# IFIP Technical Committee 11 Security and Privacy Protection in Information Processing Systems

Kai Rannenberg, Sh Solms, Leon Strous

► To cite this version:

Kai Rannenberg, Sh Solms, Leon Strous. IFIP Technical Committee 11 Security and Privacy Protection in Information Processing Systems. 26th International Information Security Conference (SEC), Jun 2011, Lucerne, Switzerland. pp.317-325, 10.1007/978-3-642-21424-0_26 . hal-01567604

HAL Id: hal-01567604

https://inria.hal.science/hal-01567604

Submitted on 24 Jul 2017

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
IFIP Technical Committee 11
Security and Privacy Protection
in Information Processing Systems<fnref n="1" />

Kai Rannenberg, SH (Basie) von Solms, Leon Strous

**Abstract.** IFIP Technical Committee 11 (TC-11) on Security and Privacy Protection in Information Processing Systems was created in 1983 under the chairship of the late Kristian Beckman of Sweden. Representatives from more than 30 IFIP member societies are members of TC-11 and meet at least once a year at the IFIP/Sec conferences that are held in different member countries. This text gives an overview on the state of TC-11 and its development over the last 28 years. It starts with a snapshot on the current situation of TC-11, followed in Section 2 by an overview of the historical background and trends of TC-11 and its flagship conference IFIP/Sec. Section 3 is dedicated to the main development trends in the field of TC-11, while Section 4 honours the awardees of TC-11's Kristian Beckman Award, many of them TC-11 Pioneers. Section 5 then gives an outlook on the future role of TC-11.

**Keywords:** Security, Privacy, Protection, Information Processing Systems, IT Systems, ICT Systems, IFIP, IFIP Technical Committee 11

# 1 TC-11 – a snapshot

TC-11 can to some degree be recognized by its aims, scope, and last but not least its working groups, which are introduced in the following sections. All three underwent some significant changes over the past 28 years, which are documented in the remainder of this article

## 1.1 TC-11 Aims

To increase the trustworthiness and general confidence in information processing and to act as a forum for security and privacy protection experts and others professionally active in the field

<footnote n="1">¹ This text is an updated version of “IFIP Technical Committee 11 Security and Privacy Protection in Information Processing Systems”, pp. 302–310 in: Kai Rannenberg, Vijay Varadharajan, Christian Weber (Eds.): “Security and Privacy - Silver Linings in the Cloud”, Proceedings of the 25th IFIP TC 11 International Information Security Conference, SEC 2010, held as part of WCC 2010, Brisbane, Australia, September 20-23, 2010, IFIP Advances in Information and Communication Technology, Vol. 330, 2010, ISBN 978-3-642-15256-6, and pp. 153–161 in Klaus Brunnstein and Heinz Zemanek (Eds.): “50 years of IFIP - Development and Visions”, ISBN: 978-3-901882-43-2, www.ifip.org.</footnote>
## 1.2 TC-11 Scope

Work towards:

* the establishment of a common frame of reference for security and privacy protection in organizations, professions and the public domain;

* the exchange of practical experience;

* the dissemination of information on and the evaluation of current and future protective techniques;

* the promotion of security and privacy protection as essential elements of information processing systems;

* the clarification of the relation between security and privacy protection.

## 1.3 TC-11 Working Groups

Already in 1985 TC-11 established its first working groups. Since then number and activity of TC-11's WGs underwent a non-linear but steady growth with two new WGs being established in 2010 driving the number of TC-11s WGs up to twelve, of which two WGs are shared with fellow TCs. The current WG list reads as follows:

1. WG 11.1: Information Security Management (established 1985)

2. WG 11.2: Pervasive Systems Security (established 1985 as the WG on Office Automation and from 1992 until 2009 named Small System Security)

3. WG 11.3: Data and Application Security (established 1987 under the name of Database Security and renamed 2001)

4. WG 11.4: Network & Distributed Systems Security (established 1985 under the name of Crypto Management and from 1992 until 2003 named Network Security)

5. WG 11.6: Identity Management (established 2006)

6. WG 9.6 / 11.7: IT Misuse and The Law (established 1990)

7. WG 11.8: Information Security Education (established 1991)

8. WG 11.9: Digital Forensics (established 2004)

9. WG 11.10: Critical Infrastructure Protection (established 2006)

10. WG 11.11: Trust Management (established 2006)

11. WG 11.12: Human Aspects of Information Security and Assurance (established 2010)

12. WG 8.11 / 11.13: Information Systems Security Research (established 2010)

# 2 The historical background of TC-11 and its flagship conference

In May 1983, the 1st International Conference on Information Security, IFIP/Sec '83, took place in Stockholm, Sweden. This conference was organized by members of the Swedish Special Interest Group on Information Security, as well as a number of further people, including some from existing IFIP Committees. The organization was
under the chairman-ship of Kristian Beckman of Sweden. A proposal was submitted to IFIP's General Assembly (GA), and at its meeting in September 1983 in Paris, TC-11 was formally established. Kristian Beckman was appointed as the first Chairman of TC-11.

The 2nd International Conference on Information Security, IFIP/Sec '84, took place in May 1984 in Toronto with the motto "Computer security: a global challenge". During this conference, the first official meeting of TC-11 was held. Unfortunately, because of ill health, Kristian Beckman could not attend that meeting. He asked Per Hoving from Sweden to act as Chairman, but during the conference, the sad news that Kristian Beckman passed away, reached TC-11.

The next TC-11 meeting took place in Dublin during IFIP/Sec 85, which had the motto "Computer security: The practical issues in a troubled world". Per Hoving was elected as Chairman for a three year term, with Willis Ware from the USA as Vice-Chairman.

Subsequent IFIP/Sec Conferences took place as follows and show the real global approach of TC-11 both with regards to its flagship conference as well as its management teams:

* IFIP/Sec 86 Monte Carlo: "Security and protection in information systems"

* 1987: No IFIP/Sec Conference took place, but a TC-11 meeting was held in Vienna (Austria) in conjunction with a TC-11 Working Group conference.

* IFIP/Sec 88 Gold Coast, Australia: "Computer security in the age of information". At the corresponding TC-11 meeting Bill Caelli from Australia was elected as new Chair, Willis Ware re-elected as Vice-Chair, and David Lindsay from the UK as Secretary.

* 1989: No IFIP/Sec conference was held, and efforts were combined with the IFIP Congress which took place in San Francisco, USA.

* IFIP/Sec 90 Helsinki, Finland: "Computer security and information integrity"

* IFIP/Sec 91 Brighton, England: "Information security"

* IFIP/Sec 92 Singapore: "IT security: the need for international cooperation"

* IFIP/Sec 93 Toronto, Canada: "Computer security". Unfortunately David Lindsay died before IFIP/Sec 93. Bertil Fortrie from the Netherlands took over as Secretary.

* IFIP/Sec 94 Curaçao: At the TC-11 meeting during this conference Sebastiaan von Solms from South Africa was elected as Vice-Chair and David Bachelor from Canada as Secretary. Later that year Sebastiaan von Solms was appointed as acting Chair of TC-11 by the IFIP President.

* IFIP/Sec 95 Cape Town, South Africa: "Information security - the next decade". At the TC-11 meeting preceding the conference Sebastiaan von Solms was elected as new Chair with Reinhard Posch from Austria as Vice-Chair.

* IFIP/Sec 96 Samos Island, Greece: "Information systems security: facing the information society of the 21st century"

* IFIP/Sec 97 Copenhagen, Denmark: "IT Security in Research and Business"

* IFIP/Sec 98 Vienna/Budapest, Austria/Hungary with the motto "Global IT security" and as part of the IFIP World Computer Congress
* 1999: No IFIP/Sec Conference took place, but a TC-11 meeting was held in Amsterdam (Netherlands) in conjunction with a TC-11 Working Group conference.

* IFIP/Sec 2000 Beijing, China with the motto "Information Security for global information infrastructures" as part of the IFIP World Computer Congress: Geoff Fairall from Zimbabwe was appointed as new Secretary of TC-11.

* IFIP/Sec 2001 Paris, France: "Trusted information: the new decade challenge". At the TC-11 meeting preceding the conference Leon Strous from the Netherlands was elected as new Chair with Kai Rannenberg from Germany as Vice-Chair. Rossouw von Solms from South Africa was appointed as WG coordinator.

* IFIP/Sec 2002 Cairo, Egypt: "Security in the information society: visions and perspectives"

* IFIP/Sec 2003 Athens, Greece: "Security and privacy in the age of uncertainty"

* IFIP/Sec 2004 Toulouse, France with the motto "Security and protection in information processing systems" as part of the IFIP World Computer Congress

* IFIP/Sec 2005 Tokyo-Chiba, Japan: "Security and privacy in the age of ubiquitous computing". Lech Janczewski from New Zealand, representing SEARCC, was appointed as Secretary.

* IFIP/Sec 2006 Karlstad, Sweden: "Security and privacy in dynamic environments"

* IFIP/Sec 2007 Johannesburg-Sandton, South Africa: "New approaches for security, privacy and trust in complex environments". At the TC-11 meeting preceding the conference Kai Rannenberg from Germany was elected as new Chair with Rossouw von Solms from South Africa as Vice-Chair.

* IFIP/Sec 2008 Milano, Italy as part of the IFIP World Computer Congress: At the TC-11 meeting preceding the conference Yuko Murayama from Japan was appointed as WG Coordinator.

* IFIP/Sec 2009 Pafos, Cyprus: "Emerging Challenges for Security, Privacy and Trust"

* IFIP/Sec 2010 Brisbane, Australia with the motto "Security & Privacy – Silver Linings in the Cloud" as part of the IFIP World Computer Congress: At the TC-11 meeting preceding the conference Yuko Murayama from Japan was appointed as Vice Chair in addition to Rossouw von Solms from South Africa.

* IFIP/Sec 2011 Lucerne, Switzerland with the motto "Future Challenges in Security and Privacy for Academia and Industry"

* IFIP/Sec 2012 scheduled for Greece

TC-11's annual IFIP/Sec conferences are established as an integral and well-reputed part of the international Information Security conference scene. The same holds for many Working Group conferences.
# 3 Main development trends in the field of TC-11

## 3.1 The 80es

The early eighties were the years when personal computers started to invade people's lives. One saw an increasing concern about several issues like privacy and witnessed the "birth" of computer viruses. The attention for security started to evolve from the closed defence and mainframe environments to business and small computer environments, from confidentiality towards integrity, from technical security to managerial issues. This was clearly an era where establishing a TC dedicated to security was an obvious thing to do. The founders made it clear by the name and aims and scope of TC-11 that security is not limited to computers but encompasses computers, applications, data and the organization. That was more or less a visionary view because in those days the term computer security was more common than the term information security.

## 3.2 The 90es

The increasing trend towards distributed systems, and the associated use of communication networks, as well as the tendency to use such systems and networks for more and more highly sensitive applications like electronic commerce and medical applications, catapulted the absolute importance of the securing and protecting of electronic information during storage, processing and transmission right into the forefront of Information Technology research and implementation.

It became clear that a very large number of such systems would not be acceptable if proper solutions would not exist for the security and protection of such systems. Developments in cryptography showed to be essential to provide non-reputability and proof of origin in electronic messages. Without digital signatures, provided by cryptography, electronic purchasing was deemed to be not possible.

Security in distributed systems became known to be much more difficult and complex than in centralized systems. Authentication and Authorization in distributed systems are of extreme importance, and must be given the necessary attention.

New techniques to implement and to specifically manage Information Security were constantly needed, and with the growing complexity of IT systems, the internal control of the systems became ever more important. The same held for the growing role, importance and commitment of senior management of companies, up to Board level, towards the security of their companies' IT systems. Special efforts were needed to provide skilled people to be able to evaluate, address and manage security risks involved in IT systems, and to ensure that such systems are operated within the necessary secure environment.

With the fact that computers became so much more user friendly than before, and so much more were being used by the public in general, a serious effort showed up as being needed to make these people aware of the importance of Information Security on their systems, and to show them the risks if such security measures were ignored.
In the application field, Information Security became ever more essential for the
growing use of systems in medical applications. Standardization efforts and
cryptology policies in different countries also required attention. All in all,
Information Security had never before been a more important and essential part of IT
systems and networks.

These developments were reflected in TC-11's work mainly by the expanding
activities in the respective TC-11's Working Groups, but also by public statements
from TC-11. One statement concerns IFIP's position on crypto policies and was
drafted in the second half of the nineties. It reflected that cryptography was a hot topic
from a policy point of view and discussions concentrated on questions such as
whether governments should have access to the keys in encryption systems used by
companies and individuals. A second statement concerned information security
assessment and certification and addressed TC-11's opinion that the information
security status of IT systems and the information security management of such
systems should be assessed against specified standards related to information security
management and that members of IFIP should be instrumental to ensure that such
standards, for systems and individuals, be harmonized on an international level.

3.3 The Beginning of the new Millennium

The early beginning of the new Millennium was driven by the Internet and mobile
Communication becoming more and more mainstream. “E-words” such as “E-
Commerce” and “E-Business” became and more popular. While many of them were
just buzzwords, as almost everything from the “old” world became e-d there was little
doubt that some of these areas would have significant impact on business and society
as a whole. Following this it stepwise became clear that trust and confidence in the
security and reliability of all those “e-words” was necessary for them to become the
success that everybody was hoping (and waiting) for. So many topics within the scope
of TC-11 were influential in that respect, e.g. identification and authentication means
(biometrics and smart(er) cards), integrity of messages, secure business transactions
and payments.

The events of September 11, 2001 pointed strongly to further aspects of security
such as cyber terrorism and (critical) infrastructure protection (CIP). Not only did
these issues require new technologies or larger scale use of known technologies
(biometrics and smart(er) cards again?) they also shed a different light on privacy
issues and human aspects.

To address these issues in an effective way even more cooperation between the
different IFIP disciplines was required. Topics of most of the TC's became relevant
such as topics like software quality (TC-2), training people (TC-3), safety-critical
systems (TC-10), and social aspects and human-computer interaction (TC-9 and TC-
13). And although those issues may have seemed to be of a technical nature, one
could not hide from the fact that cultural and political aspects also do play a role. IFIP
had to consider this when addressing the issues and trying to find a way to deal with
them in an as “neutral” as possible fashion. New successful WGs such as WG 11.9
Digital Forensics (established 2004) and the trio of WG 11.6: Identity Management,
WG 11.10 Critical Infrastructure Protection, and WG 11.11 Trust Management (all three established 2006) reflected these developments.

A related achievement concerned the objective to promote security and protection as essential elements of information processing systems. TC-11 had been successful in this area, which can be measured directly within the IFIP community by the fact that more and more TC's and working groups were including security in their aims and scopes. This also resulted in an increasing cooperation between TC's and working groups on security topics such as the Communications and Multimedia Security (CMS) conferences of TC-6 and TC-11 and the E-Commerce, E-Government and E-Business (I3E) conferences of TC-6, TC-8 and TC-11, and last but not least the joint WG with TC-9 on legal, privacy and social issues (WG 9.6/11.7 IT Misuse and the Law), a very successful example of an active cooperation.

At the same time some “old” issues did not disappear and one did not succeed in eliminating them. Although their “hot” days were over and they were no longer in the focus of attention (with the exception of an occasional short hype), these activities still had and continued to have a significant impact. Hackers and viruses continued to cost society a lot of money and the security professionals kept trying to find ways to limit the effects as much as possible.

Another important issue was attention for developing countries. While IFIP as a whole supported the work of the Developing Countries Support Committee (DCSC) and the World IT Forum (WITFOR) TC-11 was one of the TCs actively participating in these initiatives by e.g. actively strengthening its activities in developing countries and encouraging participation from the respective member societies to also review and revise traditional (maybe “northern” or “western”) views.

Moreover in 2002 TC-11 agreed on another statement which contains a request to all member societies of IFIP to urge their relevant government and education bodies to ensure that proper education and certification requirements are set for those people who intend to become information technology security professionals and including those who audit the security of IT systems.

## 3.4 Current Challenges

Especially the Internet but also other Information and Communication Technology (ICT) systems such as Mobile Communication systems have moved even further on: From popular and established mainstream technologies to the information and communication backbones for many societies and countries and moreover as the essential infrastructures for global and international cooperation.

The rapid and radical movement towards new and Internet based ICT systems was partially supported by the decline of some established technologies, but also by the changing habits of users. It has raised major questions of trust in to the ICT systems and into information security as such and demonstrated the importance of projection of citizens, consumers and their privacy. TC-11 reflected this development in more and more IFIP/Sec mottos since 2003 and moreover with its first TC name change since its inception: In 2007 the term “Privacy” was added to TC-11’s name and subsequently the aims and scope were adapted accordingly. This was preferred to
simply establishing a new WG on Privacy as the deep and delicate relations between
security and privacy were considered where information security sometimes supports
privacy and sometimes endangers it. These delicate relations affect the work of most
WGs in IFIP TC-11.

The further miniaturisation and the pervasive use of ICT lead WG 11.2 to changing
its name from “Small System Security” to “Pervasive Systems Security” reflecting the
fact, that almost every aspect of (human) life is now exposed to ICT. This trend also
led to the founding of WG 11.12 “Human Aspects of Information Security and
Assurance”. At the same time it became clear, that Information Security is also
important for researchers and in the information systems field leading to a new WG
8.11 / 11.13 “Information Systems Security Research” together with TC-8.

4 The Kristian Beckman Award

TC-11 established the Kristian Beckman Award in 1992 to commemorate the first
chair of the committee, Kristian Beckman from Sweden, who had also been
responsible for promoting the founding of TC-11 in 1983. This award is granted not
more than annually to a successful nominee and is usually presented at IFIP/Sec. The
objective of the award is to publicly recognise an individual, not a group or
organisation, who has significantly contributed to the development of information
security, especially from an international perspective. However this particular
requirement will not necessarily preclude nominations of those whose main
achievements have been made on a national level. Many of the awardees can be
considered IFIP (TC-11) Pioneers.

TC-11 was honoured to award the Kristian Beckman Award to:

* Harold Highland (USA) in 1993, presented in Toronto (Canada)

* Per Hoving (Sweden) in 1995, presented in Cape Town (South Africa)

* Sushil Jajodia (USA) in 1996, presented in Samos (Greece)

* Donald Davies (UK) in 1997, presented in Copenhagen (Denmark)

* Richard Sizer (UK) in 1998, presented in Vienna and Budapest (Austria and Hungary)

* Willis W. Ware (USA) in 1999, presented in Amsterdam (Netherlands)

* William Caelli (Australia) in 2002, presented in Cairo (Egypt)

* Roger Needham (UK) in 2003, presented in Athens (Greece)

* Jean-Jacques Quisquater (Belgium) in 2004, presented in Toulouse (France)

* William List (UK) in 2005, presented in Tokyo-Chiba (Japan)

* Butler W. Lampson (USA) in 2006, presented in Karlstad (Sweden)

* Pierangela Samarati (Italy) in 2008, presented in Milano (Italy)

* Klaus Brunnstein (Germany) in 2009, presented in Pafos (Cyprus)

* Sebastiaan von Solms (South Africa) in 2010, presented in Brisbane (Australia)

* Ann Cavoukian (Canada) in 2011, to be presented in Lucerne (Switzerland)
# 5 The Future Role of TC-11

With the rising importance of ICT systems and society's dependability on these systems, the role of TC-11 and its topics has risen significantly over the last years, and is still rising. TC-11 has taken up this challenge and is active on several fronts through its Working Groups, its special conferences to discuss research developments, and other dissemination services to member societies of IFIP and to the international community in general. However a number of challenges remain and are even growing:

* Still relevant security and privacy issues are only considered relatively late in system development processes – and often still too late.

* Security and privacy are “horizontal” subjects and orthogonal to many topics that are cared for by other IFIP TCs.

* In many cases appropriate decisions with regard to security and privacy can only be taken, if the respective (application) context is considered.

Therefore TC-11 is encouraging the inclusion of security and privacy topics in all areas and actively cooperates with other TCs. This will hopefully contribute to a situation, where relevant security and privacy considerations and measures are embedded as a natural topic in all domains rather than coming in late.
# 6 Contact Information

**TC-11 Homepage:** www.ifiptc11.org

## TC-11 Management:

### TC-11 Chair

Prof. Dr. Kai Rannenberg
T-Mobile Chair of
Mobile Business & Multilateral Security
Goethe University Frankfurt
Postfach 66
Grüneburgplatz 1
60629 Frankfurt / Main, Germany
Tel: +49 69 798 34701
Fax: +49 69 798 35004
www.m-chair.net

eMail: kai.rannenberg@m-chair.net

### TC-11 Vice-Chair

Prof. Dr. Rossouw von Solms
Nelson Mandela Metropolitan University
Institute for ICT Advancement, School of ICT
Summerstrand (North)
P.O. Box 77000
Port Elizabeth 6031
South Africa
Tel: +27 41 504 3604
Fax: +27 41 504 3313

eMail: rossouw.vonsolms@nmmu.ac.za

### TC-11 Vice-Chair & WG Coordinator

Prof. Dr. Yuko Murayama
Faculty of Software and Information Science
Iwate Prefectural University
152-52 Sugo, Takizawa,
Takizawa-mura
Iwate, 020-0193
Japan
Tel: +81 19-694-2548
Fax: +81 19-694-2549

eMail: murayama@iwate-pu.ac.jp

### TC-11 Secretary

Prof. Dr. Lech Janczewski
The University of Auckland
Dept. of ISOM
Private Bag 92019
Owen G Glen Building
12 Grafton Road
Auckland, New Zealand
Tel: +64 9 923 7538
Fax: +64 9 373 7430

eMail: lech@auckland.ac.nz

## TC-11 Webmaster:

Gökhan Bal
T-Mobile Chair of
Mobile Business & Multilateral Security
Goethe University Frankfurt
Grüneburgplatz 1
60629 Frankfurt / Main, Germany
Tel: +49 69 798 34701, Fax: +49 69 798 35004
www.m-chair.net
eMail: contact@ifiptc11.org