Projektstatusbericht. EICAR Minimum Standard für AV Produkte. Rainer Fahs EICAR WG II Meeting 10. Februar 2015

Größe: px

Ab Seite anzeigen:

Download "Projektstatusbericht. EICAR Minimum Standard für AV Produkte. Rainer Fahs EICAR WG II Meeting 10. Februar 2015"

Claus Gehrig
vor 8 Jahren
Abrufe

1 Prjektstatusbericht EICAR Minimum Standard für AV Prdukte Rainer Fahs EICAR WG II Meeting 10. Februar 2015

2 Prjektübersicht Einfache frmulierte Minimalanfrderungen für AV Prdukte? Erhöhung vn Transparenz und Vertrauen in AV Prdukte Zunächst beschränkt auf AV Prdukte, erweiterbar auf IT Sicherheitsprdukte

3 Aktueller Status Idee auf Expert Meeting Februar 2014 bei G-Data? Erster Entwurf vn P. Stelzhammer (AV Cmparatives)? Kmmentare und Vrschläge durch Expertenrunde U. a. AV Cmparatives, G-Data, Uni Mannheim, Uni Hannver Knslidierter Entwurf vn R. Fahs Erweiterung der Expertenrunde auf AV Hersteller (G-Data, F-Secure, Trend, Kasperski, AVIRA) Sicherung vn Mitarbeit im Bereich Verschlüsselung durch Uni Leuven? Schwierigkeiten mit Frmulierungen im Bereich Eigentum vn Cde und Verschlüsselungsimplementierung? Zeitliche Zielvrgabe (ein Jahr) eingehalten?

4 EICAR Minimum Standard für AV Prdukte (endgültiger Entwurf) EICAR Minimum Standard fr Anti-Virus (Malware) prducts a. T claim adherence t the EICAR Minimum Standard an Anti-Virus/Anti-Malware Prduct shall fulfil the fllwing requirements: i. The requirements in this standard apply t all parts f the prduct including: 1. Cde develped by the vendr 2. Cde develped by external parties and included in the prduct by the vendr 3. Cde run n the user s device 4. Backend systems perated by the vendr t the extent they stre r prcess data received frm the user s device ii. The vendr shall have a sufficient understanding f all cde in the prduct, bth internally and externally develped, t be able t ensure cmpliance with this standard. iii. The vendr shall have sufficient cntrl ver all parts f the prduct s cde, bth internally and externally develped, t make sure that any discvered faults that cnflict with this standard can be amended prmptly.

5 EICAR Minimum Standard für AV Prdukte (endgültiger Entwurf) iv. The vendr shall publish a Privacy Declaratin cvering the prduct. This declaratin is written in a clear and cmprehensive way and des nt bfuscate relevant infrmatin. It cntains at least the items mentined elsewhere in this standard and is kept up t date when new versins f the prduct is released. v. The prduct is designed t fulfil slely its claimed bjectives; the claimed bjectives are fully described in the prduct s Privacy Declaratin vi. vii. The vendr des nt supprt any scheme that requires the nndetectin f malicius activities. The prduct des nt cntain any hidden functinality r any ther intended functinality that is nt anticipated by the claimed bjectives. viii. Mre specifically, the prduct des nt cntain any back dr * and the vendr des nt supprt any Third Party Access (TPA) scheme.

6 EICAR Minimum Standard für AV Prdukte (endgültiger Entwurf) ix. The prduct uses cryptgraphic methds t prtect data that is transferred t and frm the device. The vendr uses cryptgraphic methds t ensure the integrity f any cde r data installed n the user s devices as part f the prduct. Any used cryptgraphic methd is based n algrithms and prtcls that are cnsidered t be f sufficient strength. Cde prviding cryptgraphic algrithms and prtcls is either based n widely accepted crypt libraries r therwise engineered t prvide sufficient security and be f sufficient quality. x. Infrmatin identifying the device wner, the prduct license wner r any ther persn using the device must nt be transferred t the vendr unless there is a cmpelling reasn. The Privacy Declaratin shall state if such data is transferred, t what extent and fr what reasn. xi. User-wned cntent, like cntacts, messages and dcuments, must nt be transferred t the vendr withut the user s explicit cnsent. The Privacy Declaratin shall state if such data is transferred, t what extent and fr what reasn.

7 EICAR Minimum Standard für AV Prdukte (endgültiger Entwurf) xii. xiii. xiv. xv. xvi. Technical infrmatin, like device cnfiguratin, infrmatin abut installed and run applicatins, the applicatin files, usage f features in the prduct r the system, installed updates and ther similar data, can be upladed t the vendr if that is beneficial fr fulfilling the prduct s intended purpse and isn t in cnflict with any significant user interest. The Privacy Declaratin shall state if such data is transferred, t what extent and fr what reasn. Any data cllected frm the user s device is prtected in accrdance with applicable legal data prtectin requirements. The Privacy Declaratin shall state what r which cuntries data frm the user s device may be stred in. Authrity access t user data stred under the vendrs cntrl is slely prvided in accrdance with current laws f users natinal legal systems. Malicius cde and ptentially cntained user data is stred at the vendr s facility in a secure manner ensuring that nly authrised persns have access t the stred cde and data. Exchange f malicius cde with ther legitimate entities r individuals is kept t the necessary minimum and is in adherence with the EICAR Cde f Cnduct. b. The wner/vendr f the prduct agrees t be subject t an independent evaluatin and verificatin f the abve identified requirements. * back dr in the sense f the EICAR Minimum Standard means any, published r nn-published access t the applicatin r its cde ther than the access described with the claimed bjectives.

8 Zeitachse

9 Ausblick Frschung im Bereich Evaluierung und Zertifizierung (Uni Mannheim)? Frschung im Bereich Verifizierung vn Verschlüsselung (Uni Leuven)? Zusammenarbeit mit EU (MAPPING)? Zusammenarbeit mit BSI im Bereich Cmmn Criteria review? Mögliche Erweiterungen (Test, Testlabre)

Ähnliche Dokumente

Projektstatusbericht

Projektstatusbericht EICAR Minimum Standard für AV Produkte Rainer Fahs DuD Berlin 15. Juni2015 Projektübersicht Einfache formulierte Minimalanforderungen für AV Produkte Erhöhung von Transparenz und Vertrauen