ISSE 2010 Securing Electronic Business Processes [electronic resource] : Highlights of the Information Security Solutions Europe 2010 Conference /
Information Security Solutions Europe (Conference)Corporate Author
Information Security Solutions Europe (Conference)
Information Security Solutions Europe (Conference)
Pohlmann, Norbert.editor.
Reimer, Helmut.editor.
Schneider, Wolfgang.editor.
This book presents the most interesting talks given at ISSE 2010 – the forum for the inter-disciplinary discussion of how to adequately secure electronic business processes. The topics include: - Identity and Security Management - Technical and Economical Aspects of Cloud Security - Security Services and Large Scale Public Applications - Smart Grid Security and Emerging Security Solutions - Privacy and Data Protection Adequate information security is one of the basic requirements of all electronic business processes. It is crucial for effective solutions that the possibilities offered by security technology can be integrated with the commercial requirements of the applications. The reader may expect state-of-the-art: best papers of the Conference ISSE 2010. The content: Identity and Security Management - Technical and Economical Aspects of Cloud Security - Security Services and Large Scale Public Applications - Smart Grid Security and Emerging Security Solutions - Privacy and Data Protection – Security Threats and Contermeasures Target Groups: Developers of Electronic Business Processes IT Managers IT Security Experts Researchers About the Editors: Norbert Pohlmann: Professor for System and Information Security at the University of Applied Sciences in Gelsenkirchen Helmut Reimer: Senior Consultant, TeleTrusT Wolfgang Schneider: Deputy Institute Director, Fraunhofer Institute SIT.
Contents; About this Book; Welcome; Germany on the Road to Electronic Proof of Identity; High security in miniature format; Security in many layers; Trust based on reciprocity; Give and take - the principle of networked system chains; Full control over data for citizens; Other components for using the German eID card; That's what authorisation certificates warrant; Tasks of AusweisApp; eID service as a trust authority; Who will benefit from the new eID architecture?; Security for the digital handshake; Citizens are the ones who will determine the success of the new concept; Outlook
ConclusionIdentityand Security Management; Security Analysis of OpenlD, followed by a Reference Implementation of an nPA-based OpenlD Provider; 1 OpenlD asa standard for SSO on the Internet; 1.1 Problem; 1.2 Overview of OpenlD; 1.3 Courseof the protocol; 1.4 Possible fields of application; 2 Security evaluation of using OpenlD; 2.1 The main threats: Phishing and profiling; 2.2 Additional risks and concerns; 3 The new identity card (nPA) in Germany; 3.1 Overview of the nPA; 3.2 Course of an online authentication; 3.3 Recognition via Restricted Identification
4 An nPA-based OpenlD provider (OP)4.1 Fundamental Concept; 4.2 OP's communication sequence; 4.3 Precondition for user and services; 4.4 Added value in different directions; 5 Outlook; 6 Summary; References; New Authentication Concepts for Electronic IdentityTokens; 1 Introduction; 2 Background and motivation; 2.1 Standardized interfaces in the context of electronic Identity Cards; 2.2 Java Card 3.0 connected; 2.3 Existing and emerging SAML-related profiles; 3 The Service Access Layer as interoperable smart card Interface; 4 New Authentication Concepts; 4.1 EAC Web Service Binding
4.2 Path Protection based on XML and WS Secure Conversation4.3 Path protection based on an EAC-TLS cipher suite; 4.4 Integrating eID and SAML; 4.4.1 Naïve integration using Web Browser SSO Profile; 4.4.2 An ECP-based SAML-profile for eID integration; 4.4.3 Identity Provider inside the elD-Taken; 5 Conclusion; References; A Simplified Approach for Classifying Applications; 1 Introduction; 2 Background; 3 Classification scheme; 3.1 Confidentiality; 3.2 Availability; 3.3 Integrity; 4 How to Classify Information; 4.1 Process-oriented Approach; 4.2 Application-oriented Approach; 5 Experiences
5.1 Application Classification5.2 Fast Lane Information Classification; 5.3 The FLICTool; 6 Conclusion; Technical and Economical Aspects of Cloud Security; Single Sign-on(SSO) to Cloud based Services and Legacy Applications ""Hitting the IAM wall""; 1 Examining the role of IAM as SSO enabler; 2 No SSO without solid Identity Management!; 3 What makes Access Control 'in the Cloud' special?; 3.1 Conventional SSO Solutions; 3.2 Access to non web based legacy applications; 3.3 Legacy Applications need user provisioning; 4 SSO to Web applications 'in the cloud' using federation
5 SSO to Web applications 'in the cloud' using a User Centric Identity Management Framework (UCIF)
"With 80 figures."
Includes bibliographical references and index.
This book presents the most interesting talks given at ISSE 2010 – the forum for the inter-disciplinary discussion of how to adequately secure electronic business processes. The topics include: - Identity and Security Management - Technical and Economical Aspects of Cloud Security - Security Services and Large Scale Public Applications - Smart Grid Security and Emerging Security Solutions - Privacy and Data Protection Adequate information security is one of the basic requirements of all electronic business processes. It is crucial for effective solutions that the possibilities offered by security technology can be integrated with the commercial requirements of the applications. The reader may expect state-of-the-art: best papers of the Conference ISSE 2010. The content: Identity and Security Management - Technical and Economical Aspects of Cloud Security - Security Services and Large Scale Public Applications - Smart Grid Security and Emerging Security Solutions - Privacy and Data Protection – Security Threats and Contermeasures Target Groups: Developers of Electronic Business Processes IT Managers IT Security Experts Researchers About the Editors: Norbert Pohlmann: Professor for System and Information Security at the University of Applied Sciences in Gelsenkirchen Helmut Reimer: Senior Consultant, TeleTrusT Wolfgang Schneider: Deputy Institute Director, Fraunhofer Institute SIT.
Computer science.
Computer security.
Computer Science, general.
Systems and Data Security.