Enterprise Security IT Security Solutions -- Concepts, Practical Experiences, Technologies

by Fumy, Walter; Sauerbrey, J?rg

• ISBN13: 9783895782671
• ISBN10: 389578267X
• Format: Hardcover
• Copyright: 2006-01-17
• Publisher: Publicis

Summary

In order for enterprises to truly achieve security, they need to have in-depth knowledge of security management This book discusses the concepts, trends, technologies, and standards behind enterprise security Shares practical experiences, including risk management in the financial services industry, IT security in the automotive sector, smart card applications for hospitals, IT security for e-Government applications, and more Examines cryptographic techniques, public key infrastructure, intelligent tokens, process and product certification, and identity and access management technologies

Author Biography

DR WALTER FUMY is Vice President Security Technology at Siemens Communications, where he is responsible for overseeing research and development in the area of I&C security which includes to select and/or develop advanced solutions, to partner with best-in-class technology providers, and to monitor and/or influence appropriate standards bodies and forums. He has published numerous papers and several books, and is a frequent speaker at conferences and events. Since 1997 Fumy is Chairman of ISO committee SC 27 "IT Security Techniques". He is also chairing the German BITKOM's Group on Security Management.

PROF JOERG SAUERBREY is Vice President Product Management for IT security solutions at Siemens Communications. He is responsible for own products, partner products and services for the worldwide IT security solutions business. In 1992 he has been awarded with the annual price of the ITG (German Information Technology Association). Since 2001 he is Honorary Professor for IT security at Technical University Munich, Germany. He has published numerous papers and a book, gives lectures, and is a frequent speaker at conferences and events.

Table of Contents

Introduction
Challenges for Enterprise Security	16	(12)
Walter Fumy
Joerg Sauerbrey
Threats	16	(3)
Enabling New Business Opportunities	19	(1)
Compliance	20	(3)
Why this Book?	23	(1)
How to Read this Book	24	(4)
Part I: Concepts and Trends
Information Security Management	28	(16)
Sabine Kornprobst
Roberto Pillmaier
Goals of Information Security Management	28	(2)
Starting Point / Current Situation	30	(2)
Drivers for Information Security Management	32	(3)
What's the Best Way?	35	(1)
Object-Oriented vs. Process-Oriented Approach	35	(1)
Strategic Comprehensive Approach	36	(1)
Solutions	37	(6)
Conclusion	43	(1)
Network and System Security	44	(13)
Uwe Blocher
Challenges and Requirements	44	(1)
Solution Components	45	(10)
Firewall	46	(2)
Virtual Private Networks	48	(2)
Remote LAN Access	50	(1)
Intrusion Detection and Prevention Systems	51	(2)
Filtering Content: Content Security and Gateway Antivirus	53	(1)
All-in-One Communication Platforms	54	(1)
Integrated Solution for Data and Voice Communication	55	(1)
Conclusion	55	(2)
Smart Card Solutions	57	(13)
Axel Pfan
Introduction	57	(1)
Types of Smart Cards	58	(3)
Communication with the Chip	58	(1)
Type of Chip	59	(2)
Smart Card Infrastructure	61	(4)
Card Management System (CMS)	61	(2)
Public Key Infrastructure (PKI)	63	(1)
Smart Card Readers	64	(1)
Smart Card-Enabled Applications	65	(4)
One Card, Many Functions	66	(1)
The Argument for Single Sign-On	67	(1)
Return on Investment for Smart Card-Enabled Solutions	68	(1)
Conclusion	69	(1)
Identity and Access Management (IAM)	70	(14)
Rudolf Wildgruber
Challenges	70	(1)
Use Cases	71	(4)
Making a New Employee Productive Quickly	71	(1)
Changing an Employee's Job Function	72	(1)
Changing a User Password	73	(1)
Authorizing an Order	73	(1)
Web Single Sign-On	74	(1)
Components	75	(6)
Directory Services	75	(1)
Identity Management	76	(3)
Access Management	79	(2)
IAM for Heterogeneous Environments	81	(1)
IAM and Regulatory Compliance	82	(1)
Conclusion	82	(2)
Biometric Authentication	84	(20)
Gerd Hribernig
Peter Weinzierl
Biometric Systems	84	(5)
Types of Biometric Systems	84	(3)
General Working Scheme of a Biometric System	87	(1)
Components of a Biometric System	88	(1)
Deployment of Biometric Systems	89	(4)
Requirements	89	(1)
Verification versus Identification Scenario	90	(1)
Performance of Biometric Systems	90	(3)
Biometrics Security -- User Authentication	93	(4)
General	93	(1)
Two- and Multi-Factor Authentication	93	(1)
Combining Possession and Biometrics	94	(2)
Fraud and Mitigation	96	(1)
Systems	97	(3)
Software	100	(2)
Conclusion	102	(2)
Part II: Practical Experiences
Risk Management in the Financial Services Industry	104	(12)
Roland Muller
The Merger of Two Automotive Corporations	104	(1)
Legal Requirements for Financial Services Providers	105	(1)
Risk Control Legislation	105	(1)
Data Protection Legislation	105	(1)
Legislation Fighting Organized Crime and Terrorism	106	(1)
The Decision to Use an International Standard	106	(2)
Information Security Status Evaluation	108	(1)
Derivation of Activities	109	(3)
Corporate-wide Activities	110	(1)
Local Activities	111	(1)
Interim results	112	(2)
Support Process	112	(1)
Work Stream Results	112	(2)
The Ongoing Information Security Process	114	(1)
Conclusion	115	(1)
Digital Signatures for eGovernment Applications	116	(10)
Joacquin Galeano
Introduction	116	(1)
ACCV -- The Certification Authority (CA)	116	(4)
What Can Be Done With the Certificates?	117	(1)
Implementation Steps	118	(2)
Applications	120	(4)
Some Relevant Data	124	(1)
Conclusion	124	(2)
Identity Management for an Insurance Company	126	(8)
Jurgen Lorek
The Starting Point	126	(2)
Project Setup and Goals	128	(1)
The New Solution	129	(3)
Success Factors	132	(1)
Conclusion	132	(2)
Infosec Management in a Global Enterprise	134	(14)
Reinhard Schopf
Introduction and Motivation	134	(1)
The Siemens PKI	135	(5)
The Siemens Corporate ID Card	140	(1)
The Business Case	141	(4)
Electronic Identities	142	(1)
Digital Signatures	143	(1)
Increase of Security	144	(1)
Benchmarking	145	(1)
Conclusion	145	(3)
Part III: Technologies and Standards
Cryptographic Techniques	148	(19)
Walter Fumy
Ute Rosenbaum
Goals of Cryptographic Techniques	148	(5)
Symmetric Algorithms	149	(1)
Asymmetric Algorithms	150	(2)
Keyless Algorithms	152	(1)
Symmetric Encryption Algorithms	153	(3)
Stream and Block Ciphers	153	(1)
DES	154	(1)
Triple-DES	154	(1)
AES	154	(1)
Other Symmetric Ciphers	155	(1)
Asymmetric Encryption Algorithms	156	(1)
RSA Encryption	156	(1)
Hybrid Encryption	157	(1)
Hash Functions	157	(1)
Message Authentication Codes (MAC)	158	(1)
Digital Signatures	159	(1)
RSA Signatures	159	(1)
Discrete Logarithm-Based Signatures	160	(1)
Elliptic Curve-Based Signatures	160	(1)
Algorithm and Parameter Recommendations	160	(6)
Security Levels and Moore's Law	161	(1)
Cryptanalysis	162	(1)
Quantum Cryptanalysis	162	(1)
Key Size Recommendations	163	(3)
Conclusion	166	(1)
Public Key Infrastructure (PKI)	167	(16)
Michael Munzert
Motivation	167	(1)
Certificates	168	(3)
Users, Services and Components of a PKI	171	(6)
PKI Users	171	(1)
PKI Services	172	(1)
PKI Components	173	(3)
Communication between PKI Components, PKI Users and PKI Services	176	(1)
PKI and Authentication	177	(1)
PKI Domains	177	(3)
Single Trust Domain	177	(2)
Combining Trust Domains	179	(1)
Deployment Considerations -- Essential Steps for Building up a PKI	180	(2)
Conclusion	182	(1)
Smart Card Technologies	183	(9)
Detlef Houdeau
The Beginning	183	(1)
Application Segments for Smart Cards	184	(1)
Technology Drivers	185	(3)
Computing Power	185	(1)
Memory Size	185	(1)
Security on Silicon	186	(2)
Interface and Speed	188	(1)
Contact Interface	188	(1)
Contact-less Interface	188	(1)
USB Interface	189	(1)
Standards	189	(1)
Smart Card Production	190	(1)
Conclusion	191	(1)
Identity and Access Management Technologies	192	(34)
Tendor Dumitrescu
Oliver Pfaff
Fundamental Concepts	192	(5)
Identity Management	192	(1)
Authentication and Single Sign-On (SSO)	193	(2)
Authorization	195	(2)
Identity and Access Management Reference Model	197	(1)
Traditional Technologies	197	(13)
LDAP	197	(3)
X.500	200	(2)
Metadirectory and Provisioning	202	(2)
Kerberos	204	(2)
Traditional Authorization Techniques	206	(4)
Further Initiatives	210	(1)
Emerging Technologies	210	(10)
SAML	210	(1)
Shibboleth	211	(1)
Liberty-Alliance	212	(1)
XACML	213	(2)
Web Services Security (WS-Security)	215	(2)
SPML	217	(2)
Further Initiatives	219	(1)
Applications and Examples	220	(5)
Provisioning Windows Domain Accounts	220	(1)
Web-SSO and Authorization	221	(2)
Identity Federation	223	(2)
Conclusion	225	(1)
Information Security Management Systems	226	(19)
Steve O'Reilly
The Need for and Relevance of Information Security	226	(3)
Introduction	226	(1)
Business Drivers for Information Security	227	(2)
Business Issues	229	(1)
Focussing on Security Critical Business Processes	229	(3)
Setting a Management System Scope	230	(1)
Scoping and Security Assurance Strategies	231	(1)
Establishing an Effective Information Security Structure and Culture	232	(5)
Management System Development	232	(1)
Information Security Assessment and Improvement	233	(1)
The Information Asset Register	234	(1)
Selecting Risk Justified Controls	234	(1)
Implementing Controls	235	(1)
Security Documentation	235	(1)
Security Roles and Responsibilities	236	(1)
Information Security Management Forum	237	(1)
Maintaining Effective Security	237	(3)
ISMS Maintenance	237	(1)
Raising Security Awareness	237	(1)
Security Incident Reporting and Management	238	(1)
Security Assurance Mechanisms	238	(1)
Operating the ISMS	239	(1)
Assurance in Third Parties and Outsourcing Issues	240	(4)
Typical Third Party and Outsourcing Scenarios	240	(3)
Achieving and Measuring Security Assurance	243	(1)
Conclusion	244	(1)
Glossary and Abbreviations	245	(8)
References	253	(7)
Index	260