AI security: The right measure for regulating AI
Homepage Admin

AI security: The right measure for regulating AI

Precisely because of their enormous potential, their diverse areas of appli­cation and their ability to learn, artificial intel­li­gence (AI) systems must be and remain safe and control­lable at the same time. Here, it is important to find the right balance in regulation.

Voice assis­tants, trans­la­tions at the push of a button, predictive mainte­nance or applicant management systems. Despite the diverse areas of appli­cation, artificial intel­li­gence (AI) is only at the beginning of its devel­opment. many of the future areas of appli­cation are not even foreseeable yet. This opens up great oppor­tu­nities for devel­opers and manufac­turers to achieve compet­itive advan­tages with improve­ments based on the use of artificial intelligence.

In addition to further coordi­nation, a great deal of detailed work will now have to be done in the future; the corre­sponding norms and standards will have to be worked out or adapted and proce­dures for conformity assessment will have to be developed. In doing so, the organ­i­sa­tional and technical effort for manufac­turers should be kept within reasonable limits so as not to hinder the devel­op­ments of AI systems. At the same time, it is also important to gain economic and social trust in this promising technology.

Under the german title “KI-Sicherheit: Das richtige Maß zur Regulierung von KI finden”, the magazine “it-daily” gave Randolf-Heiko Skerka, Division Manager IS Management at SRC Security Research & Consulting GmbH, the oppor­tunity to comment comprehensively.

If you are inter­ested, we look forward to hearing from you.

IT Security Act 2.0 approved by the Bundesrat (Upper House)
Homepage Admin

IT Security Act 2.0 approved by the Bundesrat (Upper House)

On Friday, 07 May 2021, the Bundesrat finally approved the contro­versial IT Security Act 2.0. The Bundestag had already approved it at the end of April 2021. In this regard, Federal Minister of the Interior Horst Seehofer spoke of a “good day for cyber security in Germany”. He commented: “Digital­i­sation permeates all areas of life, and the pandemic has once again accel­erated this process enormously. Our protection mecha­nisms & defence strategies must keep pace — this is what the IT Security Act 2.0 is for”. As early as November 2020, the discussion about the IT Security Act was reignited with a third draft bill. In terms of content, many aspects that were already the subject of the government draft from 2020 have been retained. However, they have been modified in detail. Thus, the continuing industry-wide criticism of the IT Security Act 2.0 seems hardly surprising.

Expanded powers for the BSI, inventory data disclosure and the so-called “Huawei clause

A central aspect of the new IT Security Act is the expanded powers for the Federal Office for Infor­mation Security (BSI). There are improve­ments in the draft law at least in the concreti­sation of overriding protection goals and the work of the BSI geared to them. In addition, the handling of vulner­a­bil­ities and security gaps is to become more trans­parent. The new law is intended to make the BSI a key player in the fight against botnets and the spread of malware. To this end, 799 new positions will be created.

Detection of security vulnerabilities

The BSI will be empowered to detect security vulner­a­bil­ities at the inter­faces of IT systems to public telecom­mu­ni­ca­tions networks by means of port scans. In addition, it will be allowed to use honeypots and sinkholes to analyse malware and attack methods.

Storage and collection of inventory and log data

A partic­u­larly critical aspect of data protection is that in future the BSI will be allowed to store and evaluate “log data” and personal user infor­mation (such as IP addresses) generated during online commu­ni­cation between citizens and federal admin­is­trative insti­tu­tions for a period of 12 to 18 months. This also includes internal “logging data” from the author­ities. Furthermore, the BSI may obtain inventory data infor­mation from providers of telecom­mu­ni­ca­tions services. This is intended to protect those affected and to detect attacks, e.g. by Trojans such as Emotet.

The so-called “Huawei clause” — hurdle for the exclusion of equipment suppliers

The so-called “Huawei clause” sets the hurdle for the exclusion of individual equipment suppliers from network expansion for 5G, for example, quite high. It is also part of the amendment. The federal government is to be able to prohibit the use of “critical compo­nents” in the event of “probable impairment of public safety and order”. To this end, there will be a certi­fi­cation oblig­ation and manufac­turers will have to issue a guarantee declaration.

In this regard, the BSI tweets in the sense of a “self-image” that security vulner­a­bil­ities will be commu­ni­cated trans­par­ently and remedied quickly, consumers will be provided with even more neutral, up-to-date infor­mation on digital topics and critical infra­struc­tures will be supported with close-meshed advice and supervision.

Strength­ening consumer protection and more security for businesses

In addition, the new IT Security Act contains regula­tions to strengthen consumer protection and increase security for companies. To this end, consumer protection is included in the BSI’s catalogue of tasks. Furthermore, a uniform IT security label will in future make it clear to consumers which products already comply with certain IT security standards.

In order to increase corporate security, operators of critical infra­struc­tures and, in the future, other companies in the special public interest (e.g. arms manufac­turers or companies of partic­u­larly great economic impor­tance) must implement certain IT security measures and will be included in the trustful exchange of infor­mation with the BSI.

Draft of a second ordinance amending the BSI Criti­cality Ordinance (BSI-KritisV) published

The IT-SiG 2.0 not only refers to the Critis Ordinance, it also expands the existing oblig­a­tions of the CRITIS operators. For this reason, it is not surprising that on 26 April 2021, the Federal Ministry of the Interior published the draft of a second ordinance amending the BSI Critis Ordinance as part of the consul­tation of associ­a­tions, specialist groups and academia. Corre­sponding comments are to be submitted by 17 May 2021.

The draft bill contains consid­erable changes and adjust­ments to the content as well as new additions in the individual annexes to determine the categories of instal­la­tions and concrete threshold values, in particular in part also the individual numerical assessment criteria. In addition, software and IT services that are necessary for the provision of a critical service are now also identified as invest­ments within the meaning of the regulation. Furthermore, trading in securities and deriv­a­tives is included as a new critical service.

Support from SRC experts

The SRC experts will be happy to exchange views with you on the innova­tions as well as their effects and support you in the imple­men­tation of the require­ments from IT-SIG and BSIG as well as in the provision of evidence within the scope of §8(a) BSIG (“Critical Service Examination”).

IT security in the health sector: Regulation is necessary and overdue
Homepage Admin

IT security in the health sector: Regulation is necessary and overdue

Open inter­faces, outdated technology and different interests: IT security in the health sector is a complex topic, after all it is about the needs and safety of the patient. A major problem is the lack of regulation on the part of author­ities such as the Federal Institute for Drugs and Medical Technology and the Federal Office for Infor­mation Security — currently there are only recom­men­da­tions but no binding guidelines.

The Federal Office for Infor­mation Security (BSI), the Federal Institute for Drugs and Medical Devices (BfArM) and gematik are the competent author­ities for IT security of medical devices in Germany. It must be ensured that unautho­rised persons cannot use the IT in medical devices and systems against the patient and that compo­nents and systems are only open to autho­rised persons. Companies special­ising in IT security, such as SRC Security Research & Consulting GmbH from Bonn, can help here. Regulation is necessary to create security standards — although a sense of proportion is needed here. Because over-regulation can also cause damage.

Under the title “IT Security in the Healthcare Sector: Regulation is necessary and overdue” (german), the magazine “all about security” gave Randolf-Heiko Skerka, Head of IS Management at SRC Security Research & Consulting GmbH, the oppor­tunity to comment comprehensively.

If you are inter­ested, we would be pleased to hear from you.

Homepage Admin

BSI publishes CC certifi­cates of connectors in the healthcare sector

Within the framework of the gematik telem­atics infra­structure, a connector coordi­nates and encrypts the commu­ni­cation between the client system, eGK, HBA/SMC and the central telem­atics infra­structure. It thus repre­sents the link between these compo­nents on the decen­tralised service provider side and the central telem­atics infrastructure.

A connector fulfils security require­ments that have been laid down in corre­sponding protection profiles.

The connector in product type version 3 comprises the following components:

  • the network connector,
  • the appli­cation connector including a signature application,
  • the specialised modules “Versicherten­stam­m­daten­man­agement” (VSDM), “Notfall­daten­man­agement” (NFDM) and “Arneimitteltherapiesicherheit/elektr. Medika­tion­splan” (AMTS/eMP).

SRC has success­fully evaluated the network and appli­cation connector in product type version 3 of the company Research Indus­trial Systems Engineering (RISE) Forschungs‑, Entwick­lungs- und Großpro­jek­t­ber­atung GmbH. The certifi­cates BSI-DSZ-CC-1052-V3-2021 and BSI-DSZ-CC-1132–2021 have been published by the BSI.

In addition SRC has success­fully evaluated the network and appli­cation connector in product type version 3 of the company secunet Security Networks AG. The certifi­cates BSI-DSZ-CC-1044-V3-2020 and BSI-DSZ-CC-1135–2020 have been published by the BSI.

For questions about Common Criteria or other evalu­a­tions, please contact us.

Certification of fiskaly Cloud Crypto Service Provider
Homepage Admin

Certi­fi­cation of fiskaly Cloud Crypto Service Provider

Among other things, the Tax Code provides for a combi­nation of technical and organ­i­sa­tional measures to effec­tively prevent manip­u­lation of digital basic records. The core of the tax code is a certified technical security device (TSE for short). The TSE is the central technical component for securing the basic records against subse­quent manip­u­lation. The certi­fi­cation aims to ensure a uniform minimum level of trust and security in the TSE as well as compliance with necessary inter­op­er­ability requirements.

Cash register systems carry out digital basic records in the above sense. Therefore, the cash register security ordinance of the Federal Ministry of Finance specifies require­ments for the certi­fi­cation of TSEs, which have been imple­mented accord­ingly by the BSI. These include detailed require­ments for the security module, the storage medium, the digital interface and the electronic storage, which have been published in the form of several technical guide­lines and protection profiles.

The central security component of a TSE is a so-called Crypto­graphic Service Provider (CSP). This is the component that performs the crypto­graphic signature opera­tions and securely manages essential compo­nents such as crypto­graphic keys and other parameters.

The BSI has certified fiskaly’s CSP Light based on the evalu­ation results of the SRC. This CSP Light is imple­mented as a cloud service to enable integration into networks.

In contrast, CSPs can also be created in the form of smart cards for stand-alone systems. Such products have also already been evaluated by SRC.

PCI DSS v4.0 release delayed
Homepage Admin

PCI DSS v4.0 release delayed

The publi­cation of a new, funda­men­tally revised version of the payment trans­action standard PCI DSS has been announced since 2019. We are eagerly awaiting the changes that the new version will bring.

After PCI DSS v4.0 had already undergone two RFC phases in 2019 and 2020, the PCI Security Standards Council has now decided to also initiate an RFC phase for supporting documents, in particular for

  • the template for the Report on Compliance (ROC),
  • the template for the Attes­tation of Compliance (AOC), and
  • the self-assessment question­naires (SAQs)

in June 2021. However, this will also delay the publi­cation of PCI DSS v4.0.

Instead of the announced release period in Q2 2021, the aimed period of final­ization is now Q4 2021. The actual release date has not yet been specified.

We must therefore be patient a little longer before we can properly plan the migration. With the shift of the publi­cation date, the planned transition periods from PCI DSS v3.2.1 to v4.0 have also been postponed. We are therefore also postponing our PCI DSS v4.0 webinars to 2022.

How cryptocurrencies create new market opportunities for banks and financial services providersHow cryptocurrencies create new market opportunities for banks and financial services providers
Homepage Admin

How cryptocur­rencies create new market oppor­tu­nities for banks and financial services providers

“The impor­tance of cryptocur­rencies is growing ever faster. Banks can use their expertise in imple­menting regulatory issues to gain a good starting position in the market for cryptocur­rency services such as key custody. Through their existing compe­tences in dealing with crypto­graphic proce­dures, e.g. in autho­ri­sation, online banking or PIN protection, banks already bring along a large part of the technical prereq­ui­sites for entering this business field.” SRC expert Dagmar Schoppe explains the oppor­tu­nities for banks and financial service providers with regard to the devel­opment of cryptocur­rencies in an article just published on the specialist platform “it-daily.net”.

Are there depen­dencies on the digital euro?

The increasing interest in cryptocur­rencies — in addition to the rapid rise in the euro equiv­alent to a bitcoin observed in recent days — should also be seen in connection with the discussion about the intro­duction of a digital euro. The digital euro — according to the perception in the German banking industry (DK) — is assessed as a forward-looking means of payment in a digital economy that coher­ently comple­ments the existing and proven systems and struc­tures. In this context, the greatest possible synergies should be sought with existing payment trans­action solutions so that access to digital central bank money can be secured for end consumers.

New oppor­tu­nities in the digital­i­sation of business processes

Insti­tu­tions face the challenge of increasing their visibility in this new market segment in order to then be able to respond to requests from customers, retailers as well as service providers. In the medium term, the generally growing interest in cryptocur­rencies can also result in oppor­tu­nities for insti­tu­tions that, for example, offer their corporate customers self-issued cryptocur­rencies to support them in the digital­i­sation of their business processes.

The SRC experts follow the exciting devel­op­ments in the field of cryptocur­rency and the digital euro for you and support you in the reali­sation of your crypto custody service. We will be happy to inform you about the oppor­tu­nities to get involved in this innov­ative sector.

further liter­ature

Homepage Admin

Opera­tional Resilience — Cyber resilience require­ments for institutions

Current key topics: Opera­tional Resilience and Cybersecurity

Attacks on the financial system can have serious conse­quences — not only for the affected company, but also for the entire public. Experts at the Bundesbank and security experts at BaFin and the ECB also cite cyber attacks and a lack of resilience to such attacks as the greatest threat posed by increasing digiti­zation in the financial sector. This is one of the reasons why more legal and regulatory frame­works are being created in order to establish uniform standards across the entire financial sector and increase the „opera­tional resilience“.

For both the ECB and BaFin, the focus in 2020 was on “opera­tional resilience” and “cyber­se­curity”. In addition, the TIBER-EU program was launched at European level, which the Bundesbank imple­mented as TIBER-DE in September 2020. Alongside this, the EU published its require­ments for opera­tional resilience and cyber­se­curity in October 2020 as part of the Digital Finance Package in the form of DORA (Digital Opera­tional Resilience Act).

The question for those respon­sible is how these various activ­ities interact and — even more relevant — how efficiently they contribute to the achievement of the objectives.

Revision of MaRisk and BAIT — Opera­tional IT Security

Domes­ti­cally, BaFin published its approaches to addressing opera­tional IT risks in October with the amendment of MaRisk and BAIT. The impor­tance of the topic is evident in the expansion of the BA IT require­ments as part of a new chapter. Imple­menting the specific require­ments formu­lated there is likely to pose major challenges on smaller and medium-sized insti­tu­tions, as they are aimed at operating a security infor­mation and event management system (SIEM), setting up and operating a security opera­tions center (SOC), as well as regular internal deviation analyses, vulner­a­bility scans, penetration tests and the simulation of attacks (“red teaming”). In practical terms, this requires the estab­lishment of a profes­sional cyber security department as well as independent internal infor­mation security struc­tures. This will pose major challenges on the insti­tu­tions concerned, due to the required expertise and limited resources on the labor market alone. Emergency management — also in a separate new chapter in the BA IT — is addressed as a further focal point.

The TIBER Program of the ECB and the Bundesbank

Back in 2018, the central banks of the European System of Central Banks launched the TIBER-EU (Threat Intel­li­gence-based Ethical Red Teaming) program. TIBER-EU serves as a framework on threat-led penetration testing that financial insti­tu­tions can use to put their own resilience to cyber­at­tacks to the test. The goal here is to create a “gold standard” of penetration testing. The clear reluc­tance to partic­ipate in TIBER-DE can be explained on the one hand by the complex scope of the project, the signif­icant risks and, on the other hand by the “voluntary nature” of partic­i­pation. Of course, especially in 2020, many internal forces are tied up elsewhere, also due to the Covid pandemic. The question arises as to whether the insti­tu­tions subjec­tively perceive the risk of a cyber attack as critically.

Digital Opera­tional Resilience Act (DORA) of the EU

With the publi­cation of the Digital Finance Package, the EU regulatory framework on digital opera­tional resilience contains a compre­hensive legislative proposal for the Europe-wide prevention and reduction of cyber risks. Up to now, national regula­tions for opera­tional resilience have been in place, but they do not do justice to the cross-border and global use of IT systems and are therefore not very effective. Moreover, this fragmen­tation also carries the risk of incon­sis­tencies and is also associated with additional high expenses for insti­tu­tions operating across Europe.

It is therefore highly desirable to strive for uniform regula­tions with DORA, in particular for risk management, testing, outsourcing emergency and incident management. In addition to improving and optimizing the resilience of the IT systems used, a signif­icant reduction in admin­is­trative effort for the insti­tu­tions will certainly also be achieved.

Increasing Cyber Resilience together

The SRC experts will gladly discuss the new devel­op­ments and their impact on the legal and regulatory level with you. Together we analyze your need for action and support you in the imple­men­tation. We evaluate the amendment of MaRisk and BA IT for your insti­tution, support you in the prepa­ration, execution and analysis of TIBER tests and analyze the planned require­ments of DORA. You can draw on our experience from countless penetration tests, banking compliance and infor­mation security management projects.

Cryptocurrencies ECB Digital Euro
Homepage Admin

Cryptocur­rencies — When and how will the Digital Euro emerge?

The European Central Bank’s (ECB) public consul­tation on the Digital Euro concluded on January 12, 2021. Based on the state­ments received, a funda­mental decision on the contin­u­ation of this major project is expected in the summer of 2021. In this context, the devel­op­ments of the private sector cryptocur­rencies Bitcoin and Diem (formerly Libra) are also considered. Other central banks’ activ­ities, e.g. in Sweden regarding the “E‑Krona” as well as in China, will certainly have an impact in this regard as well.

Statement of the German Banking Industry Committee

In its statement on the Digital Euro, the German Banking Industry Committee expressed its support for the ECB’s activ­ities and pledged its assis­tance with the design and project planning.

“For the German Banking Industry Committee, the intro­duction of a Digital Euro by the Eurosystem has the potential to strengthen Europe’s compet­i­tiveness, depending on how it is designed. However, it also carries the risk of funda­men­tally changing the geometry of the European banking system. Banks in Germany and Europe play a key role in the economic cycle and make an indis­pensable contri­bution to the efficient supply of financial resources to companies and consumers. That alone is why it is important to involve the banking industry in the consid­er­a­tions of a digital currency at an early stage.”

Karl-Peter Schackmann-Fallis, Executive Member of the Board of the German Savings Banks Association.

Predom­i­nantly positive tenor

The tenor of the German Banking Industry Committee statement is mostly positive. The Digital Euro is considered to be a pioneering payment method in a digital economy, which coher­ently comple­ments the existing and proven systems and struc­tures. The aim should be to achieve the greatest possible synergies with existing payment trans­action solutions in order to ensure access to digital central bank money for end consumers. There is consensus that digiti­zation is changing payment trans­ac­tions and that the ECB needs to carefully design the Digital Euro to ensure financial stability. To implement the targeted activ­ities, high invest­ments are inevitable for both insti­tu­tions and the economy. But the use of modern tokenization solutions, e.g. through Distributed Ledger Technology (DLT), enables the imple­men­tation of innov­ative payment solutions. In this context, the use of smart contracts and micro­pay­ments, services such as “Blockchain as a Service”, “Smart Contracts as a Service” or payment offers in the Internet-of-Things (IoT) are conceivable.

Need for clarification

It is considered critical that the proven two-tier banking system with central bank and commercial banks could be called into question. According to the German Banking Industry Committee, this constel­lation is essential for money market stability, the supply of loans to companies and private individuals, and the accep­tance of and trust in the payment methods issued. The estab­lished banking system is seen as a crucial component for ongoing economic growth.

Another open question is to what extent a Digital Euro is to be regarded as a crypto-asset in the sense of MiCA (Proposal for a regulation on Markets in Crypto-assets) and what impli­ca­tions this might have. The German Banking Industry Committee has also issued a statement on the ECB’s proposed regulation.

There is a need for further clari­fi­cation with regard to some regulatory issues. In this context, the German Banking Industry Committee proposes an orien­tation towards existing standards. All parties involved should at least comply with the require­ments of

From the German Banking Industry Committee‘s point of view, legal certainty, uniform speci­fi­ca­tions for a token-based fiat money and an appro­priate regulatory standard are the basic prereq­ui­sites for consumer accep­tance and trust in the Digital Euro.

Courses of action for payment institutions

The discussion on the Digital Euro has to be seen in the context of the general increase in the impor­tance of cryptocur­rencies. Many companies have long since recog­nized that Distributed Ledger Technology can help to efficiently digitize complex supply relation­ships. It is therefore a logical conse­quence that there is also growing interest in using this new technology to process payments as well. In the future, it will certainly not only be central bank-issued cryptocur­rencies that will be used. For payment insti­tu­tions, the generally growing interest in cryptocur­rencies increas­ingly results in the need to offer their own customers storage of and trading in cryptocur­rencies. In addition, oppor­tu­nities may also arise for insti­tu­tions that offer their corporate customers self-issued cryptocur­rencies to support them in the digital­ization of their business processes.

The SRC experts will keep an eye on the exciting devel­op­ments in the field of cryptocur­rency and the Digital Euro for you and support you in the realization of your crypto storage service. We will gladly inform you about the options to get involved in this innov­ative sector.

BSI Medical and Care Products
Homepage Admin

BSI publishes study results on the security of medical products and care products

The thoughts of unsafe medical or care products is discon­certing. Especially in a sensitive area such as the health care sector, the affected person trusts in the best possible help. But especially with the advancing digital­i­sation in the healthcare sector, vulner­a­bil­ities are increas­ingly appearing in networked medical‑, IoT- and elderly care products. If such vulner­a­bil­ities are discovered or even exploited, this often poses a major problem for users and manufac­turers of these products.
The Federal Office for Infor­mation Security (BSI) therefore initiated the projects “ManiMed — Manip­u­lation of Medical Devices” and “eCare — Digiti­sation in Care” in order to be able to assess the IT security of selected products.

he studies now published by the BSI enable manufac­turers to improve the IT security features of their products. In addition, users of medical devices are informed about which IT security features could be critical. Improved IT security features strengthen the confi­dence of patients and doctors in the security of networked medical devices. In the study, a total of six products from different categories were examined in terms of IT security.

SRC played a major role in the prepa­ration of the eCare study. The study focused on networked products (both medical and IoT products) that are used in the field of care for the elderly or sick. These include, for example, devices for measuring vital data or a tablet for senior citizens. A total of six products from different categories were examined from an IT security perspective. The results of the study can be found on the BSI website for Download.

In summary, the IT security level of the products examined can be rated as poor to very poor. The results lead us to believe that none of the products examined, including their inter­faces, apps, etc., have been subjected to a profes­sional security evalu­ation, an independent penetration test or similar.