, store and distribute a range of security-related information
for the use and management of such services. This implies the need for
a set of harmonised procedures for the accreditation and audit of TTPs
in order to ensure mutual trust by the public in TTPs and the services
they provide.

Tasks

    Development of international guidelines for the accreditation
    and audit of TTPs (6.1.3.)

    Adaptation of applicable legislation or regulations to provide
    an appropriate legal framework for use throughout the Community
    and in the relations with third countries (6.1.3.)

Annex: Recalling the Action Lines from the Council mandate

Action line I - Development of a strategic framework for the security
of information systems

Issue

Security of information systems is recognized as a pervasive quality
necessary in modern society. Electronic information services need a
secure telecommunications infrastructure, secure hard- and software as
well as secure usage and management. An overall strategy, considering
all aspects of security of information systems, needs to be
established, avoiding a fragmented approach. Any strategy for the
security of information processed in an electronic form must reflect
the wish of any society to operate effectively yet protect itself in a
rapidly changing world.

Objective

A strategically oriented framework has to be established to reconcile
social, economic and political objectives with technical, operational
and legislative options for the Community in an international context.
The sensitive balance between different concerns, objectives and
constraints are to be found by sector actors working together in the
development of a common perception and agreed strategy framework. These
are the are the prerequisites for reconciling interests and needs both
in policy-making and in industrial developments.

Status and trends

The situation is characterized by growing awareness of the need to act.
However, in the absence of an initiative to coordinate efforts, it
seems very likely that dispersed efforts various sectors will create a
situation which will de facto be contradictory, creating progressively
more serious legal, social and economic problems.

Requirements, options and priorities

Such a shared framework would need to address and situate risk analysis
and risk management concerning the vulnerability of information and
related services, the alignment of laws and regulations associated with
computer/telecommunications abuse and misuse, administrative
infrastructures including security policies, and how these may be
effectively implemented by various industries/disciplines, and social
and privacy concerns (e.g. the application of identification,
authentication, non-repudiation and possibly authorization schemes in a
democratic environment ).

Clear guidance is to be provided for the development of physical and
logical architectures for secure distributed information services,
standards, guidelines and definitions for assured security products and
services, pilots and prototypes to establish the viability of various
administrative structures, architectures and standards related to the
needs of specific sectors.

Security awareness must be created in order to influence the attitude
of the users towards an increased concern about security in information
technology (IT).

Action line II - Identification of user and service provider
requirements for the security of information systems

Issues

Security of information systems is the inherent prerequisite for the
integrity and trustworthiness of business applications, intellectual
property and confidentiality. This leads inevitably to a difficult
balance and sometimes choices, between a commitment to free trade and a
commitment to securing privacy and intellectual property. These choices
and compromises need to be based on a full appreciation of requirements
and the impact of possible options for the security of information
systems to respond to them.

User requirements imply the security functionalities of information
systems interdependent with technological, operational and regulatory
aspects. Therefore, a systematic investigation of security requirements
for information systems forms an essential part of the development of
appropriate and effective measures.

Objective

Establishing the nature and characteristics of requirements of users
and service providers and their relation to security measures of
information systems.

Status and trends

Hitherto, no concerted effort has been undertaken to identify the
rapidly evolving and changing requirements of the major actors for the
security of information systems. Member States of the Community have
identified the requirements for harmonization of national activities
(especially of the "IT security evaluation criteria"). Uniform
evaluation criteria and rules for mutual recognition of evaluation
certification are of major importance.

Requirements, options and priorities

As a basis for a consistent and transparent treatment of the justified
needs of the sector actors, it is considered necessary to develop an
agreed classification of user requirements and its relation to the
provision of security in information systems.

It is also considered important to identify requirements for
legislation, regulations and codes of practice in the light of an
assessment of trends in service characteristics and technology, to
identify alternative strategies for meeting the objectives by
administrative, service, operational and technical provisions, and to
assess the effectiveness, user friendliness and costs of alternative
security options and strategies for information systems for users,
service providers and operators.

Action Line III - Solutions for immediate and interim needs of users,
suppliers and service providers

Issues

At present it is possible to protect adequately computers from
unauthorized access from the outside world by "isolation", i.e. by
supplying conventional organizational and physical measures. This
applies also to electronic communications within closed user group
operating on a dedicated network. The situation is very different if
the information is shared between user groups or exchanged via a
public, or generally accessible, network. Neither the technology,
terminals and services nor the related standards and procedures are
generally available to provide comparable security for information
systems in these cases.

Objectives

The objective has to be to provide, at short notice, solutions which
can respond to the most urgent needs of users, service providers and
manufacturers. This includes the use of common IT-security evaluation
criteria. These should be conceived as open towards future requirements
and solutions.

Status and trends

Some user groups have developed techniques and procedures for their
specific use responding, in particular, to the need for authentication,
integrity and non-repudiation. In general, magnetic cards or smart
cards are being used. Some are using more or less sophisticated
cryptographic techniques. Often this implied the definition of
user-group specific "authorities". However, it is difficult to
generalise these techniques and methods to meet the needs of an open
environment.

ISO is working on OSI Information System Security (ISO DIS 7498-2) and
CCITT in the context of X400. It is also possible to insert security
segments into the messages. Authentication, integrity and
non-repudiation are being addressed as part of the messages (EDIFACT)
as well as part of the X400 MHS.

At present, the Electronic Data Interchange (EDI) legal framework is
still at the stage of conception. The International Chamber of Commerce
has published uniform rules of conduct for the exchange of commercial
data via telecommunications networks.

Several countries (e.g. Germany, France, the United Kingdom and the
United States) have developed, or are developing, criteria to evaluate
the trustworthiness of IT and telecommunication products and systems
and the corresponding procedures for conducting evaluations. These
criteria have been coordinated with the national manufacturers and will
lead to an increasing number of reliable products and systems starting
with simple products. The establishment of national organizations which
will conduct evaluations and offer certificates will support this
trend.

Confidentiality provision is considered by most users as less
immediately important. In the future, however, this situation is likely
to change as advanced communication services and, in particular, mobile
services will have become all-pervasive.

Requirements, options and priorities

It is essential to develop as soon as possible the procedures,
standards, products and tools suited to assure security both in
information systems as such (computers, peripherals) and in public
communications networks. A high priority should be given to
authentication, integrity and non-repudiation. Pilot projects should be
carried out to establish the validity of the proposed solutions.
Solutions to priority needs on EDI are looked at in the TEDIS programme
within the more general content of this action plan.

Action line IV - Development of specifications, standardization,
evaluation and certification in respect of the security of information
systems

Issues

Requirements for the security of information systems are pervasive and
as such common specifications and standards are crucial. The absence of
agreed standards and specifications for IT security may present a major
barrier to the advance of information-based processes and services
throughout the economy and society. Actions are also required to
accelerate the development and use of technology and standards in
several related communication and computer network areas that are of
critical importance to users, industry and administrations.

Objective

Efforts are required to provide a means of supporting and performing
specific security functions in the general areas of OSI, ONP, ISDN/IBC
and network management. Inherently related to standardization and
specification are the techniques and approaches required for
verification, including certification leading to mutual recognition.
Where possible, internationally agreed solutions are to be supported.
The development and use of computer systems with security functions
should also be encouraged.

Status and trends

The United States, in particular, has taken major initiatives to
address the security of information systems. In Europe the subject is
treated in the context of IT and telecommunications standardization in
the context of ETSI and CEN/CENELEC in preparation of CCITT and ISO
work in the field.

In view of growing concern, the work in the United States is rapidly
intensifying and both vendors and service providers are increasing
their efforts in this area In Europe, France, Germany and the United
Kingdom have independently started similar activities, but a common
effort corresponding to the United States is evolving only slowly.

Requirements, options and priorities

In the security of information systems there is inherently a very close
relationship between regulatory, operational, administrative and
technical aspects. Regulations need to be reflected in standards, and
provisions for the security of information systems need to comply in a
verifiable manner to the standards and regulations. In several aspects,
regulations require specifications which go beyond the conventional
scope of standardization, i.e. include codes of practice. Requirements
for standards and codes of practice are present in all areas of
security of information systems, and a distinction has to be made
between the protection requirements which correspond to the security
objectives and some of the technical requirements which can be
entrusted to the competent European standards bodies (CEN/CENELEC/
ETSI).

Specifications and standards must cover the subjects of security
services of information systems (personal and enterprise
authentication, non-repudiation protocols, legally acceptable
electronic proof, authorisation control), their communication services
(image communication privacy, mobile communications voice and data
privacy, data and image data-base protection, integrated services
security), their communication and security management (public/private
key system for open network operation, network management protection,
service provider protection) and their certification (assurance
criteria and levels, security assurance procedures for secure
information systems).

Action line V - Technological and operational developments in the
security of information systems

Issues

Systematic investigation and development of the technology to permit
economically viable and operationally satisfactory solutions to a range
of present and future requirements for the security of information
systems is a prerequisite for the development of the services market
and the competitiveness of the European economy as a whole.

Any technological developments in the security of information systems
will have to include both the aspects of computer security and security
of communications as most present-day systems are distributed systems,
and access to such systems is through communications services.

Objective

Systematic investigation and development of the technology to permit
economically viable and operationally satisfactory solutions to a range
of present and future requirements for the security of information
systems.

Requirements, options and priorities

Work on security of information systems would need to address
development and implementation strategies, technologies, and
integration and verification.

The strategic R&D work would have to cover conceptual models for secure
systems (secure against compromise, unauthorized modifications and
denial of service), functional requirements models, risk models and
architectures for security.

The technology-oriented R&D work would have to include user and message
authentication (e.g. through voice-analysis and electronic signatures),
technical interfaces and protocols for encryption, access control
mechanisms and implementation methods for provable secure systems.

Verification and validation of the security of the technical system and
its applicability would be investigated through integration and
verification projects.

In addition to the consolidation and development of security
technology, a number of accompanying measures are required concerned
with the creation, maintenance and consistent application of standards,
and the validation and certification of IT and telecommunication
products with respect to their security properties, including
validation and certification of methods to design and implement
systems.

The third RD&T Community Framework Programme might be used to foster
cooperative projects at precompetitive and prenormative levels.

Action line VI - Provision of security of information systems

Issues

Depending on the exact nature of the security features of information
systems, the required functions will need to be incorporated at
different parts of the information system including
terminals/computers, services, network management to cryptographic
devices, smart cards, public and private keys, etc. Some of these can
be expected to be embedded in the hardware or software provided by
vendors, while others may be part of distributed systems (e.g. network
management), in the possession of the individual user (e.g. smart
cards) or provided from a specialised organization (e. g.
public/private keys).

Most of the security products and services can be expected to be
provided by vendors, service providers or operators. For specific
functions, e.g. the provision of public/private keys, auditing
authorization, there may be the need to identify and mandate
appropriate organizations.

The same applies for certification, evaluation and verification of
quality of service which are functions which need to be addressed by
organizations independent of the interests of vendors, service
providers or operators. These organizations could be private,
governmental or licensed by government to perform delegated functions.

Objective

In order to facilitate a harmonious development of the provision of
security of information systems in the Community for the protection of
the public and of business interests, it will be necessary to develop a
consistent approach as to its provision of security. Where independent
organizations will have to be mandated, their functions and conditions
will need to be defined and agreed and, where required, embedded into
the regulatory framework. The objective would be to come to a clearly
defined and agreed sharing of responsibilities between the different
actors on a Community level as a prerequisite for mutual recognition.

Status and trends

At present, the provision of security of information systems is well
organized only for specific areas and limited to addressing their
specific needs. The organization on a European level is mostly
informal, and mutual recognition of verification and certification is
not yet established outside closed groups. With the growing importance
of the security of information systems, the need for defining a
consistent approach to the provision of security for information
systems in Europe and internationally is becoming urgent.

Requirements, options and priorities

Because of the number of different actors concerned and the close
relations to regulatory and legislative questions, it is particularly
important to pre-agree on the principles which should govern the
provision of the security of information systems.

In developing a consistent approach to this question, one will need to
address the aspects of identification and specification of functions
requiring, by their very nature, the availability of some independent
organizations (or interworking organizations). This could include
functions such as the administration of a public/private key system.

In addition, it is required to identify and specify, at an early stage,
the functions which in the public interest need to be entrusted to
independent organizations (or interworking organizations). This could,
for example, include auditing, quality assurance, verification,
certification and similar functions.



    OJ No L 123, 8.5.1992, p.19

    SOG-IS Opinion of 17.11.92 on objectives, scope and approach

    Information Security is concerned with the protection of
    information stored, processed or transmitted in electronic
    form, against deliberate or accidental threats.

    Information is acquired, communicated, processed and stored by
    Information Services.  Electronic Information services need a
    secure telecommunication infrastructure, secure terminals
    (including processors and data bases) as well as secure usage.
    The management of the service provision itself must also and
    foremost be secure.  Therefore the approach to information
    security starts form an analysis of the needs of an individual
    or organisation for Information Services.  92/242/EEC

    This danger has already been identified and OECD Member
    Countries have, in the context of Protection of Privacy and
    Transborder Data Flow of Personal Data, recognised the risk of
    new technical barriers forming.  They have therefore agreed to
    endeavour to remove and to avoid to create in the name of
    privacy protection, unjustified obstacles to transborder flows
    of personal data, co-operate in the implementation of the
    Guidelines and agree as soon as possible on specific procedures
    of consultation and co-operation for the application of these
    Guidelines.