EN Official Journal of the European Union CE 84/766

(2004/C 84 E/0862)

WRITTEN QUESTION E-0183/04

by Charlotte Cederschiöld (PPE-DE) to the Commission

(29 January 2004)

Subject: Network and information security

Information technology security continues to be an area where the Commission and other EU-level bodies must take care to protect their internal systems. Does the Commission agree that the ‘Common Criteria’ provide internationally accepted standards for judging the security of ICT products and, if so, how can the European Network and Information Security Agency use the Common Criteria when procuring its own products and providing procurement guidance to EU and Member State bodies?

Joint answer

to Written Questions E-0181/04, E-0182/04 and E-0183/04

given by Mr Liikanen on behalf of the Commission

(10 March 2004)

With regard to network and information security standardisation and on Common Criteria in particular, the Commission has contributed throughout the whole process of the development of Common Criteria ever since the work with the predecessor, ITSEC, in 1991. The Commission has also worked with Member States in defining the Mutual Recognition Agreement of the Common Criteria standard ISO/IEC 15408.

The European Network and Information Security Agency (ENISA), that is also mentioned by the Honourable Member as a possible vehicle for promoting this standard further in Europe, is about to start its operations within the coming months. The Commission is presently contributing to the drafting of the ENISA's work programme. In this reply the Commission suggests some tasks related to standardisation for ENISA, but no definitive answers can, at this stage, be given as to what ENISA's coming work programme will look like.

From the Commission's perspective, the use of recognised standards for evaluation and certification of ICT-products has been an important component of the policy for network and information security. The use of such standards in procurement activities was promoted in the Council Recommendation (95/144/EC) of 7 April 1995 (1). In the Commission Communication Network and Information Security: Proposal for A European Policy Approach (2), the Commission emphasised the importance of security certification of products as a key element to contribute to the users' trust and confidence. In this respect, the Common Criteria standard represents a solid, internationally recognised, framework for security certification of products. As such, it is widely used in procurement activities.

It has, however, proven difficult (also in the United States) to get the commercial sector (and in particular the financial sector) interested in and committed to uptake of ISO/IEC 15408. This was highlighted at the International Common Criteria Conference held in Stockholm in September 2003. To remedy this, ENISA could support the uptake of such a standard by engaging the stakeholders in network security in a discussion of the issues, problems and opportunities associated with the use of Common Criteria.

As far as network and information security standardisation is concerned, the Commission is assessing the implications of the recent joint CEN-ETSI report (3), which deals with network and information security standardisation issues that are relevant to the European Standards Organizations (ESOs). On this basis, future actions and policy initiatives will be elaborated.

At the technical level, the Commission has set the development of secure products and systems as a high priority of the IST programme and this would certainly contribute to improving the development practices of ICT products in Europe. ENISA could complement this activity by helping the Member States in developing appropriate education curricula on security, sharing experiences and co-operation on awareness campaigns targeting in particular small and medium-sized enterprises (SMEs).

As the Common Criteria standards provide a framework for product security and certification, the Commission would consider the adoption of such a standard in procurement activities, to date, as a good practice in all cases where stringent and auditable security is needed. Hence, should ENISA have such needs, it would be advisable to refer, as appropriate, to the Common Criteria while procuring its own products or giving advice to the Commission and Member State Governments on the use of Common Criteria in procurement. However, the Commission shall not forget that certified security does not come cheaply.

Lastly, it is important to note that the technical standard ISO/IEC 15408 would not be sufficient to ensure adequate level of security in an organisation. Indeed, any organisation or business shall also select and adhere to a management security standard (such as ISO/IEC 17799) to build and manage the necessary security processes and practices.

(1) OJ L 93, 26.4.1995.

(2) COM(2001) 298 final.

(3) ETSI SR 002 298.