Secure Services and Quality Testings SST. Security Engineering Privacy by Design Trusted Solutions. Mario Hoffmann. for Service Ecosystems

Transkript

1 Secure Services and Quality Testings SST Security Engineering Privacy by Design Trusted Solutions for Service Ecosystems Mario Hoffmann Head of Department Secure Services & Quality Testing

2 Fraunhofer-Institute for Secure Information Technology Competencies SOA- & -Security Data protection / web 2.0 Information Rights Management Risk-Management Methods for security testing Biometrics / Smart cards Hardware & embedded security Side channel attacks / robustness IT-Forensics Anti-Product-Piracy

3 Secure Services & Quality Testing Research Areas CS Security Security Implications in Computing Ecosystems Risk Analyses and Technology Studies IdM Identity Management Development of Security Concepts in Identity Ecosystems SOA SOA Security Research and development of service oriented achitectures for the Internet of People, Things and Services Lab Testlab Installation & Evaluation of Open Source Solutions for Computing, Identity Management and Service Architectures

4 Computing in a nutshell It s all about outsourcing and virtualisation... so what s new about it? Characteristics by NIST 1. On-demand self-service 2. Broad network access / Ubiquity 3. Resource pooling / Multi-tenancy 4. Rapid elasticity 5. Measured Service / Pay-per-use LEGEND: NIST: National Institute of Standards and Technology, USA,

5 Computing Deployment Models low Economy of Scales high private hybrid public strong Control weak

6 Computing Deployment Models++ low Economy of Scales high Community private hybrid public strong Control weak

7 Computing Service Models low Economy of Scales high high low Community Software as a Service Abstraction private hybrid Platform as a Service Infrastructure as a Service public Flexibility low strong Control weak high

8 Service Examples in Germany Well, thanks for the technical overview... but how can a local authority benefit from Computing? Service Overview Hansestadt Lübeck (200T inhabitants): stadt LÜBECK: Bewohner: Bürgerservice: Dienstleistu... Offizielle Website der Hansestadt Lübeck Dienstleistungen von A - Z Die Verwaltung der Hansestadt Lübeck bietet ein breites Spektrum an Dienstleistungen. Was Sie bei den einzelnen Ämtern und Bereichen erledigen können, finden Sie in der Rubrik Dienstleistungen von A bis Z ebenso wie Angebote nicht-städtischer Behörden, Institutionen und Organisationen. Verzeichnis A-Z A-C D-F G-J K-M N-P Q-S T-V W-Z Abbruchgenehmigung Abfallberatung Abfallsäcke Abfuhr von Fäkalschlamm Abgeschlossenheitsbescheinigung Abmeldung von Personen Absenken von Grundwasser im Rahmen von Baumaßnahmen Abwassersammelgruben Adoptionsvermittlung Akteneinsicht Baugenehmigung Aktuelles aus dem Gesundheitsamt Alkohol- und Suchtberatung Altenpflegeheime (nicht städtisch) Altenpflegeheime (städtische) Altentagesstätten / Seniorenbegegnungstätten Amtliche Bekanntmachungen / Ausschreibungen Amtsärztliche Gutachten Amtstierärztliche Angelegenheiten Anmeldung eines Sterbefalles Anmeldung von Geburten Anmeldung von Personen Anmietung von Räumen im Rathaus Anmietung von stadteigenen Gebäuden Anonyme Geburten Anpassung an den Klimawandel Ansprechpartner für Unternehmen Antrag auf Beschulung von Schülern aus einem anderen Kreis Anzeige von Brauchwasserbrunnen Anzeige von Erdaufschlüssen und Anzeige zur Errichtung von Erdwärmesonden Arbeiterwohlfahrt (AWO) - Beratungen pages Hansestadt LÜBECK: Bewohner: Bürgerservice: Dienstleistu... Waffen und Munition Wahlen Wasserversorgung Wegweiserin Weihnachtsbaumabfuhr Wespen WHO-Auszeichnung Winterdienst Wirtschaftliche Jugendhilfe (Jugendamt) Wohlfühlhauptstadt Lübeck Wohnberechtigungsschein Wohngeld Wohnungen Wohnungsbauförderung Wohnungsvermittlung (Sozialwohnungen) Zählerablesungen Zahnärztlicher Dienst Zivil- und Katastrophenschutz Zivildienst im Bereich Naturschutz Zweitwohnungssteuer From A To Z Home! Impressum! Sitemap! Suche! Kontakt Copyright 2010 LYNET Kommunikation AG (PG1) Adresse dieser Seite: /index.html?bereich=0 Abbruchgenehmigung... Zweitwohnungssteuer More than 400 services! Some potential for? For example: Service overlap with other cities and communes? Commune is too small to run its own infrastructures? Cities and communes will become Service Providers! :39

9 Example: apps.gov LEGEND: GSA: U.S. General Services Administration

10 Example: apps.gov Cities and communes are already Service Consumers! For example: US Department of Agriculture Moves to the Microsoft

11 Computing and Government (1/2) Major challenges facing Government in Implementing Computing 1. The need for scalability IT resources will need to become more flexible, agile in other words, scalable 2. The need for high reliability Service level agreement (SLA) with four-9s performance, guaranteeing percent uptime -> just 52 minutes of downtime per year. 3. The need for securing data in the Privacy and security questions will need to be addressed as public data and applications move into a cloud environment. 4. The need for open standards and interoperability From the original mainframe model, interoperability and lock-in have both been major concerns for it users, buyers, and administrators. 5. The need to revise procurement practices One of the challenges going forward will be to make acquiring cloud-based services as easy as possible to obtain. Source: Moving to the : An Introduction to Computing in Government, IBM and Southeastern Louisiana University, 2009,

12 Computing and Government (2/2) Major challenges facing Government in Implementing Computing 6. The need to resolve potential legal issues 7. The need to regulate the market 8. The need to redefine the roles of the IT workforce 9. The need to assess the return on investment of Computing 10.The need for Government Coordination Source: Moving to the : An Introduction to Computing in Government, IBM and Southeastern Louisiana University, 2009,

13 Top 7 Threats in Computing 1. Abuse of Computing Resources 2. Shared Technology Vulnerabilities 3. Data Loss or Leakage 4. Insecure Application Programmer Interface 5. Account, Service & Traffic Hijacking 6. Malicious Insiders 7. Unknown Risk Profile

14 made up of 4 main domains: infrastructure, application and platform, administration, and compliance. Each of these main areas and the associated security risks are discussed in detail in the following sections with a checklist of specified questions which a cloud consumer would be well advised to ask a cloud vendor. SIT s Study, 2009 Security Taxonomy f!"#$%$&'($)(*+,(-,./01*'("-2,.*-($)(.3$/4(.$&2/5%6(-'-*,&-( 9%)0"-*0/.*/0,( "5$%("%4( 74&1%1-*0"5$%( :$&231"%.,( 23"8$0&( A+'-1."3( -,./01*'( C$-*( D10*/"31E"5$%( F,*>$0?( Approach: Multilateral Security ;"*"(-,./01*'( "5$%( -,./01*'( A3"8$0&(-,./01*'( G,./01*'("-("( -,0<1.,( A+"-,-($)(-,0<1.,( /-,( 7/41*( 94,%5*'("%4(016+*-( &"%"6,&,%*( B,'(&"%"6,&,%*( 9%*,0$2,0"I131*'("%4( 2$0*"I131*'( ;"*"(201<".'( H1-??( &"%"6,&,%*( =,6"3( The Analysis interdependencies of different perspectives: between Consumer, each Apps of Provider, these areas Operator, areetc. analyzed in greater detail in the following and shown in Figure 5.3 to provide a further explanation of how the taxonomy can be used. Arrows indicate interdependencies between

15 SIT s Study, 2009 DOs and DON Ts (1) Use a holistic security concept (2) Integrate the services in an existing security concept (3) Build a relationship of trust between the cloud consumer and the cloud vendor (4) Protect the network infrastructure (6) Reuse basic services (7) Pay attention to lock-in effects (8) Request security certificates (9) Don t forgo security concepts for purely financial reasons (10) Use service level agreements (5) Use innovative security solutions for cloud computing systems

16 Conclusion & Take Aways made in Germany Impact of Computing Great potential for cities and communes for sharing standardised services in the (being both Service Consumer as well as Service Provider) Computing can be beneficial for local authorities (as well as small and medium sized companies) which cannot afford their own IT infrastructures Taking advantage of Germany s high data protection standards Follow IT-Security Design Principles IT-Security & Privacy by Design Follow a Multilateral Security Approach

17 References & Useful Links SST s Security study BSI (Germany s Federal Office for Information Security) RFC Minimal Requirements for Providers _Computing_Mindestsicherheitsanforderungen.pdf BITKOM Germany s National Initiative IT-Gipfel Euro Germany: BMWi Trusted Call, Jan 2011 (BMWi, Federal Ministry for Economics and Technology) Europe: EU-FP7, Call 8, Objective, Jan 2012 Security Alliance ENISA - European Network and Information Security Agency ITU-T (International Telecommunication Union) Workshop on Addressing security challenges on a global scale, Geneva, 6+7th Dec,

18 Secure Services & Quality Testing Cooperation Opportunities CS Security: Trend, technology, and feasibility studies, White Papers, Architecture Design, Demonstrators, especially Computing Security IdM Identity as a Service: Solutions based on standards, security requirements and privacy concerns enabling the ambient lifestyle SOA SOA Security: Design and development of security concepts, architectures, and prototypes for SaaS Lab Test-Bed: Security analyses as well as compliance and interoperability tests for SOA, IdM, and Computing

19 SST Contact Fraunhofer-Institute for Secure Information Technology Parkring Garching (near Munich) Germany Secure Services & Quality Testing SST Mario Hoffmann Head of Department Phone: +49-(0) Fax: +49-(0) Web: mario.hoffmann@sit.fraunhofer.de NEW Security Lab ( currently in German only) CeBIT 2011 Demonstrators ( Roaming, Cockpit)