Ross McKean

As Datonomy readers may know October is Cybersecurity Month – a good time to read the second edition of Olswang’s Cyber Alert. There is no doubt that cyber security is rising up the international as well as the business agenda. NATO recently adopted an amendment to its charter to put cyber attacks on the same footing as armed attacks – see paragraph 72 of NATO’s Declaration.

In this edition:

  • In our lead article, EJ Hilbert, Managing Director, Cyber investigations, Kroll EMEA, considers the true cost of cybercrime;
  • In our standards and benchmarks section we consider the new ISO standard for processing PII in the cloud, new standardisation guidelines for cloud computing SLAs and look at the UK’s new certification scheme Cyber Essentials.
  • On our regulatory radar in this edition we  track the  progress of EU legislation on data and cyber breach notification, and draft US legislation and look in depth at new cyber security legislation in France and Germany and proposals to strengthen criminal penalties in the UK. We also look at a first of its kind ruling by the French data protection regulator, the CNIL, over supply chain security breaches, and at the impact UK fines are having on security compliance.
  • In our threat vectors section we highlight just some of the breaches and threats which have been in the headlines over the summer.

We hope Datonomy readers will enjoy the Cyber Alert. There is a printable PDF version of it here.

Posted in Cloud computing, cyber crime, cyber-privacy, cybersecurity, data, data breach, data breaches, data loss, e-Privacy, Germany, information security, internet, New publication, online data protection, outsourcing | Tagged | Leave a comment

Threat Vectors

Tom Errington - October 22nd, 2014
Tom Errington

A small selection of the cyber threats and statistics that have made recent headlines.

  • Sources including censorship watch dog GreatFire have alleged that the Chinese authorities are staging a “man-in-the-middle” attack on Apple’s iCloud, just days after the iPhone went on sale in China. The attack is designed to intercept user’s iCloud account usernames and passwords, using a fake login site that looks exactly like the Apple iCloud login site. Read more from The WHIR and ITProPortal.
  • A new bug, which could be affecting hundreds of millions of computers, servers and devices using Linux and Apple’s Mac operating system, has been discovered. System administrators have been urged to apply patches to combat the bug, which has been dubbed “Shellshock”. Read more from the BBC.
  • US companies Home Depot, Supervalu and JPMorgan Chase & Co have all been hit by high profile cyber attacks.
  • Mark Boleat, head of policy for the City of London, has echoed comments made by New York’s financial regulator Benjamin Lawsky that an “Armageddon style” cyber attack will trigger the next global financial crisis by making a major bank “disappear”. Mr Boleat also said that the City of London police had uncovered a huge underground economy, and a huge underground network” capable of conducting movie-style cyber attacks. Read more from The Telegraph.
  • As has been widely reported, there has been an extremely targeted hack against celebrities, resulting in numerous nude photographs being temporarily floated in the public domain. In the fallout, cyber-thieves reportedly sent out fake notification messages to iCloud users to trick people into handing over their login details.
  • Similarly, 13 GB worth of photos from popular mobile phone app Snapchat have been dumped online. The attack has been dubbed “The Snappening” and was carried out by the use of insecure third-party software designed to let users store “disappearing” snaps. Many are blaming Snapchat for the breach. Read more from The Independent.
  • Security firm Hold Security has announced the “largest data breach known to date”, after a Russian gang dubbed “CyberVor” stole over 2 billion credentials. More details here and here.
  • As ZDNet reports, new research published by FireEye claims that 68% of the most popular free Android apps could become a pathway for cybercriminals to lift sensitive data.
  • An interesting blog by CBR highlights six cyber security trends to watch out for during the rest of 2014, which includes more focus being placed on cyber education and an increase in infrastructure targeting by hackers.
  • The “very alarming” level of cyber threats organisations face is unlikely to fall for at least 10 years, says Suleyman Anil, head of cyber defence at the emerging security challenges division of NATO. Mr Anil asserted there are three prime reasons for this; cyber crime is low risk with the promise of high profits, there has been an increase in opportunity to attack systems and most worryingly, there is growth in state-sponsored cyber attacks. Read more here.

 

Posted in cyber crime, cyber-privacy, cybersecurity, data | Tagged , , | Leave a comment
Claire Walker

As  reported  in our first edition, there are two proposals making their way through the Brussels legislature which will change the legal landscape for the reporting of cyber attacks. These are the draft Network and Information Security Directive, which will impose reporting obligations on providers of critical infrastructure, and the draft General Data Protection Regulation which will impose data breach reporting requirements on all data controllers. The summer has seen much institutional change in the EU, first with the European Parliament elections in May, the start of Italy’s Council Presidency in July and now with the reorganisation of the European Commission and appointment of a new Commission President and Commissioners with effect from 1 November.  The summer has seen little procedural progress, although trilogue negotiations on the NISD have now begun, and on the GDPR the Council (representing the Member States) has, according to this Council press release, just reached a broad consensus on the security and breach provisions in Chapter IV of the draft Regulation (although the Council has not yet agreed its position on the whole proposal).  We will continue to monitor progress in our Cyber Alert.

We summarise the state of play – as at 22 October 2014 – on both proposals in a table available here

Posted in cyber-privacy, cybersecurity, data | Tagged , , | Leave a comment
Thibault Soyer

With the text of the draft Network and Information Security Directive (“NISD”) still being negotiated between EU institutions, and the national transposition deadline for the Directive likely to be 18 – 24 months from the date of EU adoption, some Member States are pre-empting the new regime with national legislation of their own. France has already implemented the principles enshrined in the draft Directive via its Military Programming Act, which was published at the end of 2013.

 Overview

France has already implemented many of the principles enshrined in the Draft NISD into national law. The French Government published its strategy on Information systems and defence in February 2011. This included reviewing and where necessary strengthening cyber laws. As a result, the government passed Article 22 of Act n°2013-1168 dated 18 December 2013 (the “Military Programming Act”) which sets out several obligations applicable to vitally important operators (“VIOs”) which are comparable to those imposed by the Draft NISD on operators of critical infrastructures.

 It should be noted that Article 22 of the Military Programming Act has not yet come into force; various decrees and Ministerial orders which will spell out the detail of the regime have not yet been published – for example, those specifying security standards applicable to VIOs, the notification procedure, criteria defining an “incident” triggering the notification obligation and conditions and limits of “inspection” powers of the Prime Minister.

 The French National Agency for the Security of Information Systems (“ANSSI”), i.e. the regulatory authority which has been empowered to define implementing and enforcement measures of Article 22, is currently working with the French government as well as with public and private entities to define the application conditions of this framework. The implementing decree had been announced by the ANSSI to be due by Autumn 2014. As of the date of publication of this article, however, no such decree has been published.

When published, the decree will set out general principles, and following such publication, ministerial orders will be published to define sector-specific rules (if any) and implementation deadlines. At a cyber security conference in September, the ANSSI director indicated that France was “the first to go down this road. Other countries have tried, without succeeding” and that implementation conditions remain “unclear”, even at the NATO level (therefore not providing a reference framework for the ANSSI).

 NISD vs Military Programming Act – how do they compare?

 Below we highlight the key similarities and differences between the French legislation and the proposed NISD. Note that there are significant differences between the Commission’s original draft of the NISD published in February 2013 and the amended text approved by the European Parliament in March 2014. It remains to be seen what the final compromise text of the NISD agreed by all three EU institutions will look like. As things stand, here’s how the new French regime compares to the proposed EU-wide regime.

Key similarities:

  • Breach notification deadlines: the Draft NISD (as amended by the European Parliament) requires breach notification “without undue delay” (Article 14 (2)) and the Military Programming Act requires notification “without delay”.
  • Audits: the broad obligation for VIOs to subject themselves to security Audits under the NISD (as originally proposed by the European Commission, Article 15(2)) is similar to the “inspection” obligation under the Military Programming Act. However, the EP’s text has significantly watered down the audit requirement.

Key differences:

  • Scope: the notions of VIOs in the Military Programming Act and of “vitally important sectors” under the relevant French legislation are slightly broader than the scope of “critical infrastructure” (in the sense of the Council directive 2008/114/EC) and of “market operators” in the Draft NISD (see the table for more detail).
  • Inspection and audit: the extent of inspection/auditing powers of VIOs by the French Prime Minister is deeper than the equivalent proposals under the EP’s version of the Draft NISD.
  • Sanctions: the French law includes specific sanctions for a VIO’s failure to comply with any of the obligations specified in Article 22, following a formal notice (up to EUR 750.000 for corporate entities). However, such formal notice is not required prior to imposing a fine in case of failure by a VIO to notify the Prime Minister “without delay” of a cyber-breach.
  • Notification triggers: no materiality threshold for cyber security incidents triggering the notification requirement is yet provided by the Military Programming Act, compared to the “significant impact” threshold and criteria included in the European Parliament’s proposed version of Article 14(2) of the Draft NISD.
  • Notification to the public: whereas the Draft NISD (European Parliament’s version, Article 14 (4)) provides for precise criteria and conditions for notification to the public of cyber security incidents, the Military Programming Act remains silent on this possibility.

For further details on the similarities and differences between the Draft NISD and the Military Programming Act, please refer to the comparative table available here.

Posted in cybersecurity, data | Tagged , , | Leave a comment
Tom Errington

The ICO has published a review of the impact of its civil monetary penalties (CMPs), the vast majority of which have related to security breaches. The review canvassed the views of representatives from 14 organisations who had received a CMP and 85 peer organisations who had not. The findings suggest that overall CMPs are effective at improving data protection compliance. However some respondents felt that there was a lack of transparency about how CMPs have been calculated and some showed a lack of understanding of just what poor practices trigger the CMP threshold.

Posted in civil monetary penalties, cybersecurity, data | Tagged , , | Leave a comment
Katharine Alexander

UK: Cyber security certification scheme launched

Following the consultations on the requirements for a preferred standard for cyber security, which concluded in November 2013 (background information here), the Government has launched a new cyber security certification scheme. The scheme focuses on five main controls for basic cyber hygiene:

  • boundary firewalls and internet gateways;
  • secure configuration;
  • access control;
  • malware protection; and
  • patch management.

Businesses can apply for a “Cyber Essentials” certificate (based on independently verified self-assessment) or a “Cyber Essential Plus” certificate (offering a higher level of assurance through external testing). The scheme is designed to be affordable and offers a snapshot of the organisation’s cyber security effectiveness on the day of assessment. Guidance on meeting the Cyber Essentials requirements can be downloaded from the government-approved cyberstreetwise website here, and a summary of the scheme can be found here. Vodafone has become the first telecoms company to gain the UK ‘cyber essentials plus’ accreditation.

Posted in cybersecurity | Tagged , , | Leave a comment
Claire Walker

These new guidelines were published in June by the Cloud Select Industry Group.

Forming part of the European Commission’s wider Cloud Computing strategy which was unveiled in 2012, the guidelines have been described as a first step towards standardised building blocks for terminology and metrics in cloud SLAs. They aim to improve the drafting clarity and customer understanding of cloud SLAs. European Commission Vice-President Viviane Reding said: “[the] new guidelines will help generate trust in innovative computing solutions and help EU citizens save money. More trust means more revenue for companies in Europe’s digital single market.”  The 62 page guidelines – created by a drafting team which included participants from IBM, Amazon, Microsoft and T-Systems – deal with service levels relating to availability, reliability, security, support services and data management, and take into account the guidance of the Article 29 Working Party.

Posted in Cloud computing, cybersecurity | Tagged , , | Leave a comment
Tom Errington

In July the Senate Intelligence Committee approved a bill for the Cybersecurity Information Sharing Act (“CISA”) that would encourage companies to share information about threats with each other and the federal government. The bill has been controversial, especially in the wake of Edward Snowden’s revelations about access to US citizens’ data, as it would give the NSA wider powers to access, retain and use data for “a cybersecurity purpose”. This is rather broadly defined as “the purpose of protecting an information system or information that is stored on, processed by or transiting an information system from a cybersecurity threat or security vulnerability”. Indeed, an open letter from a number of privacy, civil liberties and open government groups has been published criticising the bill. Further coverage can be found here, here and here. The bill is expected to see a full vote in the Senate this year. The text of the bill is available on the Congress website here.

Posted in cybersecurity | Tagged , , | Leave a comment

 In August this year (to not a great deal of fanfare), ISO published a new security standard for cloud services: ISO/IEC 27018Information technology – Security techniques – Code of practice for protection of personally identifiable information (PII) in public clouds acting as PII processors (“ISO 27018”).  Datonomy reported in May this year, that this new standard was on its way. This publication is a welcome step towards ensuring compliance with the principles of privacy laws and further boosting customer confidence in in cloud computing technologies.

 Here are Datonomy’s questions and answers on this new security standard.  

 What’s the aim of ISO 27018?

 The standard’s aim is to create a common set of security controls that can be implemented by a public cloud computing service provider that is processing personal data on behalf of another party.   

 How is ISO 27018 structured?

 The standard is based on (and follows a similar structure to) ISO/IEC 27002 – Information technology – Security techniques – Code of practice for information security controls (“ISO 27002”).  In short, ISO 27018 tailors ISO 27002 for use by a public cloud computing service provider.  The structure breaks down into three key parts:

  1. ISO 27018 provides a reference to ISO 27002 where the controls in ISO 27002 are applicable to cloud computing service providers processing personal data. 
  2. ISO 27018 sets out additional guidance and/or information for these controls, where necessary for cloud computing service providers processing personal data. 
  3. There are additional controls (and associated guidance) in the Annex to the standard which are not covered in ISO 27002.

 What’s in ISO 27018?

 The main section of ISO 27018 covers the same  areas as ISO 27002: Information security policies; Organization of information; Human resource security; Asset management; Access control; Cryptography; Physical and environmental security; Operations security; Communications security; System acquisition, development and maintenance; Supplier relationships; Information security incident management; Information security aspects of business continuity management; and Compliance.

 The Annex to ISO 27018 covers additional areas: Consent and choice; Purpose legitimacy and specification; Data minimization; Use, retention and disclosure limitation; Openness, transparency and notice; Accountability; Information security; and Privacy compliance.

 From a legal perspective, ISO 27018 can been seen as having elements of a controller to processor agreement and elements of technical and organizational security measures.

 Who can use ISO 27018?

 ISO states that “ISO 27018 is applicable to all types and sizes of organizations, including public and private companies, government entities, and not-for-profit organizations, which provide information processing services as PII processors via cloud computing under contract to other organizations.

 How can ISO 27018 be used?

 The organizations listed above can use the standard to select applicable controls when implementing a cloud computing information security management system and/or as a guidance document for implementing these controls. Like ISO 27002, ISO 27018 does not specify what controls are applicable to what organization.  This is not surprising as it would be near impossible to do so. However, to circumvent this issue, ISO/IEC 27001 requires a risk assessment to be performed to identify what controls are required and to what extent it should be applied. A new ISO 27017  that is still in the pipeline might fill this gap.

 Providers that comply with ISO 27018 will definitely have a better selling argument as they confirm compliance with important data protection standards. There are also good arguments that a self-audit by a provider under ISO 27018 is accepted as proof of compliance with technical and organizational measures (as required, for example, under EU law for data processing agreements).

 What are the limitations of ISO 27018?

 Most of the controls in the standard will also apply to a controller of personal data.  However, the controller will, in most cases, be subject to additional obligations, not included in this standard.

  1. Cloud beyond personal data.  ISO 27017, which has not been published yet, will deal with the application of ISO 27002 to the use of cloud services and to the provision of cloud services generally.  ISO 27018 is focused on cloud services that process personal data.
  2. Legal nuances.  We will have to see if this ISO standard is widely adopted. It is being  heavily promoted by cloud giants.  The standard addresses, broadly, the key obligations in privacy laws around the world (and there are of course large similarities).  However,  there are nuances in privacy laws around the world.  The standard does not address all of these.  Therefore customers and providers alike will still have to consider those nuances. 
  3. Additional sector rules.  There are often additional rules to privacy laws that ISO 27018 doesn’t deal with.  Many readers will be familiar with additional relevant rules imposed in particular industry sectors e.g. the financial services industry, the public sector, the health sector and the education sector.  Customers and providers in these sectors will still have to consider these additional rules.

 Conclusion

 This is a helpful standard for the cloud industry.  ISO 27018 is not a management standard (c.f. ISO 27001) and therefore is unlikely to be certified against.  The same is true for ISO 27017.  However, it provides a useful reference guide for customers and suppliers alike – it is the first global standard of its kind and is a suitable means for globally operating providers to demonstrate their data protection/privacy compliance – instead of having to cope with different national standard in various jurisdictions.  If this standard is adopted and accepted widely, then customers and providers can use this standard to evaluate what protections are in place and, more importantly, what’s missing!

Posted in Uncategorized | Leave a comment
Christian Leuthner

On August 19, 2014, more than one year after the first draft bill of an IT Security Act, the German Federal Ministry of the Interior has published the new draft bill of the Act, aimed at boosting the security of information technology systems. The full title of the legislation is “Entwurf eines Gesetzes zur Erhöhung der Sicherheit informationstechnischer Systeme” (IT Sicherheitsgesetz) (“IT Security Act”). The new rules are still subject to change but look likely to come into force in early 2015.

General overview

In fact, the IT Security Act will not be an individual law, but will amend the Act on the Federal Office for Information Security, the Telecommunication Act, the Telemedia Act and the Act on the Federal Criminal Police Office as well as the Act on the German Federal Office of Information Security. The IT Security Act contains five central topics and provides for:

  • IT security in companies (see A. below)
  • Protection of individuals/citizens while using networks (see B. below)
  • Securing federal IT (see C. below)
  • Strengthening the German Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik “BSI”) (see C. below)
  • Extension of competences of the Federal Criminal Police Office (Bundeskriminalamt “BKA”). (see C. below)

The aim behind the IT Security Act is to turn German IT systems and critical infrastructures into the safest systems in the world.

A. IT security in companies

Scope: which organisations are caught by the new rules?

Under the new IT Security Act, providers of critical infrastructures (“CI Providers”) shall implement an acknowledged standard of technical measures to secure their IT systems and inform authorities about certain attacks or IT incidents without undue delay. “Critical Infrastructures” will be defined by a separate regulation to be enacted once the IT Security Act is in place. According to the proposed amendment of the Act on the German Federal Office of Information Security critical infrastructures shall, however, include establishments, plants and parts of it in the sectors of energy, IT, transport and traffic, health, water, nutrition, finance and insurance. Provider of critical infrastructures considered to be micro, small and medium-sized enterprises in the meaning of Recommendation 2003/361/EC are excluded from the scope of the IT Security Act.

Expressly excluded from the term “critical infrastructures” are federal communication technologies that are used for internal communication between authorities and for communication towards third parties. This exclusion is subject to criticism of industry associations because the the IT Security Act does not apply to the biggest critical infrastructure in Germany.

Furthermore, currently there is a lot of criticism as the term “Critical Infrastructures” requires concrete definition. To date it is not fully clear which organisations are covered by the new rules.

  1. Security standards

CI Providers, except providers of public telecommunication networks or public telecommunication services, will be obliged to implement adequate organizational and technical precautions and other measures to protect the IT systems, their components and the processes that are mandatory to provide the critical infrastructure (“Security Measures”). Security Measures must be fully implemented two years after the IT Security Act comes into effect. CI Providers will be obliged to prove those Security Measures every two years by providing sufficient audit reports or certificates.

CI Providers in common sectors and their relevant sector associations may propose their own standards for Security Measures that substantiate the general Security Measures.

  1. Notification duties

CI Providers must designate at least 15 individuals as contact points for warning and alerting (Warn- und Alamierungskontakte). CI Providers are obliged to notify the BSI via those designated contacts without undue delay in case of interference or impairment that could lead to breakdown or the impairment of the critical infrastructure. In such cases, providers may notify the BSI on an anonymous basis. The notification must contain the technical framework of the CI Provider used to provide the critical infrastructure, the Security Measures implemented and the sector of the provider. In cases where the interference or impairment has already led to a breakdown or impairment, an anonymous notification is not permitted.

  1. Further obligations

Companies in the same sector may designate one common contact person managing the communication between CI Providers and the BSI.

Third parties may request information on Security Measures and on security incidents from the BSI unless CI Providers have legitimate interest in non-disclosure or if the disclosure of such information would impact material security interests of the general public. CI Providers have to consent in the disclosure of information with regard to actual breakdowns or impairments as well as on the result of the regular audits.

B. Protection of individuals/citizens while using networks

Protection of individuals/citizens is mainly aimed at telemedia and telecommunication providers. Telemedia providers and telecommunication providers shall implement an acknowledged standard of technical security measures.

Telecommunication providers are obliged to inform the Federal Network Agency (Bundesnetzagentur) in case of impairment of the telecommunication networks that could lead to significant security incidents, e.g. unauthorized access to users’ systems. The Federal Network Agency may request a detailed report in case of an actual incident from the providers. In case of an incident, the Federal Network Agency either may inform the public itself or oblige the provider to do so.

Providers are obliged to inform their customers about incidents on the providers’ data processing systems (e.g. malware and cyber-attacks) and provide them with information and, if applicable, software or applications to remove or combat such malware or cyber attacks.

In addition, Telemedia providers are permitted to process and use usage data, telecommunication providers may process and use inventory and traffic data to identify, limit or eliminate impairments.

C. Securing federal IT and strengthening federal authorities

BSI is entitled and obliged to determine minimum security requirements for federal authorities to secure federal IT networks. BSI is entitled to assess IT systems and services to and publish the results for the purpose of improving IT systems and services. BSI is no longer only entitled to inform the public on malware but also on the loss of data. The BKA is entitled to investigate in more kinds of cybercrime, such as espionage of data, computer fraud.

D. Olswang comment and outlook for the new act

The IT Security Act is a step in the right direction – creating high security standards where necessary, increasing protection for individuals and providing assistance for individuals to self-help with regard to security incidents. The opportunity to notify the BSI anonymously of security incidents leads to a fair balance between the reputation of providers and the protection of individuals and general public. However, as long as the term ‘critical infrastructures’ is not defined, it is not fully clear what companies are in the scope of the IT Security Act. Furthermore, the provider of the biggest critical infrastructure of all, the Federation, is excluded from this scope. Furthermore, the costs of implementation which providers will face are currently not easy to quantify. Industry associations assume costs of more than one billion Euros triggered by the implementation and maintenance of the technical and organizational measures under the IT Security Act.

In addition, there are privacy concerns with regard to the processing and use of usage data by telemedia providers and processing and use of inventory and traffic data by telecommunication providers. These companies are entitled to store a lot of information under the cloak of IT security and share this information with federal authorities, i.e. what was denied by the ECJ with regard to the Data Retention Directive.

The IT Security Act is now subject to interdepartmental coordination and will then be discussed with stakeholders of the relevant industries and stakeholders of society. A formal procedure with regard to the participation of stakeholders does not exist. Industry associations will likely request their members to provide feedback and raise issues so that the IT Security Act can be amended. According to a statement made previously by the German Federal Ministry of the Interior, the IT Security Act shall be enacted in early 2015. The content of the final draft will be eagerly awaited.

It is interesting to see that Germany is introducing its own legislation on cyber security ahead of the formal adoption of the EU Network and Information Security Directive, which is still to be agreed by the EU institutions and Member States. However, the EU Network and Information Security Directive and the IT Security Act cover similar topics. The IT Security Act can be seen as Germany’s position in further discussions about the EU Network and Information Security Directive. Next steps, and the final text of the Act, will be monitored with interest by Datonomy.

 

 

Posted in breach notification, cyber crime, data breach notification; telecoms package; europe, data breaches, data security standards, data theft, data violation, disclosure of personal data, EU, EU Legislation, Germany | Tagged , , , , , , , | Leave a comment