DOCSLIB.ORG

Standards Supporting Certification

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Standards Supporting Certification STANDARDS SUPPORTING CERTIFICATION Analysis of Standards in Areas Relevant to the Potential EU Candidate Cybersecurity Certification Schemes DECEMBER 2019 0 STANDARDS SUPPORTING CERTIFICATION December 2019 ABOUT ENISA The mission of the European Union Agency for Cybersecurity (ENISA) is to achieve a high common level of cybersecurity across the Union, by actively supporting Member States, Union institutions, bodies, offices and agencies in improving cybersecurity. We contribute to policy development and implementation, support capacity building and preparedness, facilitate operational cooperation at Union level, enhance the trustworthiness of ICT products, services and processes by rolling out cybersecurity certification schemes, enable knowledge sharing, research, innovation and awareness building, whilst developing cross-border communities. Our goal is to strengthen trust in the connected economy, boost resilience of the Union’s infrastructure and services and keep our society cyber secure. More information about ENISA and its work can be found at www.enisa.europa.eu. CONTACT For contacting the authors please use [email protected]. For media enquiries about this paper please use [email protected]. EDITORS Ioannis Agrafiotis, Dorin Bugneac, Slawomir Gorniak AUTHORS Inigo Barreira, Hendrik Dettmer, Massimiliano Masi, Leire Orue Echevarria, Andreas Sfakianakis LEGAL NOTICE Notice must be taken that this publication represents the views and interpretations of ENISA, unless stated otherwise. This publication should not be construed to be a legal action of ENISA or the ENISA bodies unless adopted pursuant to the Regulation (EU) No 2019/881. This publication does not necessarily represent state-of the-art and ENISA may update it from time to time. Third-party sources are quoted as appropriate. ENISA is not responsible for the content of the external sources including external websites referenced in this publication. This publication is intended for information purposes only. It must be accessible free of charge. Neither ENISA nor any person acting on its behalf is responsible for the use that might be made of the information contained in this publication. COPYRIGHT NOTICE © European Union Agency for Cybersecurity (ENISA), 2019 Reproduction is authorised provided the source is acknowledged. Copyright for the image on the cover and on the internal pages: © Shutterstock For any use or reproduction of photos or other material that is not under the ENISA copyright, permission must be sought directly from the copyright holders. ISBN 978-92-9204-329-2, DOI 10.2824/40722 1 STANDARDS SUPPORTING CERTIFICATION December 2019 TABLE OF CONTENTS 1. INTRODUCTION 5 2. CYBERSECURITY ACT 6 3. INTERNET OF THINGS (IOT) 8 3.1 IOT LANDSCAPE 9 3.1.1 Eurosmart cybersecurity certification scheme for IoT 9 3.1.2 ETSI 303 645 12 3.1.3 Other relevant frameworks and suggestions 13 3.2 POTENTIAL CANDIDATE FOR A EUROPEAN IOT CYBERSECURITY CERTIFICATION SCHEME 14 4. ANALYSIS OF THE STANDARDS LANDSCAPE FOR CLOUD SERVICES 16 4.1 OVERVIEW OF LANDSCAPES 16 4.2 POTENTIAL CANDIDATE FOR AN EU CYBERSECURITY CERTIFICATION SCHEME FOR CLOUD 19 5. ANALYSIS OF THE STANDARDS LANDSCAPE FOR THREAT INTELLIGENCE-BASED FRAMEWORK 26 5.1 OVERVIEW OF THE TIBER-EU FRAMEWORK 26 5.1.1 History of Threat Intelligence-led Red Teaming Frameworks 26 5.1.2 Overview of TIBER-EU Framework 27 5.2 POTENTIAL CANDIDATE EUROPEAN CYBERSECURITY CERTIFICATION SCHEME 28 5.2.1 Gaps and opportunities for certification schemes 28 5.2.2 Security objectives of European cybersecurity certification scheme for TIBER-EU 29 5.2.3 Assurance levels of European cybersecurity certification scheme for TIBER-EU 30 5.2.4 Security requirements for the cybersecurity certification scheme for TIBER-EU 31 5.2.5 TIBER-EU certifications for individuals 34 6. ANALYSIS OF THE STANDARDS LANDSCAPE ON E- HEALTH RECORDS 36 6.1 OVERVIEW OF LANDSCAPE FOR EHR 36 6.2 POTENTIAL CANDIDATE CYBERSECURITY CERTIFICATION SCHEME FOR SHARING EHRS 38 2 STANDARDS SUPPORTING CERTIFICATION December 2019 6.2.1 Potential product/service or process that can be evolved to a cybersecurity certification scheme. 38 6.2.2 Assurance levels based on risk assessment 38 6.2.3 Potential rules/standards for the schemes 39 7. ANALYSIS OF THE STANDARDS LANDSCAPE IN RELATION TO QUALIFIED TRUST SERVICE PROVIDERS 42 7.1 OVERVIEW OF EIDAS REGULATION ON QUALIFIED TSP AND TRUST SERVICES 42 7.1.1 Initiation and supervision 43 7.1.2 TSP supervisory scheme 44 7.2 OVERVIEW OF STANDARDS’ LANDSCAPE 44 7.2.1 eIDAS Regulation requirements 44 7.2.2 ETSI certification scheme 45 7.2.3 WebTrust for CAs assurance audit 45 7.2.4 Cab Forum, CAs and browsers 45 7.2.5 ISO/IEC 27000 series 46 7.2.6 Identification of gaps in current practice to acquire a qualified status. 47 7.3 POTENTIAL CANDIDATE FOR A CYBERSECURITY CERTIFICATION SCHEME 48 7.3.1 Potential product/service or process that can be evolved to a cybersecurity certification scheme. 48 7.3.2 Identification of potential rules/standards for the schemes 48 8. CONCLUSIONS 50 REFERENCES 51 3 STANDARDS SUPPORTING CERTIFICATION December 2019 EXECUTIVE SUMMARY In September 2017, the European Commission presented a proposal for a Regulation, dubbed the Cybersecurity Act, with a view to harmonise the current cybersecurity certification activities and policies across the Member States. ENISA has a pivotal role in this new EU cybersecurity certification framework, since it is tasked to prepare candidate schemes. This report explores five distinct areas, which have frameworks, schemes or standards that can potentially be evolved to EU candidate cybersecurity certification schemes. These five areas are the Internet of Things (IoT), cloud infrastructure and services, threat intelligence in the financial sector, electronic health records in the healthcare and qualified trust services. This report reflects on standards currently available on these five areas of interest (i.e., Eurosmart IoT Certification scheme, SESIP, TIBER EU Framework) to identify gaps. It further proposes reasonable recommendations based on Articles 51, 52 and 54 of the CSA on how these gaps can be addressed and how the available standards could potentially be adapted to form the basis of future candidate EU cybersecurity certification schemes. A key finding of this exercise is that for a potential EU candidate scheme to be successful, the levels of assurance should reflect the market needs. There are technical rules in standards that can provide the guiding principles for assurance levels in all five areas. Further investigation is required on how these rules will be allocated to different levels, specifically for technical metrics which are present in all three levels with variant objectives (e.g., time to perform patch management). In all five areas there are opportunities for products (smart home devices for Internet of Things area, test-beds for validating interoperability in the electronic heath records domain), processes (accreditation schemes to harmonise the process of providing a qualified status to Trust Service Providers) and services (penetration testing for the financial sector and cloud services such as Platform as a Service). 4 STANDARDS SUPPORTING CERTIFICATION December 2019 1. INTRODUCTION In September 2017, the European Commission presented a proposal for a Regulation, dubbed the Cybersecurity Act (hereinafter CSA)1, with a view to harmonise the current cybersecurity certification activities and policies across the Member States. The CSA was published on 7th of June 20192 in the official EU journal and entered into force on the 27th of June 2019. The CSA follows on an array of legal instruments that compose the legal framework of the Digital Single Market. It further benefits from the framework on standardisation laid out by means of Regulation 1025/2012 and standardisation and provisions on conformity assessment laid out in Regulation 765/2008. The CSA is a multi-layered Regulation that on the one hand addresses the updated ENISA mandate and on the other it lays out the EU cybersecurity certification framework. With regard to the latter, ENISA has been tasked with new competences, being to prepare candidate cybersecurity certification schemes. Furthermore, ENISA will assist the Commission in carrying out certain roles (e.g. in the European Cybersecurity Certification Group (ECCG), co-chair with the Commission the Stakeholders Cybersecurity Certification Group (SCCG)) that contribute to the overall process of designing European cybersecurity certification schemes. This report provides an analysis of the landscape of standards in five distinct key areas, followed by recommendations on how these standards can be evolved to potential European cybersecurity certification schemes by reflecting on three articles of the CSA. The five key areas are the Internet of Things (IoT), cloud infrastructure and services, threat intelligence in the financial sector, electronic health records in the healthcare and qualified trust services. This report reflects on standards currently available in these five areas of interest (i.e., Eurosmart IoT Certification scheme3, SESIP, TIBER EU Framework4 with emphasis on identifying gaps and proposing reasonable recommendations based on Articles 51, 52 and 54 of CSA on how these standards could potentially be adapted to form the basis of future candidate cybersecurity certification schemes. 1 Regulation (EU) 2019/881 of the European Parliament and of the Council of 17 April 2019 on ENISA (the European Union Agency for Cybersecurity)
Load more

Recommended publications
  • TIBER-EU Services Procurement Guidelines
    TIBER-EU Framework Services Procurement Guidelines August 2018 Contents 1 Executive summary 3 1.1 What is TIBER-EU? 4 1.2 What are the risks of the TIBER-EU test? 4 1.3 What are the Services Procurement Guidelines? 4 2 Introduction 6 2.1 Use of the Services Procurement Guidelines 6 2.2 Structure of the Guidelines 6 2.3 Target audience of the Guidelines 7 2.4 Multinational entities 7 2.5 Procurement agreements 7 3 Threat intelligence providers 9 3.1 Threat intelligence for TIBER-EU 9 3.2 The role of the TI provider 10 3.3 TI provider requirements 10 3.4 Guiding principles and criteria for selecting TI providers 12 4 Red team providers 18 4.1 The role of RT provider 18 4.2 RT provider requirements 19 4.3 Guiding principles and criteria for selecting RT providers 20 5 Possible roles of authorities 25 6 Annexes 26 6.1 List of qualifications and certifications 26 6.2 List of questions to facilitate the procurement process – TI providers 27 6.3 List of questions to facilitate the procurement process – RT providers 31 6.4 TI provider agreement checklist 34 TIBER-EU Framework – Services Procurement Guidelines 1 6.5 RT provider agreement checklist 36 TIBER-EU Framework – Services Procurement Guidelines 2 1 Executive summary The Threat Intelligence-based Ethical Red Teaming (TIBER-EU) Framework enables European and national authorities to work with financial infrastructures and institutions (hereafter referred to collectively as “entities”1) to put in place a programme to test and improve their resilience against sophisticated cyber attacks.
    [Show full text]
  • Security Certifications - 2016 Security Certifications
    Security Certifications - 2016 Security Certifications Roy Gertig, CISSP SSCP CISA CISM Security+ SCSecA NSA-IAM/IEM PMP Project+ ITILv3 SSGB CVE4.0 TCC SCSA CIW-Pro Linux+ LPIC-1 SUSE-CLA Storage+ Server+ A+ N+ iNet+ CDIA+ Information current as of July 2016 © SAIC. All rights reserved. Disclaimer • The acronyms used throughout this presentation are either “registered®” or “trademarked™” and are a product of their respective companies • This presentation covers a multitude of certifications, but by no means is all inclusive • This presentation is to be used as a resource and the links throughout work as of today 3 S A IC.c om © SAIC. All rights reserved. | SAIC Communications Agenda • (ISC)2 and Test Builds • Government and Information Assurance • Overview of Security Certifications • Have some fun 4 S A IC.c om © SAIC. All rights reserved. | SAIC Communications First, a story • Reminiscence 5 S A IC.c om © SAIC. All rights reserved. | SAIC Communications What do these have in common? IRS / IG 6 S A IC.c om © SAIC. All rights reserved. | SAIC Communications Answer We’re here to help! 7 S A IC.c om © SAIC. All rights reserved. | SAIC Communications What do these have in common? (ISC) 2 / IRS 8 S A IC.c om © SAIC. All rights reserved. | SAIC Communications Answer They both want your money! 9 S A IC.c om © SAIC. All rights reserved. | SAIC Communications (ISC)2 Banquet . Workshop Timetable – Starts on a Friday AM, ends Sunday PM . NDA – 24 month limitation – Possible loss of CPE and Certs . Why hold workshops – Several times a year to update and refresh item test bank 10 S A IC.c om © SAIC.
    [Show full text]
  • IT Security Audit (Full Scope of Audit)
    EMPANELLED INFORMATION SECURITY AUDITING ORGANISATIONS by CERT-In The List of IT Security Auditing Orgnisations, as given below, is up-to-date valid list of CERT-In Empanelled Information Security Auditing Orgnisations. This list is updated by us as soon as there is any change in it. 1. M/s AAA Technologies Pvt Ltd 278-280, F-Wing, Solaris-1, Saki Vihar Road, Opp. L&T Gate No. 6, Powai, Andheri (East), Mumbai – 400072. Website URL : http://www.aaatechnologies.co.in Ph : 022-28573815 Fax: 022-40152501 Contact Person : Mr. Anjay Agarwal, Chairman & Managing Director Mobile : +91 09322265876, 9821087283 E-mail : anjay[at]aaatechnologies.co.in 2. M/s AUDITime Information Systems (I) Ltd. A-504, Kailash Esplanade, L B S Marg, Ghatkopar (West), Mumbai – 400086 Ph: 022 40508210 Fax: 022 40508230 Contact Person :Mr. Madhav Bhadra, Director Mobile : +91 9320253902 E-mail: mmb[at]auditimeindia.com 3. M/s AKS Information Technology Services Pvt Ltd E-52, Sector-3, Noida – 201301. Website URL : http://www.aksitservices.co.in Ph: 0120-4545911, 0120-2542253 Fax : 0120-4243669 Contact Person : Mr. Ashish Kumar Saxena, Managing Director Mobile : +91 7290058951 E-mail : info.cert[at]aksitservices.co.in 4. M/s Aujas Networks Pvt Ltd #595, 4th floor, 15th Cross, 24th Main, 1st Phase, JP nagar, Bangalore, Karnataka- 560078. Website URL : http://www.aujas.com/ Ph : 080-26087878 Fax: 080-26087816 Contact Person : Mr. Jaykishan Nirmal, Vice President Mobile : +91 9980238005 E-mail : Jaykishan.Nirmal[at]aujas.com 5. M/s AGC Networks 2nd Floor, Equinox Business Park, Tower 1, (Peninsula Techno Park), Off Bandra Kurla Complex, LBS Marg, Kurla (West), Mumbai – 400070, INDIA Ph : +91 2266617490 Ext.
    [Show full text]
  • Cybersecurity Fortification Initiative 2.0
    Annex Cybersecurity Fortification Initiative 2.0 The HKMA has conducted a holistic review of the Cybersecurity Fortification Initiative (CFI) taking into account i) the experience gained in the past few years; ii) feedback of authorized institutions (AIs) obtained via an industry survey and interviews with selected institutions; and iii) overseas developments and new practices. The HKMA then issued a consultation paper in January 2020 putting forward a set of recommendations to enhance the three pillars of the CFI. Two workshops were conducted with members of the Hong Kong Association of Banks (HKAB), one in March and another in June, to discuss the industry feedback received during the consultation. A revised CFI, or CFI 2.0, is subsequently developed, having regard to the findings of the review. The revised framework aims to simplify the assessment process while maintaining effective control standards that are commensurate with latest technology trends. Substantial efforts will be made to expand the talent supply and encourage cyber threat intelligence sharing across the industry. Details of the major enhancements are set out below. C-RAF 2.0 – Risk assessment Introduction of new and enhanced control principles reflecting recent international sound practices in cyber incident response and recovery, as well as latest technology trends (e.g. cloud technology and virtualisation security); Introduction of Blue team requirements for iCAST to measure the effectiveness of detection, response and recovery functions of AIs; Allowing more
    [Show full text]
  • Pentest MARKET 01 2012__T
    �������������� ������������������������������������������������� ��������������������������������������������� ��������������� ��������������� �������������������������������������������� ���������������������������������������������� ���������������������������� ������������������������������������������������������������������������� ���������������������������������� � EDITOR’S NOTE Market 01/2012 (01) Something Fresh, Something New – PenTest Market! March is going to be an extraoridary month for the PenTest gang! We can finally present to you our new project – PenTest Market. This magazine is going to make all the difference. You will see pentesting from a different perspective. Our contributors come from the IT security world but not exclusively. Especially for you we invited potential clients of pen testers to show the other side of the barricade. This is a great opportunity to learn about their expectations. The thing that makes this magazine unique is structure. PenTest Market will consist mainly of interviews with IT security specialists, who will share their experience with you. We will also include some reports about pentesting market in different parts of the world and several guides, for example: „How to recruit a pentester?, etc. I am sure that we have many great issues of this magazine ahead. Now, however, let’s focus on what we have in this pioneer issue. On the cover you can see Derek Manky, who is the Senior Security Strategist of Fortinet, where he is in charge of directing the FortiGuard research team. We have talked with Derek about hiring for the FortiGuard, cyber war and some more interesting subjects, which you can find on page 06. These days it is hard to find good pentesters or any other IT security specialists. This is a quite big problem for companies. That matter is described by Fabiana Schütz in a revealing article „The Hunt for Pentesters”.
    [Show full text]
  • Mohamed Hasabo Eltayeb
    Mohamed Hasabo Eltayeb Email: [email protected] Contact: +966554491034 Linkedin: https://www.linkedin.com/in/mohamed-eltayeb-44a35bba OBJECTIVE: Provide network, systems, and security experience, knowledge, and solutions in a system and network diverse environment. Protect confidentiality, integrity, and availability of information and information systems. Advise and engineer secure solutions for business opportunities. Learn and experience, mentor and share. Education and Certifications: BSC. Information Systems & management (Madras University,2009-2012 ,India) Offensive Security Certified Professional (OSCP) elearnSecurity Certified Professional Penetration Tester (eCPPT) elearnSecurity Web Penetration Tester (eWPT) EC-council Certified Ethical Hacker (CEHv9) Computer Hacking Forensic Investigation (CHFI) Cyber Security Analyst (CySA+) Palo Alto Certified Network Security Engineer (PCNSE) Fortinet NSE4 Security Professional PECB ISO 27001 Lead Implementer PECB ISO 27005 Lead Risk Manager PECB ISO 22301 Lead Implementer Cisco Certified Security Professional (CCNP-Security) Cisco Certified Networks Associate Security (CCNA Security) Cisco Certified Network Professional (CCNP Routing & Switching) Cisco Certified Networks Associate (CCNA Routing & Switching) Microsoft Certified Solutions Associate (Windows Server 2012) AREA OF EXPERTISE: Penetration Testing Tools (Metasploit.Nessus,Qualys,Core Impact,CANVAS,KALI,RED-ARCH linux) 1 Web Application Penetration Testing Tools (Fortify ,Acuentix ,Appsec,Nstalker,Vega,OWASP-
    [Show full text]
  • Certifications
    CERTIFICATIONS Our highly qualified security professionals have decades of combined experience servicing complex organisations across the CampusGuard is your partner globe, and hold the following certifications: for cybersecurity, privacy, and QSA – Qualified Security Assessor compliance ASV – Approved Scanning Vendor PCIP – Payment Card Industry Professional Our mission is to guide complex organisations through CISSP – Certified Information Systems Security Professional all of their information security, privacy, and compliance needs in order to establish and maintain a secure and CISM – Certified Information Security Manager compliant environment within their IT areas and busi- CISA – Certified Information Systems Auditor ness operations. OSCP – Offensive Security Certified Professional OSWP – Offensive Security Wireless Professional CampusGuard provides a full range of services that eMAPT – Mobile Application Penetration Tester are the result of our comprehensive knowledge of the CEH – Certified Ethical Hacker unique nature and needs of complex environments. CHFI – Computer Hacking Forensic Investigator eWPT – eLearnSecurity Web App Penetration Tester GCIH – GIAC Certified Incident Handler Cybersecurity and Compliance and more availabile upon request. for Complex Organisations www.CampusGuard.com [email protected] FRAMEWORKS & STANDARDS ISO/IEC 27000 Series ISO 7000 999 CIS COBIT Essential Eight Maturity Model OWASP Cybersecurity and Compliance challenges are much different for complex organisations CYBERSECURITY Customers across the globe have come to rely on their dedicated CampusGuard team to provide reliable, accurate, and timely support for their information security and compliance needs. Our services are considered to be some of the most inclusive in the industry, supporting our CampusGuard mission assuring that ONGOING SUPPORT our customers have the highest level of expert services available. CampusGuard’s unique customer-centric service delivery model is at the center of who we are and what we do.
    [Show full text]