ENISA Quarterly Review

Vol. 5, No. 3, September 2009

IN THIS EDITION

Resilience & A Letter from the Executive Director

A Word from the Editor
Resilience and Information Sharing
A Resilient and Secure Internet
2
3
4
4

Information Sharing Infrastructure

Occasional Curiosity or Regular
Routine? Evaluating the reliability of
the Internet infrastructure
6

Three European ‘Trusted Information 7

Critical Information Sharing’ Projects

Critical Information Infrastructure
Protection
9

Infrastructure Protection Public-Private Partnership for CIIP –

Case Finland
Interdependency between Energy and
9

11
Telecommunications

Emerging and Future Risks

Emerging and Future Risks 13
Identification of Emerging and Future 13
Risks in a 2011 eHealth Scenario
Drivers of Emerging and Future 15
Threats in ICT Infrastructures

Skills & Certifications

Skills and Certifications 16
Cyber-Security Skills – The Cost of 16
Ignorance
Penetration Testing – What’s That? 16
A New Qualification to Guarantee 18

Awareness & Secure Software Engineering Skills

Awareness and End-User Issues
End-user Security: Misused and
Misunderstood?
19
19

End-User Issues Human Factors in the Dependability of

IP Networks
Technologies
20

22
A Secure Approach for Embedded 22
Systems in Japan

Technologies
tNAC: trusted Network Access Control 23

ISSN1830-3609

A LETTER FROM THE EXECUTIVE DIRECTOR
Andrea Pirotti
In mid-October I shall hand over the
management of ENISA to my successor,
Dr. Udo Helmbrecht.
After steering ENISA through its first five
years, I am pleased to leave behind an
Agency that has emerged as a Centre of
Technical Competence recognised within
and outside the borders of Europe. Since
its establishment, ENISA has increased its
technical capacity and fine-tuned its
administrative procedures. It has
increased its operations budget by
reducing administrative costs, and has
welcomed recruits from the new EU
Member States including Romania, the
ENISA Quarterly Review Vol. 5, No. 3, September 2009
2
Czech Republic, Slovakia and Poland. It is
improving its facilities with the building of
new, larger premises in Heraklion which
will be ready in 2012, and is establishing a
branch office near Athens airport to
facilitate meetings with its stakeholders.
Most importantly, it has published
numerous security papers and reports,
gathered and shared information about
crucial issues of Network and Information
Security, provided advice and brought
people together. In this way it has made a
significant impact in the battles to make
information technology safer for users and
to strengthen and secure the digital
economy.
None of this would have been possible
without the dedicated work of our staff,
‘the ENISians’, and I am privileged to have
worked with such people. I have tried to
lead by example, reminding the staff of the
respect due to the European taxpayer in
providing a good return on investment. But
it is the individual members of the ENISA
team themselves who have gone the extra
mile and consistently delivered diligent and
professional service.
It has been an honour and a pleasure to
work for the European Union. I would like
to thank all those who have helped ENISA
– in the Commission, the European
Parliament, the Council, the Hellenic
Government and in FORTH.
I now leave ENISA with a sense of
satisfaction, having accomplished my
mission. I wish the new Executive Director
every success in the Agency; I am certain
the staff will support him as they have
supported me.
To you, the readers of the ENISA Quarterly
Review, I send my best regards and wish
you a continuing and productive
relationship with our Agency.
Yours sincerely
Andrea Pirotti
Executive Director, ENISA

A WORD FROM THE EDITOR
Panagiotis Trimintzios
We received positive feedback to the last
edition of EQR where we introduced a new
structure with multiple thematic areas. So
in this issue we continue this new strategy,
which is made possible by the increased
number and quality of your submissions.
In this edition we have contributions in six
thematic areas of Network and
Information Security (NIS):
• Resilience and Information Sharing
• Critical Information Infrastructure
Protection (CIIP)
• Emerging and Future Risks
• Skills and Certifications
• Awareness and End-user Issues
• Technologies
Anne-Marie Eklund Löwinder opens with a
discussion of the challenges for the future
in achieving a resilient Internet
Infrastructure, focusing on the Domain
Name System, IPv6 and resilient network
design. Natalija Gelvanovska and Rytis
Rainys then present the main results from
a survey in Lithuania which looked at the
reliability of the country’s Internet
infrastructure, including the
interconnection points and the
international gateways. In their article,
John Harrison and Andrea Rigoni contrast
three EU projects in the area of Trusted
Information Sharing, including the ENISA
Good Practice Guide on Information
Security Exchanges.
In the area of Critical Infrastructure
Protection we have two articles. The first,
by Hannu Sivonen, looks at the lessons
learned from the Finnish Public Private
Partnership (PPP) for CIIP, a very
important subject as PPPs for CIIP are on
the agenda of the European Institutions
(see the recent Communication by the
ENISA Quarterly Review Vol. 5, No. 3, September 2009
3
European Commission, Strategy on
Critical Information Infrastructure
Protection (CIIP) ’Protecting Europe from
large scale cyber-attacks and disruptions:
enhancing preparedness, security and
resilience’ – http://ec.europa.eu/
information_society/policy/nis/strategy/
activities/ciip/index_en.htm). David Sutton
introduces another key issue in the same
topical area: the interdependencies
between different critical infrastructures,
taking as an example the energy and
telecommunications infrastructures.
ENISA’s recent work under the umbrella of
the Emerging and Future Risks (EFR)
programme on the risks in an eHealth
scenario is summarised by Barbara
Daskala, Louis Marinos and David Wright.
Sotiris Ioannidis and his co-authors
present the different dimensions that exist
when one looks at emerging risks and
future threats in ICT infrastructures, as
identified in the EU-funded project
FORWARD.
An area ENISA plans to explore more
closely in the future is NIS skills and
knowledge certification. Hugo Lueders
discusses the cost of ignorance when it
comes to (lack of) cyber-security skills.
Penetration testers are specially trained
NIS experts who can test the security of
systems and enterprises, in the manner of
‘ethical hackers’. Peter Fagan and Peter
Fischer help us to get to know a little
better what a penetration tester can do,
and they describe the relevant certification
schemes. On a similar theme, Petra Barzin
presents another (see also EQR vol. 4 no. 4
Dec 2008, p. 5) new qualification scheme
intended to guarantee different levels of
security knowledge skills for software
engineers.
A related topic is the awareness – or lack
of it – of end-users when it comes to NIS
issues. Steven Furnell elaborates on the
subject based on the findings of a study of
home-users, and emphasises the
importance of increased usability coupled
with effective awareness raising. Ilkka and
Leena Norros present the results from two
projects in Finland that looked at the
criticality of human factors in network
resilience and security.
In the area of NIS technologies, Hideaki
Kobayashi and his co-authors from the IPA
Information Technology Agency, Japan,
present a number of challenges as well as
the measures which could be taken to
create more secure embedded systems,
while Marian Jungbauer and Norbert
Pohlmann discuss trusted Network Access
Control in the context of Trusted
Computing (see also the EQR Special Issue
on Trusted Computing –
www.enisa.europa.eu/publications/eqr/iss
ues/eqr-q3-2007-vol.-3-no.-3).
Finally, may I take this opportunity to tell
you that ENISA has recently launched a
new website at www.enisa.europa.eu, with
much improved structure and functionality.
I would encourage you all to visit it.
We are always happy to hear your
suggestions and comments on how to
improve EQR. Please continue sending us
feedback and, of course, your articles.
Enjoy reading.
Dr. Panagiotis Trimintzios is an Expert at
ENISA responsible for Relations with
Stakeholders.
20-21 October
SECURE is the oldest IT security
conference in Poland. Every year it
considers current issues concerning
the security of IT systems and
networks. The conference is aimed at
senior managers, technical experts
and policy- and decision-makers with
overall responsibility for security.
The main topic this year will be
responsible Internet traffic filtering
related to the most dangerous
Internet threats, as well as blocking
illegal Internet content resources.
The conference celebrations will be
held under the honorary patronage of
Prof. Barbara Kudrycka, Minister of
Science and Higher Education, and
Grzegorz Schetyna, Deputy Prime
Minister and Minister of Internal
Affairs and Administration.
SECURE 2009 is organised by the
CERT Polska team, acting within
NASK, and is a joint event supported
by ENISA. It takes place in Warsaw,
Poland.
More information:
http://secure.edu.pl/en/index.html

RESILIENCE AND INFORMATION SHARING
A Resilient and Secure Internet Infrastructure
Challenges for the future
Anne-Marie Eklund Löwinder
The Internet was beautifully designed for
speed and growth. The infrastructure is
certainly working today as envisaged by
that yardstick. However, the Internet
continues to be vulnerable to various
problems with security and robustness.
Basic attributes in communications and
networking equipment
Users need communications and
networking equipment with the following
attributes:
• Secure: Antivirus software running on all
gateways, email servers and desktops,
serving all workers worldwide, is not
enough. A full scheme information security
management system is also needed to be
ready to face attacks and to improve
dealings with internal and external
customers.
• Dynamic: The ability to move workloads
in an information system intelligently,
automatically and securely, anytime,
anywhere. Whether for purposes of
migration, enhancing performance,
building co-location facilities or even cloud
computing, workloads should be moved
with inherent security and data protection.
• Robust: Implies dedicated resources and
well known techniques.
• Reliable: The easiest way of putting it is
‘always available’. Nevertheless, even a
reliable infrastructure sometimes fails.
The recent celebrity deaths caused
massive spikes in traffic to several sites
and some of the sites could not handle the
ENISA Quarterly Review Vol. 5, No. 3, September 2009
4
load and broke down. However, this is only
a small part of what it means to be
reliable.
Domain Name System – the cornerstone
of the Internet
One of the cornerstones of a reliable
Internet infrastructure is the Domain
Name System (DNS). The DNS keeps track
of the mapping of, for example, a human
readable name of a website (such as
www.iis.se) to the slightly more arcane
form of a numerical IP address that the
computer needs to initiate communication.
The DNS consists of a set of servers
dedicated to routing users to requested
resources on the Internet. It helps users
find their way to specific websites when
browsing the Internet, and ensures that
emails arrive at their intended destination.
A stable DNS is vital for most companies to
maintain a working and efficient operation.
If a company’s external domain name
servers become unavailable, no-one will
be able to reach its site nor will email get
through, resulting in lost productivity and
customer dissatisfaction. Investing in a
reliable DNS infrastructure is therefore a
valuable insurance policy against
downtime and forgery.
Although it is admirable that the design of
the DNS worked so well with the growth of
the Internet, its original inventors did not
take security issues as seriously as is
required today. The DNS is still far from
secure.
• Attacks against the name server
software may allow an intruder to
compromise the server and gain control
of the host. This often leads to further
compromise of the network.
• A Distributed Denial of Service (DDoS)
attack, even one directed at a single DNS
server, may affect an entire network by
preventing users from translating host
names into IP addresses.
• Spoofing attacks that try to induce a
name server to cache false data could
lead unsuspecting users to undesirable
sites.
• Information leakage from a seemingly
innocent transfer of DNS data could
expose internal network topology
information that can be used to plan
further attacks.
• A name server could even be an
unwitting participant in attacks on other
sites.
There are numerous known vulnerabilities
and there is no doubt that all users of
applications and services on the Internet
rely heavily on the Domain Name System
to work properly. That is the main reason
why Sweden has been a leading proponent
and an early adopter of a more secure
DNS, or in short DNSSEC. Discussions are
underway in various quarters to improve
the overall security of the Internet’s
infrastructure and its ability to withstand
different types of attacks. Apart from
DNSSEC, there are other – maybe less
obvious – critical measures under
consideration to enhance the security in
DNS as well as the routing infrastructure.
Major threats to the Internet
One of the major threats to the Internet
infrastructure is the DDoS attack. There is
currently no technology to deal with this
problem and the recommendation is
general vigilance and administrative
measures to minimise their potentially
devastating impact. DDoS attacks are not
specifically a problem for the DNS, but a
danger for all core Internet services (as a
whole). Countermeasures are only
effective if they are taken by a group of
networks at large; individually there is not
much that can be done against large-scale
attacks. DDoS mitigation is an active
research field and academic solutions
have been developed. However, it might
take a while until they reach the
operational world. Until then we simply
have to survive.
The issue of DNS amplification attacks has
showed its ugly face again in recent
months though the problem itself has been
known for several years. Unfortunately, the
millions of open resolvers present on the
Internet have made it easy for miscreants
to create large-scale DDoS attacks using a
relatively small amount of resources, thus
crippling their targets easily.
Another area is the deployment of IPv6.
There are some expectations that IPv6 will
not only extend the address space, now
when we are running out of IPv4
addresses, but that it will also help to
make the Internet more secure. It is
important to realise that IPv6 is not the
overall solution for the Gordian knot of
Internet security, and it will certainly bring
its own security challenges during the
transition phase, which could last from
10-15 years. On the other hand, IPv6 will
enable some new applications, including
>>
 5

RESILIENCE AND INFORMATION SHARING

physical security, since millions of

networked sensors will be able to have
their own IP addresses.
Information security needs a more
straightforward approach
Regulations are not the answer. The
existing regulatory framework is sufficient
for open market operation, and further
regulations are not required.
However, there may be some need for
additional action in terms of:
• Recommendations for the introduction
of DNSSEC
• Recommendations for the deployment of
IPv6
• Recommendations for and best practice
of robust and resilient network design.
Our current methods for securing systems
are not working well. We must find a better
way to secure our computing systems and
digital networks. One aspect we need to
push is ‘practical security’. We need to
solve our policy and technology problems
for sharing and protecting information in
practical – if not necessarily 100% perfect
– ways.
A fair amount of the technology developed
during the last decade is neither practical,
nor reliable, nor scalable. A very good – or
bad, if you want – example that comes to
my mind is the Public Key Infrastructure,
PKI, which we have tried so hard to make
work for more than ten years. A PKI is
difficult to implement and does not scale
well, but it has perfect mathematical
functions. Any number of proofs exist to
show that it works perfectly – on paper.
Due to its complexity, poor business model
and demands for a completely separate
infrastructure, its use has never become
widespread so it has never achieved its
potential as a means of secure
identification of users in the signing of
documents.
unsigned zones
OpenDNSSEC
automatic zone signing
from hidden
authoritative
name servers
reliable security solutions now, because
otherwise they will use whatever they have
to get the job done. Which is what they are
starting to do already.
Tools and software to support the
progressive work
At .SE we provide Internet users with
different tools and software to help them
recognise and understand how their
communication with the Internet works,
for example, Bredbandskollen
(www.bredbandskollen.se), Kaminskytest
(www.thekaminskybug.se/), DNSCheck
(http://dnscheck.iis.se/). We run an annual
health check on important parts of the
Swedish information infrastructure to
obtain an up to date picture of the current
status. Facts are needed to identify
problems, and to decide on which
countermeasures are required.
The latest contribution to this campaign is
OpenDNSSEC (www.opendnssec.org/).
OpenDNSSEC was created as an open-
source turn-key solution for DNSSEC and
automatic zone signing. It secures zone
data just before it is published in an
authoritative name server. It is the result of
a collaboration between .SE, Nominet,
NLNet Labs, SIDN, SURFnet, Kirei and
John Dickinson.
signed zones
to public,
authoritative
name servers
Standardisation will bring a more secure
Internet
.SE hosted the 75th meeting of the Internet
Engineering Task Force (IETF) in
Stockholm in July, with about 1200
participants. The IETF is the Internet’s
premier standards-making body,
responsible for the development of
protocols used in IP-based networks.
Participants at the IETF represent an
international community of network
designers, operators, vendors and
researchers involved in the technical
operation of the Internet and the
continuing evolution of Internet
architecture. It has become an important
body for standardisation, with its broad
co-operation between representatives
from all over the world and its basic belief
in ‘rough consensus and running code’. It
is not only a good idea – but essential – for
EU Member States to be more dedicated
and put more resources into the ongoing
standardisation process within the IETF.
Ultimately that will lead to a more resilient
and secure Internet infrastructure in the
future.
Anne-Marie Eklund Löwinder (anne-
marie.eklund-lowinder@iis.se) is the
Quality & Security Manager at .SE in
Sweden.

We also seem to have a fixation on the Holy

Grail of computer security – having a true
multilevel secure system. Of course that
would be ideal, but we have been at it for
twenty years and have not got it right yet.
Perhaps we should just carry on solving
those problems we can solve.
What we need is good security now, not
perfect security ten years from now.
Customers are tired of waiting and tired of
the promises that yet another piece of
software or another kind of hardware will
solve their problems. We need to give them
Insightful. Engaging. Interactive. In information security, you’re trained to expect the
unexpected. Changes occur in a nanosecond. Stay on top by staying one step ahead –
attend RSA® Conference Europe 2009!
Join us for the most comprehensive forum in information security. Come and learn
about the latest trends and technologies, get access to new best practices and gain
insight into the practical and pragmatic perspectives on the most critical business
issues facing you today. Connect and collaborate. Build your professional network.
And mingle with the industry’s brightest and best.
RSA 2009 is a joint event supported by ENISA and will take place in London, UK.
More information: www.rsaconference.com/2009/europe/index.htm

ENISA Quarterly Review Vol. 5, No. 3, September 2009


RESILIENCE AND INFORMATION SHARING
Occasional Curiosity or Regular Routine?
Evaluating the reliability of the Internet infrastructure
Natalija Gelvanovska and Rytis Rainys
With the growing significance of the Internet
in society, the increase of Network and
Information Security incidents and the
cyber-attacks on Estonia, Georgia and
Lithuania in recent years, it is clear that
exceptional attention is needed to ensure the
protection of the Internet infrastructure and
the reliability of its operation.
Internet Service Providers (ISPs) usually
become providers of public electronic
communications services. From the
regulatory perspective, because they
transfer all kinds of residential traffic,
infrastructure operated by ISPs has become
particularly relevant. Therefore aspects such
as interconnection between ISPs reasonably
deserve regulatory attention. These
circumstances led to the commissioning of a
special survey, named “Evaluation of the
Reliability of Lithuania’s Internet
Infrastructure”, which was performed by the
Communications Regulatory Authority of the
Republic of Lithuania (RRT) in 2008.
The main objective of the survey was to
evaluate the reliability of Lithuania’s Internet
infrastructure operation and to identify
potential risks. For this purpose the
following tasks were defined:
• to identify critical nodes in Lithuania, a
violation of which could affect the
functionality of the Internet
• to set up a scheme showing Lithuania’s
interconnections, to identify the directions
taken through the international gateway,
the total bandwidth used and the speed
• to evaluate Lithuania’s Internet
infrastructure and the vulnerability of its
individual elements.
Lack of transparency
During the evaluation of the reliability of
interconnection nodes, it became apparent
that the terms of connection to Internet
Exchange Points (IXP) are not sufficiently
transparent in Lithuania; RRT identified that
they are not publicly available but that this
could help enhance the interconnection
between ISPs and thus the reliability of the
ENISA Quarterly Review Vol. 5, No. 3, September 2009
6
national Internet infrastructure.
RRT also noted that transparency
of connection to the IXPs also
helps prevent the redirection of
national traffic through
international ISPs, since IXPs
allow direct channels of data
transmission traffic to be formed
among the Lithuanian ISPs. This
provides an opportunity to reduce
costs for international transit
services and improves the quality
and speed of the Internet
connection – factors which are of particular
importance to end-users.
RRT recommends that the Lithuanian IXP
operators should increase the transparency
of their terms of interconnection.
Could national interconnection be
affected?
RRT identified five major IXP nodes in
Lithuania where the major ISPs are
interconnected. The number of IXPs should
be as high as possible in a country, so as to
form a distributed system of international
connections. This is already the case in
Lithuania; problems with one or even several
points of interconnection would not vastly
affect the interconnection of other points or
the Internet operation of the country.
RRT pointed out that the operation of the
Internet in Lithuania could potentially be
affected by de-peering (disconnection) for
economic reasons. However, closing the
existing connections between ISPs is usually
a manifestation of anti-competitive conduct.
RRT recognised that such behaviour may be
treated as a potential threat. So far RRT has
no information whether this could have
affected the operation of the Internet
network in Lithuania.
RRT draws the attention of ISPs to the fact
that ceasing network interconnection would
directly influence not only the operation of
Lithuania’s Internet, but would also affect
the quality of Internet service provided to
end-users. In the future it will be closely
monitored whether network
interconnections between ISPs in Lithuania
are being ceased for the reasons discussed
above.
International gateways
By evaluating the bandwidth of the
international Internet in Lithuania, it was
determined that the total volume of
Lithuania’s Internet international traffic was
about 66.1 Gbps at the end of 2008. In case of
emergency, this bandwidth may be
insufficient to cope with a large number of
security attacks.
Following its investigations into connections
to international gateways, RRT concluded
that the reliability of international Internet
connectivity in Lithuania depends, in effect,
on just one international gateway operated
by one of the ISPs. Consequently the
reliability of Internet operation relies on a
single ISP’s ability to ensure alternative
channels quickly in an emergency and to
organise the redirection of data flow, the
control of stream priorities, address
blocking etc.
RRT suggests setting procedures in place to
ensure the rapid and efficient organisation
of the redirection of data traffic, the control
of stream priorities and address blocking.
The procedure would be binding at the
national level and should be co-ordinated
with the ISP.
Other areas investigated included the
operation of the Domain Name System
(DNS). To make the operation of Lithuania’s
Internet infrastructure and the continuation
of its activities safer and more reliable, in the
near future RRT will assess the risks posed
by, for example, the energy sector, servers
and software, which could influence the
operation of public electronic
communications infrastructures. As part of
the research, consultations will be held with
the Lithuanian ISPs and experts of the EU
Member States experienced in similar
research.
In 2010, RRT hopes to organise an exercise
at the national level, which would involve
large ISPs and institutions dealing with
network and information security issues.
Training would be aimed at assessing
Lithuania’s readiness to repulse large-scale
security attacks. More targeted tasks for
RRT over the next few years include
preparation of a national Internet
infrastructure critical nodes monitoring
system.
More information is available at: www.rrt.lt
and www.cert.lt/en.
Natalija Gelvanovska (ngelvanovska@rrt.lt) is
the Head of the Networks and Access
Division of the Communications Regulatory
Authority of the Republic of Lithuania.
Rytis Rainys (rrainys@rrt.lt) is the Head of
the Network and Information Security
Division of the Communications Regulatory
Authority of the Republic of Lithuania and a
member of ENISA’s Network of National
Liaison Officers,

RESILIENCE AND INFORMATION SHARING
Three European ‘Trusted Information Sharing’ Projects
John Harrison and Andrea Rigoni
All organisations rely on Information and
Communications Technologies (ICT)
infrastructures to deliver core and critical
services. The risks under which these
infrastructures operate change so quickly
that a new Dynamic Risk Management
approach is required.
Information Sharing can help both individual
organisations and national bodies to keep up
to date with the latest situation and to define
proactively the correct countermeasures.
Despite a common acknowledgment of the
importance of Information Sharing, many
initiatives have failed and many
organisations are still wary of the idea. This
may be because previous initiatives have
tried to do too much too quickly, whereas an
evolutionary approach would provide more
opportunities for organisations to compare
risks with benefits before choosing to take
part.
Information Sharing should respect the
complicated lattice of relationships and
connections among Critical Infrastructures,
national Governments, sector-based or
Government Computer Emergency
Response Teams (CERTs), the European
Commission, Associations etc. This complex
system of interactions has both a peer-to-
peer and hierarchical nature.
Information Sharing will not work without
trust. Those providing information must be
able to trust the recipients not to disclose or
to act upon the data inappropriately. The
recipient needs to trust that any information
received is validated to provide some level of
confidence as to its accuracy. In this article
we are concerned only with trusted
Information Sharing projects.
NEISAS – A National and European
Information Sharing & Alerting System
NEISAS is a new European Commission (EC)
funded project, which some are calling
‘WARPs across Europe’ (WARPs – Warning,
Advice and Reporting Points, a trusted
ENISA Quarterly Review Vol. 5, No. 3, September 2009
7
Information Sharing model scni.jrc.it/03-projects/05-SecNet-IE/index).
developed by the Centre for the This is being investigated.
Protection of National
NEISAS will develop a model and a prototype
Infrastructure (CPNI) in the
that respects the complex nature of trusted
UK, www.warp.gov.uk). NEISAS
relationships in the Critical Infrastructures
proposes a peer-to-peer
and Government sectors within Member
model for trusted sharing
States. The model will be flexible enough to
between countries where the accommodate the requirements of vertical
source organisation retains sectors and national governments, and will
ownership of the information it adopt an evolutionary approach that will help
shares and decides who to the organisations involved to build a trusted
share it with and at what level. relationship.
The earlier EC funded project The project has two main distinct focuses:
to create a Critical Infrastructure Warning • Definition of a National Information
Information Network, CIWIN, proposed a Sharing and Alerting Model and System
centralised European system; with NEISAS • Definition of a European Information
the information is stored instead on national Sharing and Alerting Model and System,
or organisation-specific systems, hence the conceived as a European Network of
name ‘National and European Information National Information Sharing and Alerting
Sharing and Alerting System’. This degree of Systems.
ownership and control was not part of the
The project has three main deliverables:
CIWIN requirement but to many it is very
• Develop a NEISAS European Framework:
important, as the level of trust between
this will also help all Member States to
countries differs.
implement a national system or, if they
In addition, NEISAS builds on MS3i, another already have one, to connect it to other
EC funded project, which proposes an Member States in a trusted way.
international standard for trusted sharing • Develop a NEISAS prototype: the project
(see below). The aim is to make NEISAS will develop a software platform that can
compliant with this emerging standard, support NEISAS. This will be piloted in
thereby making future NEISAS deployments three Member States (Italy, the
easier – the NEISAS prototype will only be Netherlands and the UK) and the results
trialled in three countries. disseminated.
• Develop a sustainable business model:
The project is starting with a requirements through the creation of an independent
capture and analysis phase, which includes body, to make NEISAS available to all
the evaluation of existing schemes such as Member States.
CIWIN and individual EU Member State
initiatives. Related work is being undertaken The NEISAS project will run for two years,
at the EC Joint Research Centre (JRC) in delivering in early 2011. The results of the
SecNet-IE, a project for a Platform for project will be disseminated through a web
Information Exchange on the Security of portal, a dedicated event and other relevant
Critical Networked Infrastructures (http:// events throughout Europe.
>>
I Encuentro Nacional
de la Industria de la
22-24
Seguridad en España October
ENISE 3 (National Meeting of Security Industry in Spain) is an annual event with a dual
aim: on one hand, the exchange of knowledge and analysis of the security sector; on the
other, the sharing of knowledge among different stakeholders in the sector.
For this third meeting the principal topic will be technological innovation in the
information security area.
The event is organised by INTECO (the National Institute for Telecommunications
Technologies), which is part of the Spanish Ministry of Industry, Tourism and Trade. This
is a joint event supported by ENISA and takes place in León, Spain.
For more information: https://enise.inteco.es/en

RESILIENCE AND INFORMATION SHARING
MS3i – Messaging Standard for Sharing
Security Information
MS3i is an EC funded project which had its
completion workshop in June 2009. The
project reports are available for download at
https://www.ms3i.eu/ms3i/final-reports.html.
In 2004 the European Commission issued a
communication to the Council and the
European Parliament on “Critical
Infrastructure Protection in the fight against
terrorism (20-10-2004)”. This document
stated that the European Programme for
Critical Infrastructure Protection (EPCIP)
would promote information exchange
(sharing) where the constraints of
competition, liability and information
sensitivity could be balanced with the
benefits of a more secure critical
infrastructure. Where sector-based
standards do not exist or where international
standards have not yet been established to
support this sharing, standardisation
organisations should be approached with
proposals to create harmonised security
standards for all the various branches and
sectors involved.
Although there are a number of international
bodies producing ICT security standards, the
most relevant is ISO/IEC JTC 1/SC 27,
particularly in relation to its new standard,
ISO/IEC 27010, “Information security
management for inter-sector
communications”.
The MS3i project conducted in-depth
interviews with stakeholders in four
European countries to capture requirements
for a management standard on trusted
Information Sharing. These requirements
were incorporated into data and proposals to
back up technical submissions to ISO SC27
WG1 Project 27010.
Clearly it is important to agree a scope for
the standard which meets the market
requirements and this work has been
started by ISO/IEC; the working draft is
available for download at www.ms3i.eu.
The relevant Standards Committee, ISO/IEC
JTC 1/SC 27, Security techniques, is actively
soliciting views on the proposed standard.
Contact your National Standards Body to
make your views known. A list of
participating standards bodies is available at
www.ms3i.eu.
ENISA Good Practice Guide on Network
Information Security Exchanges (NSIEs)
This project involves the development of an
ENISA Guide, based on observed good
practice in different countries, which
describes the Network Security Information
Exchange model. The draft Guide was first
ENISA Quarterly Review Vol. 5, No. 2, June 2009
8
Relationship between ‘Users’ and three European ‘trusted Information Sharing’ projects
presented at a workshop in Lisbon in May
2009 before being opened for wider
consultation.
This project shares the same high level aims
as NEISAS and MS3i by supporting trusted
Information Sharing. Many readers of this
Guide would also benefit from a standard in
trusted Information Sharing and should
therefore be encouraged to take an active
part in the development of ISO/IEC 27010.
The scope of this Guide deals with the
setting up and running of a Public/Private
Partnership between national stakeholders
involved in Critical Information
Infrastructure Protection (CIIP).
The scope of the partnership would be
limited to addressing the resilience of
eCommunication networks that carry voice
and data services over the fixed and mobile
(wireless) infrastructure in both the public
and private circuit domains. The partnership
would work by exchanging information on
security incidents, vulnerabilities, threats
and solutions in a trusted environment to
ensure that barriers to sharing are
minimised. The focus of this exchange is
mostly to address malicious cyber-attacks,
but also natural disasters or physical
attacks. The drivers are the benefits of
members working together on common
problems and gaining access to information
which is not available from any other source,
namely competitors and national security
agencies.
A clear distinction is drawn between a
CERT/CSIRT and an NSIE; a CERT/CSIRT
deals with emergencies, while a NSIE tries
to prevent them.
Two key critical success factors for NSIEs
are:
• Building trust between the members of the
Public/Private Partnership
• That the information exchanged should be
relevant and not easily available
elsewhere.
There are many more examples of good
practice described in the ENISA Guide. The
final version is available for download at:
www.enisa.europa.eu/act/res/policies/good-
practices-1/information-sharing-exchange/
information-sharing-exchange.
Summary
This article describes three trusted
Information Sharing projects, their
relationships in terms of sharing user
requirements and how they all aim to provide
support to the same community of trusted
Information Sharing users.
The diagram above summarises how good
practice and requirements from existing and
potential trusted Information Sharing
communities, shown in blue, are fed into the
three European ‘trusted Information Sharing
projects’, shown in green. As the NEISAS
project is just starting, it has the opportunity
to take the outputs from the other two
projects so that all three will support the
same trusted Information Sharing user
community with a consistent and
complementary approach. Although ISO/IEC
27010 development, shown in pink, is shown
closely allied to MS3i, all three projects have
an opportunity to influence this important
standard.
John Harrison (johnh@landitd.com) is the
Director and Principal Consultant at the
cluster consultancy LanditD.
Andrea Rigoni (andrea.rigoni@ne.booz.com)
is a Senior Advisor in Booz & Company and
provides independent consultancy to
national governments, European
Institutions, NATO and European Critical
Infrastructures on Cyber Security.

CRITICAL INFORMATION INFRASTRUCTURE PROTECTION
Public-Private Partnership for CIIP – Case Finland
Hannu Sivonen
Security of supply
In Finland Critical Information
Infrastructure Protection (CIIP) is seen
within the larger context of security of
supply. In Finnish legislation, security of
supply is defined as the security of the
livelihood of the population, the continuity
of vital economic activity and the
functioning of the infrastructure in normal
conditions, during serious disturbances
and exceptional circumstances. The
markets usually provide security of supply,
but special arrangements are sometimes
needed.
Public-Private Partnership
A Public-Private Partnership (PPP) for the
security of supply in Finland was started in
1955. Right from the outset the principle
has been to gather together around the
same table the representatives of state
administration and the companies that
provide vital products and services to
society. The companies come voluntarily,
and are equal partners with the
administration. They have a common
interest: to make sure that the flow of
goods and services continues without
interruption through serious disturbances
such as a heavy storm, epidemic or
commercial conflict, but also nowadays
through cyber-attacks and, in extreme
cases, an armed conflict.
The partnership organisation has grown
since 1955 and has been modernised. The
organisation and the issues to be
considered have followed the development
of the economy and technology. Both the
legal framework for security of supply and
ENISA Quarterly Review Vol. 5, No. 2, June 2009
9
Government decision on the targets of security of supply (539/12.8.2008)
Based on: International markets, national actions and resources,
bi - and multilateral agreements on preparedness
Safeguarding the critical
infrastructure of society
• Energy transmission and
distribution networks
• Electronic information and
communication systems
• Transport logistics systems
• Water supply and other
urban technology
• Construction and maintenance
of the infrastructure
The targets of security of supply
the partnership have been updated several
times, most recently in 2008.
Critical infrastructure vs. critical
production
Today, the security of supply is divided into
two areas: security of critical
infrastructure and security of critical
production.
An important part of critical infrastructure
is the critical information infrastructure, in
other words, electronic information and
communication systems, which include
data networks and systems, mass
communication and financial systems.
Tools for securing the supply
In order to secure supply, there are several
tools available to the Government and the
industrial actors; international
agreements, legislation and possible
regulation provide the framework for
security of supply, and thus for CIIP and,
more generally, for Critical Infrastructure
Protection (CIP). The Government’s
economic and industrial policy takes into
consideration the requirements of security
of supply. A vital tool is the partnership
organisation.
A network of leading experts
Securing supply in Finland has been
organised as a comprehensive
co-operative network, the National
Emergency Supply Organisation. The
participants are the various sectors of the
public administration and business, as
well as branch organisations. The network
of committees consists of more than 1000
leading experts.
Safeguarding the critical
production of society
• Food supply
• Energy production
• Health care
• Production that supports
national defence
• Supporting general
operational conditions of
the export industry
The partnership organisation exchanges
information within sectors and across
sectors, monitors the business
environment and threats to it, supports
individual business continuity
management, arranges exercises and
carries out surveys, research and
development projects with the help of
consultants and academia.
The PPP organisation
The National Emergency Supply
Organisation (NESO) consists of a strategic
level Council for Security of Supply and
Infrastructure (CSSI), a planning
committee network (Clusters and Pools)
and an executive National Emergency
Supply Agency (NESA) under the Ministry
of Employment and the Economy. There
are six NESO Clusters and 24 Pools. Their
tasks are to analyse threats against the
country’s security of supply, including the
ICT infrastructure, to plan measures to
control these threats, and to promote
continuity planning in individual industrial
sites. The Pools have 2000 member
enterprises.
Funding the partnership and protection
measures
NESA manages the National Emergency
Supply Fund which is outside the state
budget. The PPP members are not paid for
their time, but NESA finances the
exercises and the permanent secretaries
of the Pools.
The NESA Fund also finances stockpiles
for oil and medical products, as well as
selected redundancy and protection
measures for the critical information
infrastructure.
>>
 10

CRITICAL INFORMATION INFRASTRUCTURE PROTECTION

have been prepared through co-operation

Council for
Security of within the partnership organisation. High
Supply and maturity level descriptions also describe
Infrastructure
Information Society Cluster best practices, and thus represent
Electronics Pool guidelines for performance improvement.
Printing Industry Pool
Prioritised
Communications Networks Pool Prioritised
Information Technology Pool Enterprises Agreement based preparedness
Enterprises Mass Communications Pool
An example of recent development in the
Food Supply Cluster PPP organisation is the agreement model
Health Cluster
Agricultural Pool
Public Health Pool for securing business continuity among
Food industry Pool
Retail and Distribution Pool
Water Supply Pool subcontractors and business partners. The
National Emergency agreements are based on minimum level
Transport and Logistics Cluster
Energy Cluster
Supply Agency Air Transport Pool
3-maturity. The model can be added as an
Power and District Heat Pool Surface Transport Pool attachment to existing agreements. There
- Regional Commissions - Regional Commissions
Oil and Gas Pool Maritime Transport Pool
are no formal sanctions, but a mutual
Industry follow-up is defined which encourages the
Prioritised
Chemical Industry Pool
Prioritised parties involved to strive towards good
Technology Pool
Enterprises Forest Industry Pool Enterprises maturity levels in their business continuity.
Plastic and Rubber Industry Pool The model is currently being implemented
Construction Pool: Regional Commissions
Textile Industry Pool
in the ICT field and will be implemented
Finance Pool
Finance cluster next in other areas of business.
Insurance Pool
Finance Pool
Insurance Pool
Hannu Sivonen (hannu.sivonen@nesa.fi) is
The PPP organisation – Organisation of security of supply a Research Manager in the Finnish
National Emergency Supply Agency.

Legal framework for CIIP
An important part of the legal framework
for CIIP is the Communications Market
Act, which obliges communications
operators to ensure the functioning of their
services at all times, including in
exceptional situations and in times of
crisis. The act gives the
telecommunications operators a right of
compensation from the NESA fund if the
expenses incurred through such
preparatory measures are significant, or if
the measures have been ordered by the
Ministry of Transport and
Communications.
Similar legal obligations do not exist for IT
systems services, but NESA finances
selected protection measures.
CERT-FI in co-operation with CI
enterprises
CERT-FI is the Finnish national Computer
Emergency Response Team. It is a part of
the Finnish Communications Regulatory
Authority (FICORA) under the Ministry of
Transport and Communications. CERT-FI
promotes security in the information
society by preventing, observing and
solving information security incidents, and
disseminating information on threats to
information security.
CERT-FI also provides a special service for
critical infrastructure actors. This includes
24/7 incident warning and solving, via SMS
and the VIRVE/TETRA public authority
mobile telephone network, personal
advising and focused product vulnerability
warnings.
PPP portal
NESA will be launching a secure
partnership system portal early in 2010.
The portal will be a forum for information
exchange among the partners. It will
include a self-assessment tool to check
the maturity of business continuity
management in each organisation.
National maturity reports will be available
for each industrial sector, although the
assessments of individual companies will
be kept confidential. The reporting will also
provide benchmarking for the individual
partners.
The 5-level maturity model used is taken
from the Capability Maturity Model
Integrated (CMMI) developed by the
Software Engineering Institute at Carnegie
Mellon University. The 5-level maturity
description set covers numerous items
ranging from strategic management,
personnel management and ICT
management to sector-specific process
continuity management. The descriptions
19-20 November
Infosek 2009 is a two-day conference
held jointly in co-operation with
ENISA. Traditionally organised at the
end of November in Nova Gorica,
Slovenia, INFOSEK is recognised as a
unique expert conference and a key
Slovenian event. It serves as an ideal
learning opportunity for all involved in
information security, enabling them
to keep up with the fast-paced
environment of facilities security,
information protection, privacy and
regulatory compliance.
Led by security experts from a variety
of industries from Slovenia and
abroad, INFOSEK 2009 offers insight
into the importance of information
security to an organisation’s success
and indeed survival.
More information: www.infosek.net/

ENISA Quarterly Review Vol. 5, No. 3, September 2009


CRITICAL INFORMATION INFRASTRUCTURE PROTECTION
Interdependency between Energy and Telecommunications
David Sutton
Ask anybody involved in Information
Security what it is all about and you will
probably receive a variety of answers,
based around confidentiality, integrity and
availability, with a dash of compliance,
authentication and non-repudiation thrown
in for good measure.
However, Information Security is all about
the management of information risk, and
any analysis of Information Security issues
must be built around a risk assessment
process – beginning with an understanding
of the services under consideration, an
analysis of the threats they may face, their
vulnerabilities, the impact of those threats
on the services and an understanding of
the likelihood of occurrence. It is only as a
result of this risk assessment that we can
identify the priorities and develop
appropriate responses.
One of the most serious threats to any
Information and Communication
Technologies (ICT) service is the
unavailability of the electricity supply to the
underlying infrastructure, especially to
public fixed and mobile
telecommunications and to wired and
wireless Broadband services.
In most EU countries, the generation,
transmission and distribution of electricity
is robust – meaning that medium to longer
term interruptions to power are relatively
infrequent so, while the impact of such
interruptions may be significant, the low
likelihood reduces the overall risk.
Where short-term outages are concerned,
however, it is a different matter.
ENISA Quarterly Review Vol. 5, No. 3, September 2009
11
Interruptions lasting from tens of
milliseconds to tens of minutes are more
commonplace and, although the impact of
these may be less, the overall risk is much
greater due to the increased likelihood.
Short-term outages can be tolerated by
ICT networks – a voice call can be
re-established on resumption of power,
and data networks can correct for loss of
data packets at the Transmission Control
Protocol (TCP) layer or within the
application.
Medium to long-term interruptions are
more difficult to tolerate, especially in
so-called ‘mission critical’ services in
which the continuous exchange of
information is fundamental to the service
and failure could result in serious
consequences.
In ICT networks, the threat of unavailability
of power takes place at three different
levels in the service model – firstly in the
core network, the main switching hub of all
voice and data services; secondly in the
access network, the intermediate level
between the core network and the
customer; and thirdly in the customer’s
network.
Core network level
Core networks tend to serve large
numbers of customers and, because the
failure of electricity supply at such a
location would result in an extremely high
impact, the provision of suitable standby
power is straightforward to cost-justify.
Communications Service Providers (CSPs)
have long understood the need for fully
resilient Uninterruptable Power Systems
(UPS) equipped with short-term batteries
and longer term standby generation, and
they ensure that such systems are in place
and are regularly maintained and tested.
Access level
Equipment at the access level can be less
resilient to longer power interruptions and,
while short-term interruptions can be
addressed by battery backup solutions, the
option of standby generation is generally
costly to deploy across an entire network –
even assuming that space, planning and
security considerations make it a viable
solution.
It is at the access level that the greatest
challenges arise. While the equipment at
this level may be the responsibility of the
CSPs – either individually or jointly, the
environment in which the equipment is
located may be completely outside their
control.
This lack of control brings about three
main issues:
• the physical security of the location may
render the equipment susceptible to
accidental damage, vandalism or theft
• local planning regulations may preclude
the expansion of facilities
• the size of a network may make the
overall cost of standby generation
unacceptable in terms of return on
investment.
Street furniture may contain cable
television and broadband equipment, and
may act as a transfer point for ‘Fibre To
The Cabinet’ (FTTC) technology providing
data and Voice over Internet Protocol (VoIP)
services. These and mobile base stations
may contain a limited duration standby
battery capability which addresses the
short-term interruptions, but in longer
interruptions this source of standby power
will eventually discharge and service will
be lost.
While it is this intermediate level which
presents the greatest challenges, it also
demands the most innovative solutions.
These include:
• Solar or wind-powered generation
equipment which may require less
physical space than conventional
standby generation technology and may
present fewer planning difficulties.
However, this option is only viable in the
correct climatic conditions.
• Standby generators powered by Liquid
Propane Gas (LPG), which have a more
carbon-friendly appeal, are less noisy
and less likely to attract theft of fuel
than diesel generators
• Cross-organisational projects where, for
example, an electricity generation,
transmission or distribution company
might provide either a free or reduced-
cost protected supply to a CSP on some
form of ‘quid pro quo’ basis
• ‘Femtocell’ technology, in which a small
mobile base station is connected into
the CSP’s core network using
Broadband, which might serve a single
location.
None of these is a ‘silver bullet’ solution
and, in practice, the best option may be a
combination used as appropriate while
recognising that even those solutions will
not guarantee 100% availability.
>>
 12

CRITICAL INFORMATION INFRASTRUCTURE PROTECTION

Funding of any solutions will remain a key
issue. If motivation and finance were
available at an EU or Member State level,
funding could be found to provide standby
power for locations which are deemed to
be of importance to the Critical National
Infrastructure, and this could be either in
the form of capital or operational funding,
possibly both.
Customer premises level
Power resilience at the customer premises
level will always be the responsibility of the
customer and not the CSP or the national
government. In cases of shared
accommodation, provision of resilient
power for both mobile phone or WiFi
service would rest with the landlord who
might offer this to tenants who would have
the final choice in whether or not to invest
in this.
Energy networks
On the other side of the coin, the energy
industry itself also makes considerable
use of electronic communications in three
areas:
• the transmission of energy network
status information from network
components and locations back to
regional and national monitoring and
control centres
• the transmission of commands to alter
the configuration of key network
components in the reverse direction
• the exchange of information, requests or
instructions between those centres and
the operational staff who may either
have to report on network component
status or carry out physical
configuration changes in cases where
other methods cannot be used.
energy industry’s confidence in the
resilience of its electronic communications
infrastructure can be maintained.
Conclusions
Many domestic and commercial
customers take the basic fixed line
telephone service for granted and, as long
as power can be supplied to the core
network and the local serving exchange,
service will continue to be delivered to the
customer premises. But the telephone
handset will only continue to function if it
takes power from the telephone line rather
than from the local electricity supply. More
needs to be done in educating customers
in the constraints of energy supply with
respect to ICT in domestic and commercial
premises.
While responsibility for the provision of the
power resilience of core networks rests
with the CSPs and that for the customer
premises rests with the customer, the
middle ground is where both challenge and
opportunity lie.
There needs to be closer co-operation
between the energy and electronic
communications industries to ensure the
continued resilience of both types of
infrastructure at key installations.
In July 2009, the UK’s Institute for Public
Policy Research published a document
entitled ‘Shared Responsibilities’ in which
it speaks of investment by the energy
industry in helping to resolve the problem,
but it is clear that this will not work in
isolation – solutions must be through joint
working relationships between the EU,
Member State governments, the energy
industry and CSPs and their respective
regulators, which will provide for cost-
effective solutions for all concerned, using
alternative technologies and innovative
approaches where appropriate.
A first step in this is already underway in
the form of a project managed by the
Italian National Agency for New
Technologies, Energy and the Environment
(ENEA) and entitled ‘The Methodology for
Interdependencies Assessment’ (MIA). The
ultimate goal of this will be to provide both
the energy and electronic communications
industries with a methodology and metrics
to determine interdependencies in their
networks.
The real challenges will come later, as the
focus turns to the identification of practical
solutions, funding and implementation.
David Sutton (davidwsutton@mac.com) is
the Network Continuity & Restoration
Manager for Telefónica O2 UK Limited.

As with the electronic communications

industry’s concern for robust power at the
network core, the energy industry takes
robust electronic communications
extremely seriously and builds resilience
into its voice and data networks.
However, if the wired or wireless networks
used within the energy sector are not
resilient on an end-to-end basis, the
monitoring and control centres could lose
visibility of the status of parts of the energy
network and be unable to make dynamic
changes to it, bringing about the risk of
network collapse under extreme
conditions such as severe weather.
Rigorous examination of the whole ICT
infrastructure and subsequent testing is
therefore required to ensure that the
AIFS 2010, 27-28 January
The Athens International Forum on Security (AIFS) is an independent information
security conference held in Greece to deliver vendor-neutral expertise to proactive
IT professionals. AIFS provides a fresh, in-depth look into information security
technologies, policies, techniques and best practices, and helps all parties
involved – from front-line IT personnel to policy-makers – gain valuable insights
into key information security issues. This year’s forum brings together world-
class experts to examine security challenges that organisations will face in the
coming decade and introduce opportunities for successfully overcoming them.
AIFS is organised by The Hellenic American Union, a public service organisation
with an international focus and strong community commitment.
AIFS 2010 is a joint event in co-operation with ENISA and
takes place in Athens, Greece.
More information: http://conferences.hau.gr/?i=aifs2010.en.home

ENISA Quarterly Review Vol. 5, No. 3, September 2009


EMERGING AND FUTURE RISKS
Identification of Emerging and Future Risks in a 2011 eHealth Scenario
Barbara Daskala, Louis Marinos and David Wright
While new technologies generally yield
many benefits to society, they are not
unalloyed, which is to say they may also
pose risks to society. This article briefly
presents the results of the assessment of
a scenario dealing with an eHealth
application and highlights the possible
risks of such systems. The scenario was
assessed as part of ENISA‘s activities in
2008, in consultation with experts and
other stakeholders.
Why eHealth?
eHealth includes a set of systems and
services for health authorities,
professionals, patients and citizens, and is
envisaged to result in considerable
improvement in the provision of health
services to citizens; for example, it can
help to limit costs and improve productivity
in areas such as record-keeping, while
enhancing the quality of patient care (i.e.,
reducing medical errors). Although the
benefits of such applications are evident,
eHealth remains a controversial issue and,
some would say, risky. One of the biggest
challenges in implementing eHealth
concepts is convincing the public that the
service provided in general – and the
electronic health records in particular –
will be safe and secure.
In this context, we considered a scenario
based on a proposal by Philips Research
relating to remote health monitoring and
treatment. We regarded this as an
appropriate subject for analysis, and the
results could – among other things –
contribute to discussions at the European
Union level and have direct policy
relevance.
The scenario: objectives, scope and
outline
We had two main objectives:
• To identify major emerging and future
risks (EFR) in a possible remote health
monitoring and treatment scenario
ENISA Quarterly Review Vol. 5, No. 3, September 2009
13
• To obtain feedback on the ENISA EFR
Framework, a tool used for analysing
and assessing emerging scenarios.
Of course, the scenario does not and
cannot cover all possible aspects of
eHealth, thus the results are by no means
exhaustive and representative of other
eHealth applications. It does, however,
present some of the main risks and
challenges and is expected to contribute to
the dialogue on eHealth implementations
and to fuel further investigation of these
issues.
The scenario revolves around Ralph, a
diabetic enrolled in a remote health
monitoring and treatment programme. He
goes about his daily business wearing a
special vest with biosensors, keeping track
of his vital signs, ensuring rapid response
from doctors, while his personal data may
be literally flowing around, in order to
enable this kind of service. The scenario
shows us that remote health schemes
undoubtedly offer great potential,
especially to patients with chronic
diseases. Many benefits can be identified
for citizens’ wellbeing and quality of life,
but what are the risks?
The risks in a nutshell
We have to consider issues relating to
security, privacy, data protection and
legality, as well as social, political and
ethical ones. The risks listed here were
deemed by the assessment team (ENISA,
its Stakeholder Forum and other consulted
experts) to have the greatest impact with a
considerable probability of occurring. It
should also be noted that the risks are
highly interrelated.
Unauthorised access, modification or
disclosure of a patient’s medical data –
Evil-doers (both external or internal to the
system) could eavesdrop on
communication between the patient and a
doctor and steal or otherwise appropriate
personal data; or someone might steal the
patient’s sensor-embedded garment,
health card or the other IT components
used to take advantage of the remote
monitoring and treatment service. In
addition, officials and patients may be
negligent or careless in handling personal
data.
Disruption or unavailability of the medical
service – Unavailability of service may be
caused by many reasons. Some flaws in
the system design and/or infrastructure
could lead to a malfunction or breakdown
in the system, thereby disrupting service to
users and thus threatening human health.
Adding new functionalities to system
design can lead to delays in implementing
new systems; this seems to be happening
in the case of the UK’s eHealth system
(see, for example, Carvel, John, “New NHS
computer system on brink of failure, warn
MPs”, The Guardian, 27 January 2009,
www.guardian.co.uk/society/2009/jan/27/
nhs-it-computer-programme-health-
public-accounts-committee). A natural
catastrophic event, such as a hurricane or
flood, could damage (parts of) the
infrastructure on which the entire system
depends. It could also be the case where,
due to the unavailability of components,
the system might not be able to
authenticate the patients and,
consequently, deny service provision.
Failure to comply with legislation – An
eHealth system will collect large amounts
of data about patients and it may be
difficult to know precisely who should have
access to those data, for what purposes
and when the patient’s informed consent
should be obtained. Even the notion of
what constitutes informed consent could
vary according to circumstances. In some
cases, informed consent could be intrusive
or difficult to obtain. A failure to comply
with data protection legislation, such as
the European Data Protection Directive
(95/46/EC) and the e-Privacy Directive
(2002/58/EC), may occur because
individuals are not aware of their
obligations, which might be especially
important in an emergency, where
everything needs to happen fast to ensure
timely and appropriate treatment.
Repurposing or secondary use of data
(‘mission creep’) – There is a serious risk
that eHealth data might be used for a
purpose different from that for which the
data were originally collected. Such
repurposing of data need not always be for
nefarious reasons.
>>
 14

EMERGING AND FUTURE RISKS

Discrimination, social sorting and social of the problem here is the incidental data
exclusion – The disclosure of medical and that might be gathered from the sensors: ETSI SECURITY
personal data may lead to discrimination for example, knowing the location of the WORKSHOP
and social sorting, which may have severe patient in an emergency is critical, yet
impacts on the patient’s social life. This is others, such as law enforcement 20-22 January 2010
particularly the case where data regarding authorities or burglars, might also be
the patient’s medical condition is leaked to interested in knowing the location of a Call for Papers and
third parties which may, as a result, deny person at a given time. As with any form of Participation
services to the individual or otherwise data collection, it is difficult to predict what
discriminate against him or her. An uses or value data might have after it has The ETSI Security Workshop
example is loss of employment been collected. (www.etsi.org/SECURITYWORKSHOP) has
opportunities if data are leaked to a become the most important annual
prospective employer. Another example is For more information on the risks and the international security standardisation
the case of insurance companies offering actual methodology used to perform the workshop, bringing together international
premiums to customers who belong to low assessment and identify risks, see the full Standards Development Organisations
risk groups, or denying insurance coverage report and annexes available at: (SDOs) and security experts to discuss recent
or requesting higher insurance payments http://enisa.europa.eu/pages/02_01_press developments, share knowledge, identify
if the patient is considered a high risk _2009_03_20_being_diabetic_2011.html. gaps and co-ordinate on future actions and
because of disease records. This scenario is the first of several which work areas. This year’s Workshop will
ENISA intends to develop in the near include overviews of work being undertaken
Misinterpretation or errors in collecting future, in consultation with stakeholders, in the area of security across standards and
and handling medical data – A patient may as part of its mandate to identify and technical bodies, along with presentations
misinterpret the data generated from a analyse emerging and future risks relating from major organisations involved in security
monitoring device or from the eHealth to European information security. initiatives. The event will take place in ETSI
system or the physician. Not every user is Headquarters in Sophia Antipolis, France,
computer literate or even endowed with from 20-22 January 2010.
commonsense! The data may be too
complex or incomplete for the patient to ETSI is now calling for
understand properly. This risk will become Barbara Daskala (barbara.daskala@ papers!
greater if more responsibility for enisa.europa.eu) is an Expert in ENISA’s Please send a short abstract of your
maintaining their own monitoring Risk Analysis and Management section. presentation to events@etsi.org,
equipment is shifted to patients. together with the title of the
Dr. Louis Marinos (louis.marinos@ presentation, the name and contact
Data surveillance and profiling – Insurance enisa.europa.eu) is a Senior Expert in details of the presenter and the topic
companies, employers, credit-checking ENISA’s Risk Analysis and Management of reference as listed below
companies, researchers and/or others section. by 9 October 2009.
may successfully engage in data
surveillance and profiling because David Wright (david.wright@trilateral The Workshop would welcome papers
patients’ data have not been secured research.com) is a Managing Partner at on practical implementations and issues
sufficiently or because access control Trilateral Research & Consulting LLP, such as the practical use of standards,
measures are weak or too ‘porous’. A part London, UK. the human factors and examples of
insecurity. In particular this year the
presentations should mainly have a
focus on Security Innovation in one of
6-8 October 2009 the following topics: Next Generation
The Hague, The Netherlands Networks security, Mobile
Telecommunications systems, ICT
trustworthiness and integrity, Research
ISSE (Information Security Solutions Europe) is Europe’s only and Innovation, RFID and NFC Security
independent, interdisciplinary security conference and exhibition. issues, the Internet of Things, Identity
Management and your Privacy,
ISSE is renowned for its rich content and unbiased perspective, Cryptography, Smart Cards and future
designed to educate and inform ICT security professionals, trends, Quantum Key Distribution,
policy-makers and industry leaders on the latest developments in Machine to Machine communication,
technology, solutions, market trends and best practice. ISSE 2009 will Standards prioritisation and evaluation.
attract over 400 representatives from across Europe, providing an
informal and stimulating environment for attendees to learn, share For updates about ETSI events, join
experiences and explore solutions with their European counterparts. the recently created ETSI-Events
mailing list at:
ISSE 2009 is a joint event co-organised with ENISA. http://list.etsi.org/scripts/wa.exe?SU
BED1=ETSI-EVENTS
For more information: www.isse.eu.com/

ENISA Quarterly Review Vol. 5, No. 3, September 2009


EMERGING AND FUTURE RISKS
Drivers of Emerging and Future Threats in ICT Infrastructures
Sotiris Ioannidis, Evangelos Markatos, Engin Kirda and Christopher Kruegel
Computer systems, networks and Internet
users are under constant threat from
cyber-attacks. A threat is any indication,
circumstance or event with the potential to
cause harm to an Information and
Communications Technologies (ICT)
infrastructure and the assets that depend
on this infrastructure. Identifying and
evaluating threats early enough is critical
for protecting both infrastructures and
citizens. Of course this is an extremely
challenging endeavour. The past has
witnessed many stunning scientific and
technical advances, and these advances
have transformed society and the way
people use and rely on information
technology. But attackers are also very
creative and constantly invent new ways of
abusing technologies and applications
either for financial gain or simply because
they enjoy virtual vandalism. Trying to
accurately predict possible new threats is
therefore no easy task, but it is important
to think about the potential risks and
threats of emerging technologies and their
applications. Otherwise, one would
surrender to the enemy and, at best,
simply react to his new attacks.
Operating along those lines, the scientific
community involved in the FORWARD
project has been systematically working to
identify emerging and future threats in ICT
infrastructures. The FORWARD project is a
co-ordination action, supported by the
European Commission, whose purpose is
to facilitate an agenda of research
problems by mobilising the critical mass of
European researchers in network and
systems security. FORWARD has brought
together more than 100 experts from
academia, industry and government,
creating the critical mass needed to
identify the emerging and future security
threats in network and systems security.
Having completed two public workshops
and hundreds of multi-party
communications, the FORWARD
community has identified the dimensions
that drive the security threats of the future.
These dimensions serve as the main
drivers of development in general, and
ENISA Quarterly Review Vol. 5, No. 3, September 2009
15
allow us to set a framework in which each
working group can systematically explore
threats.
The four main dimensions identified are
the following:
New technologies: By new technologies,
we mean technical advances that provide
functionality that simply was not there
before. Clearly, this is very difficult to
predict, but there are certain drivers, such
as Moore’s law, that have been valid for a
long time. Extrapolating these steady
trends, we foresee much faster networks
(both wired and wireless), a substantial
increase in parallelism (multi-core
machines) and better energy and battery
technology, which will catalyse the
prevalence of mobile computing.
Computing devices will also become
smaller and cheaper. As a result, they will
become more widespread, and they will be
able to support more and richer
applications.
New applications: New applications
means completely new uses of technology,
uses that typically did not exist before or do
not have a counterpart in the real world.
One important set of emerging
applications is social networks: tools that
have rapidly reached a significant
proportion of the population and that
support social interactions among large
user groups. Another interesting class of
new applications revolves around the idea
of software as a service – a model in which
applications are hosted by providers on a
large-scale computing infrastructure,
such as a cloud. This deployment and
computing model is profoundly different
from the traditional client-server model,
presenting new challenges in security and
privacy.
New business models: With new business
models, we refer to the fact that certain
services or applications that might already
exist in some form start increasingly to rely
on a working ICT infrastructure. For
example, online shopping, online banking,
and even eGovernment would be
considered new business models in our
taxonomy. That is, these services did exist
before (as retail stores, banks and offices),
but they are now increasingly carried out
via ICT. In addition, these services do not
represent a fundamentally different
application, since they are typically
instances of well known models of
computing that are simply adapted to suit
the business case.
New social dynamics and the human
factor: This category takes into account
possible changes in the way that people
approach and use technology and certain
applications. For example, young people
are becoming increasingly sophisticated in
their use of ICT, and at the same time ICT
users in general are increasingly willing to
entrust devices and applications with a
significant amount of private information.
This opens up the possibility for a wide
variety of new threats.
The results of FORWARD are expected to
be used not only by researchers, but also
by policy-makers who want to facilitate a
road towards a more secure cyber-space.
Thus, researchers, policy-makers,
decision-makers and practitioners are
encouraged to follow the activities of
FORWARD and provide their feedback at
www.ict-forward.eu/.
Sotiris Ioannidis (sotiris@ics.forth.gr) is an
Associate Researcher at the Distributed
Computing Systems Laboratory of FORTH-
ICS and an Adjunct Professor at the
Computer Science Department of the
University of Crete.
Evangelos Markatos (markatos@ics.forth.gr)
is the Director of the Distributed
Computing Systems Laboratory at FORTH-
ICS, a Professor of Computer Science at
the University of Crete and a member of
ENISA’s Permanent Stakeholders’ Group.
Engin Kirda (ek@iseclab.org) is Associate
Professor at Eurecom and an Adjunct
Professor at the Technical University of
Vienna.
Christopher Kruegel (chris@cs.ucsb.edu)
is an Assistant Professor and the holder of
the Eugene Aas Chair in Computer Science
in the Computer Science Department of
the University of California, Santa Barbara.
 16

SKILLS AND CERTIFICATIONS

Cyber-Security Skills – The Cost of Ignorance
Hugo Lueders

around €193 billion”, according to its recent e-skills agenda and for establishing multi-
Communication on Critical Information stakeholder partnerships to drive it forward.
Infrastructure Protection (CIIP), No single stakeholder can achieve this alone
(http://ec.europa.eu/information_society/policy any longer.
/nis/strategy/activities/ciip/index_en.htm).
This much is agreed: as well as delivering
A recent industry survey also finds that this crucial investment in ICT infrastructures to
human factor tops the list of the main security promote economic and social development,
risks which increase costs to businesses and Europe should clearly focus on human
public organisations; data suggests security capacity building and accompanying
breaches cost companies in the US alone in investment in related ‘Skills Infrastructures’
excess of some €12 billion annually and (see the May 2009 ILB Policy Statement on
probably significantly more (www.industry “Skills Infrastructures”: www.e-skills-
week.com/articles/end_user_it_security_ ilb.org/docs/Skills_Infrastructures_ILB_Polic
training_can_save_billions_19133.aspx? y_Statement_13May.pdf). Developing skills
SectionID=2). goes with investment. To this end there should
be a concerted effort to improve the image of
The whole issue of helping to protect Europe ICT industries through a continuous
It is not as if European policy-makers are
from large-scale cyber-attacks such as those awareness-raising campaign (for the
unaware of these challenges. But the EU risks
in 2007-2008 on Estonia, Georgia and envisaged EC e-Skills Awareness Campaign
overlooking the human capacity challenge and
Lithuania has acquired a new urgency 2010, see: www.eicta.org/index.php?id=34&id
has made little or no appropriate,
recently. In Europe, Viviane Reding, the _article=344).
co-ordinated response to the need to develop
European Union (EU) Commissioner for
cyber-security skills. After all, ENISA itself
Information Society and Media, called for On the specific issue of cyber-crime,
organised a seminar on cyber-security skills
action with a top person in charge (a European enhanced support should be given to
credentials as long ago as November 2006.
Cyber Security Chief), and in the US President industry-based and other recognised ICT
Almost three years later, at the April 2009
Barack Obama and the Pentagon have asked skills credentials for cyber-security
meeting of EU Ministers on CIIP in Tallinn
for a new ‘Cyber Czar’ to combat the growing qualifications and the spread of higher
(www.tallinnciip.eu/), the skills challenge and
threat to America’s military and corporate education courses in forensic computing. All
growing shortages went unmentioned again,
security posed by cyber-crime. EU Member States should have Computer
although they are central to the issue of
cyber-crime and security and the post i-2010 Emergency Response Teams (CERTs) to
But is the same importance being attached to integrate related training and qualifications to
Lisbon strategy for the knowledge-based
developing the required human capacity, ward off cyber-attacks.
economy.
cyber-security training and skills to combat
this threat to the digital backbone of Europe’s The problem of network and information
Clearly, there is a pressing need to re-skill the
economy and society? security will not go away; it will only grow in
EU workforce for the new digital economy.
This means giving distinct roles to: urgency and intensity. Europe needs to raise
Cyber-crime has now reportedly surpassed its game in addressing the threat that a lack of
governments (in fostering an environment
drugs in terms of the amount of illegal cyber-security skills – especially e-skills –
which enables ICT skills to be acquired);
revenue – hundreds of billions of Euros – it poses to its ability to combat cyber-attacks.
education (providing relevant learning
nets. The European Commission also
packages); and the industry itself
calculates that there is “a 10% to 20%
(encouraging its staff to demand Hugo Lueders (HLueders@comptia.org) is the
probability that telecom networks will be hit
requirements). We urgently need to put into Senior Director of Public Policy at COMPTIA,
by a major breakdown in the next 10 years
practice long-standing proposals for responsible for Europe Middle-East and Asia
with a potential global economic cost of
implementing a long-term and consistent (EMEA).

Penetration Testing – What’s That?

Peter Fagan and Peter Fischer
In the aftermath of the various security
incidents within UK Government in 2007 and
2008, a report on Data Handling Procedures in
Government was published by the Cabinet
Office (www.cabinetoffice.gov.uk/reports/
data_handling.aspx), together with a set of
Mandatory Minimum Measures. Top of the list
of core measures to protect information was
the ‘independent penetration testing of
Departmental systems’.

>>
ENISA Quarterly Review Vol. 5, No. 3, September 2009

SKILLS AND CERTIFICATIONS
Penetration Testing – What’s That?
However, the term ‘penetration testing’ is
used loosely to cover many different activities.
These include:
• Social Engineering – There are inevitably
‘touch points’ where users interact with
system administration staff (dealing with
lost passwords, application problems etc.).
Although the term ‘social engineering’
itself covers a lot of ground, usually it is
based on trying to exploit these touch
points to gain unauthorised access. Tests
assess staff awareness of threats and
information sensitivity, and the strength of
the processes governing the interaction.
• A Network/Systems Test – This is the
usual interpretation of a ‘penetration test’.
The testers look at the switches, routers,
firewalls, servers etc., inspecting their
configurations for weaknesses (e.g.,
inappropriate access control lists),
checking for the latest patches to eradicate
known vulnerabilities and looking for
specific issues such as weak passwords.
These tests can also be extended or
constrained to specific aspects such as the
use of Voice over Internet Protocol (VoIP) or
wireless networks. A successful check will
provide confidence that the underlying
network infrastructure is well-configured,
and will identify any residual weaknesses.
However, for a system of any significant
size, it is usually better to base the
approach on sampling.
• An Application Test – Web-based systems
clearly have to accept web traffic to
function. In this case, the ‘doorways’ for the
traffic represent unavoidable
vulnerabilities. An application test will
check that these openings are only as wide
as they need to be. Typically this will ensure
that common browser-based attacks are
blocked, that ‘man in the middle’ threats
are managed, that Simple Object Access
Protocol interfaces (SOAP) and Application
Programming Interfaces (APIs) are secure,
that any tokens (such as cookies or Security
Assertion Markup Language (SAML)
tokens) are passed in a secure way, and
that, for example, Extensible Markup
Language (XML)-based attacks are
prevented.
• A Network Device Test – This is the test of
the configuration on a single network device
such as a router or a firewall. It is unusual,
because of the expense of arranging the
tests for just a single machine, but
sometimes it is necessary (e.g., when a
firewall has been replaced or to confirm
that a heuristic device such as a web
application firewall has ‘learned’ correctly).
ENISA Quarterly Review Vol. 5, No. 3, September 2009
17
There is a fundamental and important
difference between an aggressive penetration
test – executing scripts to test whether a
vulnerability can be exploited – and a
vulnerability assessment – checking for
known vulnerabilities. Unless absolutely
essential, aggressive penetration testing of
live operational systems should be avoided; it
is safer to test a reference or development
system.
The field of penetration testing continues to
evolve. One emerging approach is to identify
the key assets of the system (the user
database, the database schema, key
credentials etc.), and ask the penetration
testing team how they would use access to
that asset in order to attack the system. Not
only does that identify key assets requiring
specific protection, it can also assist with
incident handling.
The first lesson from this discussion is that
penetration tests, vulnerability assessments
or IT Health Checks (all are used to cover
roughly the same types of activity) need to be
defined and managed, and must have clear
objectives. All too often ‘Someone in
Authority’ deems that a penetration test would
be a ‘good thing’ and someone else is tasked
with ensuring that one is commissioned. That
individual might have no idea of what a
penetration test is, how it should be specified,
what precautions should be taken or what to
expect. In other words, he or she represents
the perfect example of an unintelligent, ill-
informed customer!
Additionally, the project or system manager of
the ‘target’ might have no knowledge or
experience of such a test and be totally
unprepared for what is involved and what
might happen. The result could be
misunderstanding, confusion, disaster and,
inevitably, recriminations. In the worst case
the value of a penetration test could be
completely overshadowed by the problems
caused, to such an extent that ‘management’
bans further tests.
Scoping normally takes place during an initial
meeting involving the organisation
commissioning the tests and the party
performing the tests. It is essential at this
meeting to define the types of tests required,
with their scope and related boundaries.
There have been a number of cases reported
where public and private sector systems,
usually web portals, have been ‘attacked’ by
so-called penetration testers exceeding the
boundaries of their test targets. This suggests
not only poor management of the process, but
also a degree of incompetence by the testers.
So, how does the organisation know whether a
testing company or individual is competent?
For many years CESG, the UK Government
National Technical Authority for Information
Assurance, has operated a scheme – CHECK
– which independently assures companies
and senior level vulnerability assessment
testers (using the CHECK Team Leaders (CTL)
standard) for the purpose of undertaking
penetration tests and IT Health checks
against systems and networks which process
UK Classified information. Recently, two
schemes have emerged which assess testers
to a standard evaluated by CESG as equivalent
to their CTL assessment – the CHECK ‘Assault
Course’. One of these two schemes is run by
the Council for Registered Ethical Security
Testers (CREST); the other is the TIGER
Scheme.
All three schemes – CHECK, CREST and
TIGER – recognise the need to ensure that
testers maintain their knowledge base. This is
a dynamic area where the scene is constantly
changing. Consequently the certification
offered by each scheme has a lifespan of only
three years, following which the tester must
be reassessed.
The TIGER scheme model is particularly
appropriate for providing development and
training for security testers throughout their
career, and can be replicated across the
European Community. There are four levels of
certification – Associate, Qualified, Senior and
Specialist – each supported by training
courses, and each achieved by passing an
assessment that is set and marked by a
recognised academic Examining Body,
currently the University of Glamorgan. The
scheme also has a number of approved
Training Partners, and a specific IT Health
Check Management course aimed at
individuals in organisations procuring such
tests. More information can be found at
www.tigerscheme.org.
Information on CHECK can be found at
www.cesg.gov.uk and on CREST at www.crest-
approved.org.
Peter Fagan (p.fagan@ukonline.co.uk) is a
Solutions Director and Head of Security
Practice at Sogeti UK Ltd and one of the initial
members of the CESG Listed Adviser Scheme
(CLAS).
Peter Fischer (peter.fischer@btinternet.com)
is a Managing Consultant at Sogeti UK Ltd, a
Lecturer in Information Assurance at the UK
National School of Government, an ENISA
Independent Expert and a former Head of
Information Assurance and Certification
Services at CESG.

SKILLS AND CERTIFICATIONS
A New Qualification to Guarantee Secure Software Engineering Skills
Petra Barzin
Why Secure Software Engineering?
Security at the application level is a growing
concern and one of the biggest challenges
that will face the IT community over coming
years. Although vendors provide security
patches free of charge, their roll-out
produces extra costs and brings with it the
risk of new security vulnerabilities and
critical incompatibilities in complex IT
environments. The constant race against
time to identify security vulnerabilities
before an attacker finds them, and to publish
security patches before published exploits
can cause harm is not the best approach to
bolster confidence in the security of
software. In order to win the race, the real
cause of security vulnerabilities – rather
than their effect – must be eliminated.
A firewall cannot distinguish between a valid
input parameter and a ‘code injection’
attack. This distinction can only be judged at
the level of the application itself. So possible
attacks could be eliminated earlier, i.e.,
during the application development phase.
Unfortunately, insufficient attention is
usually paid to security aspects in the
software development lifecycle in university-
level curricula, or later in the day-to-day
business of software engineers, in order to
counter security vulnerabilities in software
as they are emerging.
Secure software development demands
security-conscious and well-educated
software architects and developers. There is
need for qualifications demonstrating that a
person possesses the necessary skills to
develop secure software.
The International Secure Software
Engineering Council (ISSECO – principles and security design patterns
www.isseco.org) aims to fill this gap by
providing an international personnel
ENISA Quarterly Review Vol. 5, No. 3, September 2009
18
certification standard for secure software
engineering.
ISSECO deals with the education of people
involved in the software development
lifecycle. This new personnel certification is
aimed at everyone who is directly involved in
the software development lifecycle,
including requirements engineers, software
architects, designers, developers, software
quality managers, software testers, project
managers and all related software
development stakeholders.
The ISSECO syllabus
The structure of the syllabus is based on the
different phases of the software
development lifecycle.
The first step in creating secure software is
to understand the attacker and the
customer. In order to see with the eyes of
the enemy, Certified Professionals for
Secure Software Engineering must
appreciate the hackers’ motives, their skills
and resource situation, as well as typical
hacker thinking when attacking systems. In
addition, Certified Professionals must have
understood why and what customers expect
in terms of software security in order to be
able to classify customers’ requirements.
Next, Certified Professionals for Secure
Software Engineering must have a basic
understanding of the different trust and
threat models. In contrast with threat
models, there are various access control
models that describe how to constrain the
ability of a subject to access or perform
some sort of operation on an object.
Certified Professionals for Secure Software
Engineering must also feel comfortable with
the methodologies for secure software
development. Processes that consistently
produce secure software do not require any
particular design, development, testing or
other methods. They can be applied to any
development methodology or lifecycle
model.
Security must be incorporated from the very
beginning of the software development
lifecycle. In the requirements engineering
phase Certified Professionals should focus
on developing security requirements for the
respective application. There are numerous
different sources of requirements and many
of them are relevant to security.
Because architectural and design-level
errors made during the design phase are
the hardest vulnerabilities to fix and the
most difficult to defend against, security
must be well understood. At design reviews
Certified Professionals must be able to
focus on the areas of the application that
have the most impact on security.
The creation of secure coding requires an
understanding of which programming
errors lead to vulnerabilities such as Cross
Site Scripting (XSS) or injection flaws. All
vulnerabilities are introduced by so called
vulnerability patterns, e.g., buffer overflow,
race conditions or improper error handling.
Certified Professionals for Secure Software
Engineering must be able to identify, avoid
and remedy all of them.
During security testing Certified
Professionals will have to verify whether all
security requirements are met and that all
mitigation techniques are effective. They
must therefore understand the test
methods of security testing and how to
interpret the results.
Even when security issues are considered at
the initial stages of software development
and secure design and coding practice are
applied during development, the security
implications of deployment are often
overlooked. Much vulnerability may still
arise during this final phase. Thus, secure
deployment is another important concern.
Once the software has been deployed, the
focus shifts to the implementation of a
security response process in order to make
sure that security issues in software
installations are fixed and communicated
responsibly.
Security metrics serve to quantify the
security of an application. Security involves
every stakeholder, has an impact on many
features and must be considered by
Certified Professionals for Secure Software
Engineering throughout the complete
software development lifecycle.
Last but not least, the correct use of code
and resource protection will assure the
quality of software and protect it from
foreign sabotage.
Future prospects
Besides the foundation level certification,
further advanced levels are planned to be
defined later. These advanced levels may
address security matters specific to a
programming language, IT security
management or other topics. In the future,
ISSECO is also considering offering security
auditor training for assessing software
development with respect to security.
Petra Barzin (petra.barzin@secorvo.de)
works for Secorvo Security Consulting and
is one of the Vice Presidents of ISSECO.

AWARENESS AND END-USER ISSUES
End-user Security: Misused and Misunderstood?
Steven Furnell
Today’s end-users have to contend with a
variety of threats, many of which target and
affect them directly, and so require
associated protection. However, actually
addressing this issue is complicated by the
fact that users are often asked to accept
the existence of threats that they cannot
see and to protect against risks that they
do not really understand. Moreover, they
are frequently asked to do so via software
that seemingly requires a strong grasp of
security concepts and terminology.
Nonetheless, with Internet threats having
received greater recognition in the public
mind, security is now more prominent in
modern systems and applications. As a
consequence, users can encounter a range
of security-related features and
notifications during routine daily use. For
example, a modern web browser such as
Internet Explorer 8 incorporates anti-
phishing (via the SmartScreen Filter),
pop-up protection, data privacy controls
(via the InPrivate Browsing feature), as
well as numerous options relating to
content that can be downloaded and run
within pages. In this way, users may find
themselves interacting with a variety of
related menus and notifications – as well
as potentially needing to respond to them.
Unfortunately, evidence suggests that
users are frequently ill-equipped to deal
with security events, particularly when
handling them requires a decision to be
made. A study at the University of
Plymouth investigated this issue, with 26
users being asked to record their security-
related interactions over a two-week
period (Chatziapostolou, D. and Furnell,
S.M. 2007. “Assessing the usability of
system-initiated and user-initiated
security events”, Proceedings of
ISOneWorld 2007, Las Vegas, 11-13 April
2007). The participants were asked to
ENISA Quarterly Review Vol. 5, No. 3, September 2009
19
record both system-initiated events (e.g.,
warnings, alerts, update messages) and
security actions they tried to perform for
themselves (e.g., configuring protection,
setting permissions). Almost 90 system-
initiated events were recorded and in 16%
of cases users reported being ‘totally
unclear’ on what had happened and/or
what they were supposed to do, with a
further 23% reporting that the event was
‘mostly unclear’. Additionally, in 22% of
reported cases, the occurrence of the
event prevented the users from completing
whatever task they had been performing at
the time. Meanwhile, from almost 30 user-
initiated events, the situation was even
worse, with 31% ‘totally unclear’ and 21%
‘mostly clear’, and users being able to
complete their intended action in only 62%
of cases.
Such findings highlight the need for
security to become more usable, and it has
long been recognised that the way in which
security measures are presented to users
can be a barrier to effective protection.
Indeed, evidence of usability problems
abound, from misconfigured firewalls
through to classic problems such as
passwords that are poorly selected and
subsequently mismanaged. Thus, at its
fullest extent, the concept of usable
security embraces considerations from the
design of the user interface through to the
effect that it has on the user experience
and system performance. Focusing on the
interface level, where users must interact
and make decisions, security tools and
features need to satisfy the following
characteristics if users are to stand a good
chance of handling them effectively:
• Understandable – Features should be
presented in a manner that is
meaningful to the target audience. For
example, reliance upon jargon and
technical terminology could easily
exclude novice users.
• Locatable – If users have to spend too
long looking for security it increases the
chances that they will give up and
remain unprotected.
• Visible – A clear indication of security
status will help to remind users to
enable appropriate safeguards.
• Convenient – Security should not be so
prominent that it becomes inconvenient,
as users may disable features that are
deemed overly intrusive.
Having said this, usability will only take us
so far. While interfaces can be made more
visually appealing, the underlying problem
of actually understanding the nature of
security measures may remain
unresolved; users can navigate the
interface and click the buttons, but it does
not mean that they are making informed
and correct decisions in the process. In
short, users need to understand what they
are doing and why they are doing it.
Without at least a baseline understanding
of the threats and countermeasures we
will find that users are simply unaware of
their security needs. For example, findings
from a more recent University of Plymouth
survey of 259 home-users suggest that,
while most people have concerns about
online security, many are not positioned to
protect themselves. Only 5% of
respondents reported that they were not at
all worried about their security and
privacy, whereas 13% classed themselves
as ‘very worried’ and a further 36% as
‘fairly concerned’. In spite of these
concerns, there appeared to be some
significant gaps in the respondents’
awareness of their own security:
• 44% did not know if they were using
encryption on their wireless network,
with a further 15% reporting that they
were not using it
• 35% did not know whether their
antivirus solution also provided
protection against spyware
• 19% were unaware of whether they were
using spam filters
• 17% did not know what their firewall
does, while a further 22% did not know
where to find the related configuration
settings
• 12% reported that they did not know
about backing up their data, with a
further 33% reporting that they did not
do it.
Unfortunately, the problems do not end
with lack of awareness and lack of usage.
Even when particular technologies have
been adopted, users’ lack of
understanding can be their undoing. As
evidence, we can consider findings from
the National Cyber Security Alliance and
Symantec (NCSA-Symantec. 2008. NCSA-
Symantec National Cyber Security
Awareness Study – Newsworthy Analysis.
October 2008. http://staysafeonline.
mediaroom.com/file.php/100/2008+NCSAS
ymantecStudyAnalysis.pdf). This study
asked home-users in the US about the
protection in use on their PCs, and then
scanned 400 of them to see how closely the
users’ beliefs matched the reality. In some
areas the results were fairly positive. For
example, 93% believed they had antivirus
>>

AWARENESS AND END-USER ISSUES
measures installed, whereas 95% actually
did, and 83% claimed to have antispyware,
with 82% indeed having the protection.
However, in other cases the situation was
rather less encouraging. For example, 81%
believed they had firewall protection, but
only 58% actually had one appropriately
installed, updated and enabled.
Meanwhile, 75% thought they had anti-
spam protection, whereas only 42%
actually did so. Of course, with the
prevalence of malware and other online
attacks, it could be argued that all of the
respondents should have had antivirus,
antispyware and firewall protection. As
such, the fact that some users were still
knowingly unprotected presents further
Human Factors in the Dependability of IP Networks
Ilkka Norros and Leena Norros
The motivation for the Finnish Government
funded research project IPLU,
“Dependability evaluation methods for IP
networks”, in 2006 and its follow-up,
IPLU-II, was concern about the
dependability of the IP-based
communication infrastructure. IPLU’s task
was to create a broad conceptual
framework for considering the complex
problem, “Can one rely on IP technology?”,
and to identify and develop methods for
assessing the dependability of IP
networks. IPLU-II continued with selected
focused topics. A special feature of both
IPLU and IPLU-II was their
multidisciplinary nature, drawing on the
expertise of the VTT Technical Research
Centre of Finland, which carried out both
research projects, in communication
technologies, mathematical modelling,
statistics, safety-critical systems and
psychology.The projects were supported by
most of Finland’s key players in the field.
ENISA Quarterly Review Vol. 5, No. 3, September 2009
20
evidence of a lack of understanding and/or
neglect.
These findings emphasise the importance
of usability being supported by effective
awareness raising, in order to build an
underlying culture of security amongst the
user population. This applies to both
individuals and the organisations in which
they work, and would help to ensure that
users are better equipped to understand
the reasons that they are at risk and the
protection that they require as a
consequence. These objectives will only be
achieved via continued efforts to reach the
target audience, and by achieving a better
understanding of which approaches are
The human factors of network operation
It seems to be a common view in the
networking domain that a high percentage
of network failures are caused by human
error. Therefore it is very interesting to
know what happens ‘behind the scene’,
where experts with various qualifications
work continuously to keep the ‘invisible’
infrastructure functioning. IPLU-II
interviewed 20 people who operate the
networks of the Finnish
telecommunications company, Elisa,
resulting in the collection of empirical
material comprising 500 pages of
transcribed protocols. The answers were
analysed, applying an approach developed
at VTT for the study of experts’ work in high
tech environments. The four research
questions of the study were formulated as
follows:
• How do the actors perceive the network
as the object of their activity?
successful in which contexts. In this
respect, activities such as those of the
ENISA Awareness Raising Section are
important in highlighting and sharing good
practice, as well as potentially feeding
back into initiatives for supporting security
awareness at both national and local
levels.
Prof. Steven Furnell (steven.furnell@
plymouth.ac.uk) leads the Centre for
Security, Communications & Network
Research at the University of Plymouth,
UK.
• What kind of skill, knowledge and
collaboration requirements does
operation of the network set?
• How do the network operators act on
the network?
• What is the impact of human error on
the dependability of the network?
The background, results and conclusions
of the study will be presented and
discussed in detail in a report that will
appear on the project’s homepage in
October 2009. Below are summarised the
results of a so called ‘core-task demand
analysis’ of the work of network operation,
the interviewees’ thoughts on the impact of
human error, and some general
conclusions drawn from the study.
Demands of the work of network
operation
The special work demands in high tech
environments that are intrinsically implied
by features of the work domain can
generally be classified as being related
either to its (i) dynamics, (ii) complexity, or
(iii) uncertainty. These three dimensions
cover and structure the features of the
object of Communication Network
Operation (CNO) very well. Mastering these
features requires many kinds of skill,
knowledge and collaborative resources as
well as specific emotional resources. The
core-task demand structure obtained is
illustrated in the diagram overleaf.
>>

AWARENESS AND END-USER ISSUES
Human Factors in the Dependability of IP Networks
Collaboration and professional
confidence
Dynamics
Dynamics of the object of work
Fast action requirements
Making network changes collaboratively
Directing problems to right instances
Mastering the load of the situation
Development of new skills and situation awareness in practice
Decisions under time pressure
Changes and experiments motivate
Identification of protection needs
Checking the result
Skill and feeling of Bringing the work until its end
control
Uncertainty
Technical uncertainty
Defective information
Core-task demands of CNO
The role of human error
The majority of the interviewees, though
not all, considered the impact of human
errors on network failures as remarkable.
Erroneous acts were found possible at two
levels: the individual level and the
organisational process level.
As regards the work of an individual
network operator, hurry, stress, taking
care of several jobs simultaneously and
night work were identified as situation
factors which increase the vulnerability of
work performance. Two particular types of
error were identified in work
performances:
• lapses and confusions, in particular with
configuration and with the allocation of
subcontractor jobs
• errors in reasoning in configuration and
planning.
The vulnerability of performance at the
general level seems to be caused by
factors resulting from habits and culture
such as:
• meaningless repetition of performance,
and slackening of the control of activity
during the work
• neglect of the use of knowledge or
instructions
• weakening of interest and motivation.
On the other hand, many problems were
less connected with the performance of
ENISA Quarterly Review Vol. 5, No. 3, September 2009
21
Complexity
Complexity of technologies
Complexity of the existing network
Combination of competences in problem solving
Collaboration for controlling reliability
Appreciation of others’ contribution
Knowledge on implemented solutions
Conceptual mastering of networks
Perception of totalities
Understanding motivates
Interpretation of experiences and errors
Readiness to learn from literature
Documentation of changes
Mastering of repetition
Knowledge
and
meaning of activity
individuals and could thus be alleviated by
changes in processes, customer solutions,
working habits and education. Errors were
said to result from circumstances such as
the defective documentation of
implemented solutions, the defective
consideration of the effects of changes,
incomplete implementation of changes,
neglect of checks and unpredictability
connected with new solutions. Defects in
knowledge were also mentioned as a
source of errors. Excessive tailoring of
customer solutions was considered much
more error-prone than favouring a set of
standardised solutions. Learning from
errors is accentuated by their repetition
but, on the other hand, is often hindered by
their latency.
Some conclusions from the study
First, the social importance of the
networking branch and network operation
work is increasing as the ubiquity of
Internet access becomes an integral part
of the common technological environment.
The social appreciation of CNO work
deserves to be heightened.
Second, a combination of proactive and
resilient methods is needed in the
organisation and processes of CNO work.
Whereas planned acts upon the network
should be prepared as carefully as
possible, preparedness for online
problem-solving prompted by unexpected
network failures is an integral part of CNO
work.
Third, CNO work is also socially highly
networked by its nature, and
communication and collaboration over
organisational boundaries is a challenge
that needs attention. A socio-technical
approach to the network should be
developed. We also noted that a customer-
centric approach seems to be gaining
momentum – the network also exists for
its customers in the minds of the experts.
To follow up this work, fault diagnosis and
recovery processes should be observed
and analysed in detail as they occur in CNO
work practice. This would be valuable not
only for the development of good work
practices but also for the development of
better tools for network management.
Other results of IPLU-II
IPLU developed the basic idea of a
‘dependability case’ methodology that
makes it possible to combine a
heterogeneous set of relevant
requirements, facts, tools, techniques etc.
into an organised argument in support of a
claim concerning the dependability of a
network. The feasibility of this approach
was tested in IPLU-II by building a
comprehensive dependability case of the
Funet network in collaboration with
experts from CSC – the IT Center for
Science Ltd (www.csc.fi/english) which is
administered by the Finnish Ministry of
Education – who manage the network. A
complete description of the case and a
related article are available on the project’s
homepage.
On a more technical level, IPLU-II
contributed to the difficult concept of IP-
availability, the monitoring of IP-TV
availability, on/off process modelling for
network reliability analysis and a
comparison of strategies for improving
network dependability.
The outputs of IPLU and IPLU-II are
available on their common homepage at:
http://iplu.vtt.fi.
Ilkka Norros (ilkka.norros@vtt.fi) and
Leena Norros (leena.norros@vtt.fi) are
Research Professors at the VTT Technical
Research Centre of Finland.
 22

TECHNOLOGIES
A Secure Approach for Embedded Systems in Japan
Hideaki Kobayashi, Manabu Nakano and Tomoka Hasegawa

The Information-technology Promotion

Embedded systems used in automobiles
and home information appliances are one
of the major industries in Japan. However,
security measures are given less priority
because of the reduction in the
development period, or lack of resources
and IT security awareness, caused by
aggravated market competition. This could
affect the whole future of the global
deployment of Japanese software
embedded systems.
IPA is therefore providing embedded
system security guidelines aimed at
raising awareness and promoting secure
implementation. It is particularly targeting
engineers and managers.
Challenges and measures for the entire
lifecycle of embedded systems
We have interviewed developers of
embedded systems and summarised our
findings into four phases of the production
lifecycle: Planning, Development,
Operation and Disposal, adding one more
critical aspect, Management, to cover the
entire lifecycle within an organisation. In
addition, we have produced fifteen
practical guidelines for IT security based
on these five phases, to help both
engineers and managers identify the
threats to embedded systems and to
decide ‘what should be done’.
The fifteen guidelines are as follows:
I. Management
1. Security Rule: create a documented
organisational rule for security
2. Security Education: provide security
education on vulnerabilities etc.
3. Security Information Gathering:
collect information relevant to
security for the entire lifecycle
II. Planning
4. Budget: allocate budget for security
from the perspective of risk
avoidance
III. Development
5. Design: extract the appropriate
security challenges to be considered
and review the countermeasures
6. Adoption of the Development
Platform: configure the platform to
avoid leaks of confidential
information to attackers
7. Software Implementation: avoid
discovery of vulnerabilities by
implementing tamper-resistant
software
8. Approach for Outsourcing
Development: specify the design
rules to the outsourcing company and
clarify the responsibility of each
stakeholder
9. Security Evaluation Test and Debug:
verify the existence of
vulnerabilities by evaluation tests
10.User’s Guide: create
troubleshooting manual for
embedded system users
11. Factory Production Control:
establish a physical or network
barrier to manage security aspects
IV. Operation
12. Handling of Security Problems:
prepare for unexpected incidents by
establishing incident response
contact points or determining the
handling flow
13. Method of Advising Users and
Countermeasures: develop a method
to deliver information to users upon
discovery of a vulnerability
14.Practical Use of Vulnerability
Information: review the approach to
prevent recurrence upon discovery of
a vulnerability
V. Disposal
15.Announce the Method of
Equipment Disposal: announce to
users how to eliminate data within
the embedded system
Towards an organisational approach to
embedded system security
To tackle threats to embedded systems
effectively, their various components need
to be treated as a whole, which requires an
organisational approach.
We have classified each of the fifteen
security guidelines listed above into four
levels as an index of how well an
organisation has adopted an
organisational approach to IT security.
Details differ within each guideline but the
characteristics of each level are the same:
Level 1: There are no security measures in
place
Agency, Japan (IPA) is a Japanese
Government organisation working under
the Ministry of Economy, Trade and
Industry (METI). The IPA’s IT Security
Center (ISEC) is the core unit for
promoting Japanese IT security
countermeasures, including
disseminating information and raising
security awareness among Japanese
citizens, providing alerts on the latest
security vulnerabilities, hosting basic
and advanced security seminars
throughout the country, and publishing
security guidelines for businesses and
personal computer users.
Level 2: Security measures are performed
under the leadership of the person in
charge
Level 3: Organisational security measures
are taken
Level 4: Organisational security measures
a are taken and an external audit
mechanism exists
Summary
By applying these guidelines, embedded
systems developers now have practical
guidelines to help them implement secure
embedded systems.
IPA is working to expand its approach and
to improve the contents of the guidelines
by interviewing additional embedded
system developers. In addition, we plan to
make practical proposals for improving the
level of embedded system security by
introducing security countermeasure tools
and various case examples. Working with
relevant organisations, we will contribute
to the enhancement of security measures
among users, manufacturers and service
providers and, by advancing international
collaboration, contribute to the promotion
of global security countermeasures.
Hideaki Kobayashi (hd-koba@ipa.go.jp) is
the Laboratory Manager of the Security
Engineering Laboratory in the IT Security
Center (ISEC) of the Information-
technology Promotion Agency, Japan (IPA).
Dr. Manabu Nakano (mn-naka@ipa.go.jp)
is a member of the Security Engineering
Laboratory in the IT Security Center (ISEC)
of the Information-technology Promotion
Agency, Japan (IPA).
Tomoka Hasegawa (tm-hase@ipa.go.jp) is
a member of the Security Engineering
Laboratory in the IT Security Center (ISEC)
of the Information-technology Promotion
Agency, Japan (IPA).

ENISA Quarterly Review Vol. 5, No. 3, September 2009

 23
TECHNOLOGIES
tNAC – trusted Network Access Control
Access Control meets security platform
Marian Jungbauer and Norbert Pohlmann
tNAC (trusted Network Access Control)
project. The tNAC consortium consists of
the German Universities of Applied
Sciences Gelsenkirchen (Institute for
Internet Security) and Hanover and a
number of companies – Datus AG, Sirrix
AG and Steria Mummert Consulting. The
project is sponsored by the Federal
Ministry of Education and Research.

The main aim is the realisation of a

complete open source NAC solution based
on the TNC specifications, including an
integration of TNC into a security platform
to achieve a higher level of trust. tNAC is
based on two existing Trusted Computing
projects – TNC@FHH, an Open Source TNC
solution developed by the UAS Hanover,
and the Turaya security platform,
developed by the former European
At present there are a number of NAC Multilaterally Secure Computing Base
Current and future networks must be
solutions in existence – the most (EMSCB) project in which the Institute for
flexible and open in terms of their
prominent representatives are Cisco Internet Security participated. Turaya does
expansion. At the same time these
Network Admission Control and Microsoft not replace common operating systems. It
networks should enable trusted
Network Access Protection. And there are is a new security layer positioned between
communication. The flexibility and
further approaches under development – the hardware and the operating system. It
relatively low cost of the Internet open the
such as the Trusted Network Connect can control security-relevant processes
way to a lack of security. Field workers, for
(TNC) specification which aims to be an and offers the ability to use Trusted
example, use their computer systems in
open, producer-independent specification Computing functions securely.
many different environments with varying
security requirements and conditions. If a for verifying endpoint integrity.
One of its core functions is the ability to
computer is compromised by malware
Limitations of today’s NAC solutions isolate processes and applications
outside a company network, the company’s
All current NAC concepts – including those securely. Any process or application can
security mechanisms will be bypassed
listed above – have limitations. The core run in parallel but in strictly isolated
upon its reintegration into the company
limitation is the lack of trustworthiness environments which are called
network.
caused by the use of common operating ‘compartments’. A security relevant
systems. The trustworthiness created by application – such as an online banking
Even today there are possibilities for
any NAC solution depends on the application – runs in isolation from a
expanding networks in a flexible manner
trustworthiness of the client’s common operating system. Any access by
and equipping them with security services
measurement readings representing the the operating system, or any other
– for example via Virtual Private Networks
client state. By the use of common compartment, to data which is stored in
(VPNs). However these security
operating systems, malware can this compartment is prevented. In this way
mechanisms cannot guarantee the
manipulate the measurement readings at even compromised compartments cannot
trustworthiness and the identity of the
any time which leads to a paradox. be used by an attacker to access the
computer systems that are used.
Because of this permanent risk of isolated data.
The Network Access Control (NAC) unnoticed falsification, any collected data
must be considered as being compromised Integration of TNC into the Turaya
concept aims to make the trustworthiness
and therefore not trustworthy. This was security kernel
of computer systems verifiable to allow
demonstrated at the Black Hat Conference The potential of the Turaya security
trustworthy and secure network
2007 using Cisco NAC. By means of a platform to separate compartments with
connections. In a NAC-enabled network,
modified Cisco Trust Agent (CTA) it was running applications is also a great
the configuration of any connecting
possible at all times – irrespective of the advantage for NAC. The applications that
computer system is checked before it is
computer status – to gain access to a NAC- need to be measured and the TNC
allowed network access. Only if predefined
protected network. components can be isolated securely by
security policies are fulfilled will a
means of the security platform. The
computer system be considered
Solution: integration of NAC into security simultaneous compromising of an
trustworthy and allowed to access the
platforms application as well as the TNC components
network and the connected services.
The limitation mentioned above can only be is made considerably more difficult to
Computer systems with a faulty or
solved by integrating NAC into a security accomplish for a possible attacker. Faulty
undesirable system configuration cannot
platform. This article gives an example of integrity measurements of the applications
enter the network.
such an integration on the basis of the are therefore prevented.
>>
ENISA Quarterly Review Vol. 5, No. 3, September 2009
 TECHNOLOGIES

However, the ‘integration’ is not trivial. As

applications of the security kernel, the
TNC components have to rely on the
integrity of the kernel itself. This cannot be
determined securely by TNC, due to the
fact that a possible compromise of the
security kernel would cause the
measurement values collected by this
kernel not to be trustworthy. At this point
one paradox is exchanged for another.

A promising approach which prevents a

new paradox is the combination of TNC
with another Trusted Computing concept –
Remote Attestation.
Like NAC concepts, Remote Attestation
allows integrity checks of remote
computer systems to verify their
trustworthy state. If a computer system’s
configuration has changed, the attestation
would fail, allowing the communication
partner to abort the network connection.
There are three entities participating in a
Remote Attestation. Besides the computer
system whose state has to be checked and
the computer system that is demanding
the attestation, the presence of a Third
Party (or Trusted Party) is required to
perform the certification. Without the
process of certification by a third party
there is no possibility of performing a
Remote Attestation, other than the so
called Direct Anonymous Attestation
(DAA), introduced in the TPM-Specification
1.2.
On the downside, any change in the
computer system’s state – even that
caused by a new antivirus signature –
could result in a recertification. This
Combination of Attestation and TNC
recertification has to be executed in a
trustworthy (and complex) process. In the
case of an antivirus scanner, which may be
updated many times a day, this procedure
is not practical. It is therefore more
practical to exclude frequently changing
applications from a Remote Attestation.
A combination of TNC/NAC and Remote
Attestation raises trusted and manageable
verification of computer systems to a
higher level, but avoids the limitations
resulting from the use of a single testing
method. As a computer system’s integrity
has to be checked, the security platform
and the TNC components are measured by
Remote Attestation, while applications
such as a firewall or an antivirus
application are tested by TNC. As long as
the configuration of the security platform
remains relatively static (stable), the
number of recertifications is minimised. At
the same time it is possible to check
compartments and applications with often
changing configuration – for example an
antivirus application – by a trustworthy use
of TNC (see diagram above).
As a result, the use of NAC in combination
with Trusted Computing functions enables
trustworthy communication which in turn
establishes a base for new trustworthy
applications.
Marian Jungbauer (marian.jungbauer
@informatik.fh-gelsenkirchen.de) is a
researcher at the Institute for Internet
Security at the University of Applied
Sciences Gelsenkirchen in Germany.
Norbert Pohlmann (norbert.pohlmann
@informatik.fh-gelsenkirchen.de) is a
Professor at the Institute for Internet
Security at the University of Applied
Sciences Gelsenkirchen in Germany and a
member of ENISA’s Permanent
Stakeholders’ Group.

ENISA wishes to thank all the contributors Editor-in-Chief, Panagiotis Trimintzios:

to the publication. Please remember that all
contributions reflect the views of their
authors only, and are not in any way
endorsed by the European Network and
Information Security Agency. ENISA
assumes no responsibility for any damages
that may result from use of the publication
contents or from errors therein.
eq-editor@enisa.europa.eu
More about ENISA
For the latest information about ENISA,
check out our website at:
www.enisa.europa.eu.

The ENISA Quarterly Review is European Communities, 2009

published once each quarter. You can find Reproduction is authorised provided the
information about the ENISA Quarterly source is acknowledged.
Review, including back issues and
subscription information, on the EQR
pages on the ENISA website:
www.enisa.europa.eu/publications/eqr