IT Security Act 2.0 passed by the cabinet
Homepage Admin

IT Security Act 2.0 passed by the cabinet

In the end, draft followed draft — and then it happened very quickly. Last Wednesday, 16 December 2020, the cabinet passed the IT Security Act 2.0. Federal Minister of the Interior Horst Seehofer calls it a “break­through for Germany’s security”. Industry associ­a­tions as well as the UP KRITIS are sharply critical of the involvement of the experts there, both in the content and the very short comment period of only a few working days for draft nos. 3 and 4. This does not reflect the impor­tance of the planned amend­ments to the law.

Start of discussion in November

Surpris­ingly, the discussion on the IT Security Act was reignited in November with a third draft bill. After a long stand­still, the discussion about critical infra­struc­tures, their operators and the role of the BSI got moving again. The comments of the technical experts, which were aimed at improving the content of essential points as well as clari­fying open questions, e.g. the partly dispro­por­tionate level of sanctions, transition periods, the certi­fi­cation and notifi­cation of the use of so-called critical compo­nents or also the inclusion of new sectors such as waste management.

More powers for the BSI

It is clear that the BSI’s powers will be greatly expanded. This can be seen not only in the number of newly created posts, but also in the effort to create a cyber inter­vention force as quickly as possible.

Evalu­ation of the IT-Sig 1.0

Furthermore, the legally stipu­lated evalu­ation of the IT-SIG 1.0 according to Article 10 is still pending. Also according to Article 9 of the Critical Infra­structure Ordinance (KritisV), the BSI Critical Infra­structure Ordinance — and thus in particular the threshold values above which an operator is considered a critical infra­structure — must be evaluated every two years.

Changes in content

In the view of the SRC experts, the following points are the main changes in the new IT-SIG:

  • Regula­tions on the use of critical components
  • Concreti­sation of key figures and threshold values for the largest companies in Germany, insertion of a legal regulation on the disclosure of inter­faces and compliance with estab­lished technical standards.
  • Regula­tions on fines and sanctions
  • Amendment of the provi­sions on the storage of log data
  • Alignment of inventory data disclosure with the require­ments of the BVerfG decision of 27 May 2020 (“Inventory Data Disclosure II”).
  • Limitation of the imple­men­tation of detection measures for network and IT security (“Hacker Paragraph”)
  • Amendment of deadlines for the KRITIS regula­tions in Section 8a BSIG and an adjustment or limitation of the oblig­ation to submit operator documents, insofar as the regis­tration oblig­ation has not been fulfilled.
    Regula­tions on IT security of companies in special public interest: Self-decla­ration forms provided by the BSI are no longer binding, with the submission of the self-decla­ration there is an oblig­ation to register with the BSI.
  • Temporal restriction of the BSI’s right of entry to check the require­ments of EU Regulation 2019/881 (EU Cyber­se­curity Act).

In addition, conceptual adjust­ments and concreti­sa­tions were made throughout the entire bill. On 16 December 2020, the Federal Cabinet adopted the draft for the IT Security Act 2.0. The cabinet version is available for download.

Further regulation on IT security

The draft bill on the Telecom­mu­ni­ca­tions Moderni­sation Act (Act on the Imple­men­tation of Directive (EU) 2018/1972 of the European Parliament and of the Council of 11 December 2018 on the European Electronic Commu­ni­ca­tions Code (recast) and on the Moderni­sation of Telecom­mu­ni­ca­tions Law), which was also presented on 09.12.2020, also contains provi­sions on IT security.

The SRC experts will be happy to exchange views with you on the innova­tions as well as their effects and support you in imple­menting the require­ments from IT-SIG and BSIG as well as in providing evidence within the scope of §8(a) BSIG (“Kritis-Prüfung”).

gi-geldinstitute reports on EPEC
Homepage Admin

gi-Geldin­stitute reports on EPEC and the change in payment traffic in Europe

gi-Geldin­stitute, the trade journal for IT, organ­i­sation and commu­ni­cation in credit insti­tu­tions reports on EPEC, the European Payment Expert Consortium for payment trans­ac­tions and its consulting services.

With a view to devel­op­ments and standards in Europe’s payment traffic, three European experts for the standard­i­s­ation of payments have founded the European Payment Expert Consortium (EPEC). Besides the German SRC Security Research & Consulting GmbH, these are the French companies ELITT and FrenchSys. SRC reported in the article Frenchsys, Elitt and SRC found the EPayStan­dards Consortium.

The EPEC consortium combines the know-how of three European experts acquired in various standard­i­s­a­tions. EPEC offers consulting services for European payment service providers. Both the harmonised European standards and local specifics are taken into account. The offer covers, among other things, the use of payment standards, imple­men­tation guide­lines, as well as functional and security speci­fi­ca­tions for pan-European solutions for card, mobile and internet payments.

The gi-Geldin­stitute reports on EPEC. The title Der Zahlungsverkehr befindet sich im Wandel. The article describes the environment and upcoming challenges of EPEC.

IT-Security Law 2.0
Homepage Admin

Is the IT security law 2.0 on its way?

After a longer stand­still, the discussion about the IT Security Law (IT-SIG 2.0) is now beginning again. Recently, a 3rd draft of the bill was published by the Federal Ministry of the Interior, Building and Community (BMI).

Current status of the amendment

The amendment of the IT-SiG has now been in effect since April 2019, presumably delayed by the legal require­ments for the use of technical products from third countries by operators of critical infra­struc­tures. The third draft bill is now ready to be voted on by the various depart­ments. Adoption before the end of the first quarter of next year no longer seems unrealistic.

What are the main focuses of the draft law?

The new draft bill focuses on the threats to cyber security. In addition, the powers of the BSI will also be expanded and new areas of respon­si­bility will be created, e.g. as a national cyber security certi­fi­cation authority with the imple­men­tation of active detection measures.

The new draft also includes the notifi­cation of critical compo­nents in § 2 section 13:

“The use of a critical component (…), is to be indicated by the operator of a critical infra­structure to the Federal Ministry of the Interior, Building and Community before instal­lation. In the announcement the critical component and the kind of their employment are to be indicated “.

Critical compo­nents are especially those IT products that are used in KRITIS and are of high impor­tance for the functioning of the community. For telecom­mu­ni­ca­tions network operators or telecom­mu­ni­ca­tions service providers, these compo­nents are defined in more detail in the catalog pursuant to § 109 (6) TKG; all others are specified in a corre­sponding BSI catalog.

Only critical compo­nents may be used whose manufac­turers have issued a decla­ration of their trust­wor­thiness to the operator of the critical infra­structure (guarantee decla­ration). The BMI deter­mines the minimum require­ments for the guarantee decla­ration, taking into account superior public interests, in particular security policy concerns. The guarantee decla­ration must state whether and how the manufac­turer can adequately ensure that the critical component does not have any technical properties that could have an abusive effect on the security, integrity, avail­ability or operability of the critical infra­structure (such as sabotage, espionage or terrorism).

Here a new duty of disclosure arises for the operators of the compo­nents. Previ­ously, manufac­turers had to apply to the BSI for certi­fi­cation of these compo­nents. This new listing of critical compo­nents contains highly sensitive targets. Successful attacks by hackers or secret services can cause lasting damage to critical infra­struc­tures in the Federal Republic of Germany.

The discussion about require­ments for the IT products used, identi­fi­cation and authen­ti­cation proce­dures and their evalu­ation with regard to infor­mation security is also taken up and specified. These speci­fi­ca­tions lead to the devel­opment and publi­cation of a state of the art of security require­ments for IT products. In addition, there are require­ments for consumer protection and consumer information.

Conclusion

It remains to be seen whether this schedule can be met. In terms of content, the new draft is a signif­icant improvement, because it is more concrete than the draft of April 2019. It is critical that the evalu­ation of the IT-SIG of 2015, which should have taken place after four years at the latest, is still pending.

The SRC experts will be happy to discuss the innova­tions and their effects with you and to support you in imple­menting the require­ments of the IT-SIG and BSIG as well as in providing evidence within the scope of §8(a) BSIG (“Kritis-audit”).

20 years SRC
Homepage Admin

20 years SRC

20 years ago, on 27 November 2000, the founding meeting of the share­holders of SRC took place. That is a long time, but in retro­spect it does not seem to be the case for the acting persons. This perception is of course subjective, but a decisive factor will certainly be the rapid devel­opment in the field of infor­mation technology.
The complexity of digital­i­sation and the constantly growing need to create trust in new solutions is the business basis of SRC, the essential reason why SRC exists. At the same time this is also a big oblig­ation — namely to ensure that new digital solutions are really trustworthy.
SRC’s work on such things that many people experience in their daily life can be explained vividly. These are, above all, contactless payment by card and mobile phone, secure access to bank accounts by third parties, electronic patient files, secure commu­ni­cation in connection with the Galileo system and in the Bundeswehr, or even quite “mundane” things such as bottle deposit machines or tamper-proof cash registers — all topics of digiti­sation with which millions of people come into contact in one way or another every day. The devel­opment does not end there, with Open Finance, IoT and the increased use of AI methods there are still many exciting topics to be addressed.
None of these solutions has been produced or is operated by SRC itself, but we have made a decisive contri­bution to all of them: We provide confi­dence in these digital solutions — for relia­bility, security and future-proofness. We create “a good feeling” in dealing with digitalisation:
— Standards for new technologies create investment security,
— Reliable function­ality of new solutions through testing,
— Technical safety of new solutions through safety concepts and tests.
In fact, this “good feeling”, the trust, is something like the lubricant of digital­i­sation. For many people, the digiti­sation and mecha­ni­sation of everyday life means that processes are no longer manageable and the truth content of infor­mation is sometimes unclear. Trust makes it possible to reduce this complexity and often opens the door to accep­tance of the new ways of experi­encing and acting that digiti­sation aims to create.
The complexity of digital­i­sation and the constantly growing need to create trust in new solutions is the business basis of SRC, the essential reason why SRC exists. At the same time this is also a big oblig­ation — namely to ensure that new digital solutions are really trustworthy.
In the 20 years of SRC’s existence we have carried out more than 20,000 projects. Every year there have been more and also SRC has grown year by year — not only in terms of the number of employees, but especially in terms of the expansion of expertise, partly in areas that did not exist at the time of the foundation of SRC.
The current pandemic situation does not allow us to adequately celebrate our 20th anniversary, which we would have liked to do together with our customers. We are thinking about making up for this at a suitable time. But even without a party, we would be pleased if you, our customers, continue to place your trust in us.

TIBER-DE
Homepage Admin

TIBER-DE | Increasing the cyber resilience of the financial system

Digiti­sation of the financial sector — Chances & cyber risks

The increasing digital­i­sation of the financial sector not only provides new oppor­tu­nities, but also leads to increased cyber risks. In particular, attacks on the financial system can have serious conse­quences not only for the affected company, but also for the entire public. For this reason, the central banks of the European System of Central Banks have already launched the TIBER-EU (Threat Intel­li­gence-based Ethical Red Teaming) programme in 2018. TIBER-EU serves as a framework for threat-based penetration tests.

In the summer of 2019, the Deutsche Bundesbank and the German Federal Ministry of Finance (BMF) decided to implement TIBER-DE as a national framework for financial companies to test their own resis­tance to cyber attacks. This imple­mention has now taken place.

To whom is TIBER-DE addressed?

TIBER-DE partic­u­larly addresses critical companies in the financial sector, such as large banks and insurance companies and their IT service providers and payment service providers. In its TIBER imple­men­tation, the Deutsche Bundesbank empha­sises that the purpose of conducting TIBER-DE tests is to “establish a network of national companies belonging to the target group in order to improve the cyber-resis­tance of the financial sector in a sustainable and cooper­ative way, together and by conducting TIBER-DE tests.

What happens in a TIBER-DE test?

In a TIBER-DE test, commis­sioned hackers (“Red Team”) use infor­mation from a threat intel­li­gence provider (“spy”) to test the cyber resis­tance of a company. The primary goal is to identify security gaps in the production systems (“critical functions”) within the framework of an attack scenario that is as real as possible. The TIBER-DE test consists of three phases, which are presented here in a shortened form:

  • In the prepa­ration phase the initi­ation, the kick-off, the deter­mi­nation of the test scope and the procurement takes place. In particular, the corre­sponding contracts with all parties involved are concluded, the test scope is deter­mined and the financial super­visory authority is informed about the intended TIBER-DE test.
  • In the test phase, infor­mation on the threat situation is collected and the Red Team penetration test is conducted on the basis of the previ­ously defined test scope.
  • Finally, the final phase includes the prepa­ration of the test reports, a replay and feedback, a remedi­ation plan for found vulner­a­bil­ities as well as a final report and the attes­tation including the transfer of results.

Risks of the TIBER-DE Test

The TIBER-DE test targets the productive systems with the “critical functions” of an institute in order to realis­ti­cally evaluate their cyber-resis­tance. However, this is also accom­panied by risks, e.g. regarding the confi­den­tiality, integrity or avail­ability of the data or systems. In any case, the institute has to perform a detailed risk analysis and take appro­priate measures to minimise the risks before a TIBER-DE test is performed.

Furthermore, companies are confronted with organ­i­sa­tional, technical and data protection challenges. Critical business processes have to be identified, defensive measures have to be estab­lished and documented. In addition, TIBER-DE tests must be coordi­nated with the various stake­holders concerned, e.g. service providers. Furthermore, a confi­den­tiality oblig­ation must be observed by all parties.

Currently the partic­i­pation in TIBER-DE tests is based on a voluntary basis. Along with the not incon­sid­erable risks this seems to be the reason for the hesitation to perform a TIBER-DE test.

Team up for a successful TIBER-DE test

The experts of SRC can prepare a TIBER test together with you. This includes the company-wide scoping of the critical business processes to be tested and support in estab­lishing compliant reporting channels and processes to control and execute TIBER tests. This means that the internal prepa­ra­tions are now in place to have a TIBER-compliant penetration test performed by a service provider. With the experience gained from countless penetration tests, bank compliance and infor­mation security management projects, we are happy to support you through the entire process of a TIBER test.

Homepage Admin

IT compliance through the intro­duction of an ISMS

Increasing compliance requirements

“The depen­dency of core and value-added processes on the IT infra­structure and the IT systems operated there is constantly increasing at credit insti­tu­tions. This means that the associated compliance require­ments are also increasing almost to the same extent”. In an article that has just been published on the specialist platform “Security Insider”, SRC expert Dagmar Schoppe explains the different regulatory and legal require­ments that determine the daily business of credit insti­tu­tions and how IT compliance is improved by the intro­duction of an ISMS.

Value creation processes are threatened

The protection of these value-added processes through compliance with regulatory and legal require­ments, e.g. from BAIT, MaRisk or the IT Security Act, is a very topical issue. After all, the danger of hacker attacks is a real and current threat. This is one of the reasons why IT security is one of the central audit focuses of the BaFin. The TIBER-EU programme, which is intended to strengthen the resilience of the financial world against cyber attacks, also aims in this direction.

Holistic infor­mation security management system creates security

For a holistic approach to the protection of corporate values, the various organ­i­sa­tional and technical aspects must be combined into a holistic concept. This leads to the intro­duction of an infor­mation security management system, e.g. on the basis of ISO 27001.

The experts of the SRC division Banking Compliance will gladly advise you on regulatory and legal require­ments and their imple­men­tation, e.g. by intro­ducing an infor­mation security management system (ISMS) or by carrying out TIBER tests. SRC is a member of the Cyber-Alliance.

NextGenPSD2 certification
Homepage Admin

New BSI guidance on evidence according to § 8a paragraph 3 BSIG

The IT Security Act (IT-Sig) in conjunction with the KRITIS regulation has been in use for over five years. The main objective is the regulation of KRITIS operators according to the BSI Act. The Federal Office for Infor­mation Security (BSI) accom­panies law and regulation with the so-called BSI Orien­tation Guide to Evidence.

IT-Sig 2.0 — Is it coming or not?

Unfor­tu­nately, the topic “IT security law 2.0” has become very quiet lately. Therefore no amendment of the KRITIS regulation is to be expected in the short term. However, the current draft of the IT-Sig 2.0 can be taken from the present speaker draft. For example, the inclusion of waste management in the existing sectors is being considered. In addition, an expansion of the target group beyond the KRITIS operators to include companies in the special public interest (e.g. due to their economic impor­tance) is also being considered. For these companies, the prepa­ration of safety concepts, the oblig­ation to report incidents, the regis­tration and management of a reporting office and the trust­wor­thiness of the employees in the area are important. The planned tight­ening of the framework for fines from the previous maximum of EUR 100,000 to a maximum of EUR 20,000,000 (or 4% of the total annual company turnover worldwide in the previous business year) is partic­u­larly striking.

New guidance on evidence

While IT-Sig 2.0 is still a long way off, in the second half of August the BSI published its new “Guidance on evidence pursuant to Section 8a (3) BSIG”. Version number 1.1 already suggests it: the changes include many concreti­sa­tions and clari­fi­ca­tions of the facts and require­ments. In addition, there are further signif­icant changes. For example, the new Form P combines the infor­mation contained in the previ­ously used forms PD (test perfor­mance), PE (test results) and PS (testing body). In addition to the written submission, a digital/­ma­chine-readable copy is now also required. The list of safety deficiencies and the imple­men­tation plan are now combined in one document, while existing test results (maximum 12 months old) must be explicitly checked for topicality and stock. A clear innovation is the well-founded assessment of the maturity levels of the management systems for infor­mation security (ISMS) and business conti­nuity (BCMS). The strong focus on the aspect of trace­ability is also very noticeable. This becomes visible at various points:

  • Detailed description of the scope (with its inter­faces, depen­dencies and parts of the critical service operated by third parties) and
  • the instal­lation (including associated parts of the critical service and all essential features) as well as
  • Provision of a compre­hen­sible network structure plan.
  • In addition, a list of deficiencies must also be compre­hen­sible without the need for further documents.

Even without IT-Sig 2.0, the new BSI orien­tation guide requires attention. SRC experts will be pleased to discuss the innova­tions and their effects with you and support you in the imple­men­tation of the extended requirements.

Amendment of BAIT 2021
Homepage Admin

Amendment of BAIT 2021- The new require­ments for financial institutions

The amendment of BAIT for 2021 means new require­ments for credit insti­tu­tions. In contrast, BaFin faces the challenge of imple­menting the Guide­lines on security measures for opera­tional and security risks under the PSD2 and the Guide­lines on ICT and security risk management of the EBA in Germany. This is to be completed by 31 December 2020 with an amendment to the BAIT (banking super­visory require­ments for IT). First drafts have already been discussed and commented on in the insti­tutes and associations.

BAIT 2021 focuses on IT security

With a separate and new chapter, opera­tional IT security is moving further into focus. The require­ments formu­lated there can only be fulfilled with a Security Infor­mation and Event Management System (SIEM). This also includes the estab­lishment and operation of a Security Opera­tions Centre (SOC). Regular opera­tional checks are required. These include:

  • internal deviation analyses
  • Vulner­a­bility scans
  • Penetration tests
  • the simulation of attacks (“Red Teaming”)

The new require­ments of BAIT 2021 lead to the estab­lishment of a profes­sional cyber security infra­structure. This means extensive and independent internal infor­mation security structures.

The management assumes overall responsibility

It is noticeable that the draft already refers not only to the respon­si­bility of the management. The management is even required to explicitly acknowledge the overall respon­si­bility for infor­mation security. This also includes regular infor­mation about their concerns and the decision to deal with security risks appropriately.

Require­ments for IT emergency management are consolidated

We expect further changes in the area of IT emergency management. The require­ments from BAIT will be consol­i­dated with those from section AT7.3 of MaRisk. This creates uniform national require­ments. In addition, we expect to tighten and specify the require­ments with regard to emergency planning and prevention, BCM, disaster recovery and backup strategies. In our view, outsourcing to service providers will also be covered by the revised version.

Financial insti­tu­tions face major challenges

According to the assessment of the SRC experts for bank compliance, the expected changes will pose great challenges for the affected insti­tu­tions. This concerns especially the required know-how and the limited resources on the labour market.

SRC-Expertin Ehlers: Standards of the Payment Card Industry (PCI)
Homepage Admin

SRC-Expert Ehlers: Standards of the Payment Card Industry (PCI)

“PCI compliance requires know-how and resources.” SRC expert Jana Ehlers explains the different PCI security standards in an article which has just been published on the profes­sional platform “All About Security”.

In view of the increasing number of card payments in pandemic times, the protection of payment card data is a very current topic.

All PCI standards aim at protecting payment card data of inter­na­tional payment systems. The most well-known standard alone, PCI DSS, has around 250 individual require­ments. If these are already taken into account when setting up networks and struc­tures, there is often no need for complex and expensive retrofits. But also the permanent mainte­nance of PCI DSS conformity poses challenges for companies.

SRC examines and advises on PCI standards since their emergence in 2006. This experience can be used to correctly under­stand and consider the inten­tions of the PCI standards. SRC accom­panies through the whole process. Thus, not only PCI-conformity can be achieved in an under­standable way, but also a great deal more security for the customers’ payment card data worthy of protection.

EPayStandards Consortium
Homepage Admin

Frenchsys, Elitt and SRC found the EPay Standards Consortium

Together with the French partners Frenchsys and Elitt, SRC founds the EPayStan­dards Consortium, a cooper­ation to expand the consulting and support of inter­na­tional customers in the European payment traffic.

As a subsidiary of Cartes Bancaires, Frenchsys signif­i­cantly supports the technical and functional speci­fi­ca­tions as well as the integration in the French acquirer market.

Elitt focuses its activ­ities on the devel­opment of test case catalogs and test tools for terminals. Elitt also stands for innov­ative payment solutions.

SRC supports devel­opment and mainte­nance of the German girocard system. This includes the creation of functional and security speci­fi­ca­tions for all system compo­nents involved. Also the conception of innov­ative solutions for mobile payment is part of SRC’s service spectrum.

All three companies know the world of payment trans­ac­tions as essential carriers of European standard­ization initia­tives such as nexo, CPACE and the Berlin Group.

The EPayStan­dards consortium gives the inter­na­tional market for payment trans­ac­tions access to bundled technical and strategic consulting services. The corner­stone of the cooper­ation is laid with workshops for customers with cross-border opera­tions such as terminal manufac­turers and processing service providers.

In recent years, the European standards for payment trans­action terminals have developed further. This offers oppor­tu­nities especially for inter­na­tionally active acceptors to harmonize their terminal infra­struc­tures across borders. SRC and Frenchsys contribute detailed knowledge of these new standards and the two largest European payment trans­action markets and systems. Elitt completes the cooper­ation with its expertise in the technical prepa­ration of imple­men­ta­tions and certi­fi­ca­tions. Thus, the inter­na­tional market for payment trans­ac­tions benefits from the combi­nation of the strengths of the consortium partners.

Workshop concept eMail an: mailto:contact@epec-experts.eu