WRITTEN QUESTION E-0183/04 by Charlotte Cederschiöld (PPE-DE) to the Commission. Network and information security.
Date: 2004-01-29
Institutions: European Parliament, Provisional data
Subjects: European Union Agency for Cybersecurity, computer network, data protection, international standard, product safety, software, standardisation

C 84 E/766

Official Journal of the European Union

EN

3.4.2004

and are not being considered by all Member States during the procurement of ICT products? Has the
Commission considered how the European Network and Security Agency can promote further European
uptake of the Common Criteria?

(2004/C 84 E/0861)

WRITTEN QUESTION E-0182/04

by Charlotte Cederschiöld (PPE-DE) to the Commission

(29 January 2004)

Subject: Network and information security

Does the Commission agree that ICT products should be designed with specific security standards in mind,
and with the goal of being evaluated and certified as having an internationally recognised level of security?
If so, how can the European Network and Information Security Agency use the ‘Common Criteria’ to
promote this goal?

(2004/C 84 E/0862)

WRITTEN QUESTION E-0183/04

by Charlotte Cederschiöld (PPE-DE) to the Commission

(29 January 2004)

Subject: Network and information security

Information technology security continues to be an area where the Commission and other EU-level bodies
must take care to protect their internal systems. Does the Commission agree that the ‘Common Criteria’
provide internationally accepted standards for judging the security of ICT products and, if so, how can the
European Network and Information Security Agency use the Common Criteria when procuring its own
products and providing procurement guidance to EU and Member State bodies?

Joint answer
to Written Questions E-0181/04, E-0182/04 and E-0183/04
given by Mr Liikanen on behalf of the Commission

(10 March 2004)

With regard to network and information security standardisation and on Common Criteria in particular,
the Commission has contributed throughout the whole process of the development of Common Criteria
ever since the work with the predecessor, ITSEC, in 1991. The Commission has also worked with Member
States in defining the Mutual Recognition Agreement of the Common Criteria standard ISO/IEC 15408.

is also mentioned by the
The European Network and Information Security Agency (ENISA),
Honourable Member as a possible vehicle for promoting this standard further in Europe, is about to start
its operations within the coming months. The Commission is presently contributing to the drafting of the
ENISA’s work programme. In this reply the Commission suggests some tasks related to standardisation for
ENISA, but no definitive answers can, at this stage, be given as to what ENISA’s coming work programme
will look like.

that

From the Commission’s perspective, the use of recognised standards for evaluation and certification of ICT-
products has been an important component of the policy for network and information security. The use of
such standards in procurement activities was promoted in the Council Recommendation (95/144/EC) of
7 April 1995 (1). In the Commission Communication Network and Information Security: Proposal for A
European Policy Approach (2), the Commission emphasised the importance of security certification of
products as a key element to contribute to the users’ trust and confidence. In this respect, the Common
Criteria standard represents a solid,
internationally recognised, framework for security certification of
products. As such, it is widely used in procurement activities.

3.4.2004

EN

Official Journal of the European Union

C 84 E/767

It has, however, proven difficult (also in the United States) to get the commercial sector (and in particular
the financial sector) interested in and committed to uptake of ISO/IEC 15408. This was highlighted at the
International Common Criteria Conference held in Stockholm in September 2003. To remedy this, ENISA
could support the uptake of such a standard by engaging the stakeholders in network security in a
discussion of the issues, problems and opportunities associated with the use of Common Criteria.

As far as network and information security standardisation is concerned, the Commission is assessing the
implications of the recent joint CEN-ETSI report (3), which deals with network and information security
standardisation issues that are relevant to the European Standards Organizations (ESOs). On this basis,
future actions and policy initiatives will be elaborated.

At the technical level, the Commission has set the development of secure products and systems as a high
priority of the IST programme and this would certainly contribute to improving the development practices
of ICT products in Europe. ENISA could complement this activity by helping the Member States in
developing appropriate education curricula on security, sharing experiences and co-operation on awareness
campaigns targeting in particular small and medium-sized enterprises (SMEs).

the
As the Common Criteria standards provide a framework for product security and certification,
Commission would consider the adoption of such a standard in procurement activities, to date, as a good
practice in all cases where stringent and auditable security is needed. Hence, should ENISA have such
needs, it would be advisable to refer, as appropriate, to the Common Criteria while procuring its own
products or giving advice to the Commission and Member State Governments on the use of Common
Criteria in procurement. However, the Commission shall not forget that certified security does not come
cheaply.

Lastly, it is important to note that the technical standard ISO/IEC 15408 would not be sufficient to ensure
adequate level of security in an organisation. Indeed, any organisation or business shall also select and
adhere to a management security standard (such as ISO/IEC 17799) to build and manage the necessary
security processes and practices.

(1) OJ L 93, 26.4.1995.
(2) COM(2001) 298 final.
(3) ETSI SR 002 298.

(2004/C 84 E/0863)

WRITTEN QUESTION E-0267/04

by Juan Ferrández Lezaun (Verts/ALE) to the Commission

(4 February 2004)

Subject: Projects offering alternatives to the Spanish National Hydrological Plan (SNHP)

In November 2001 the Spanish ministries for science and technology, agriculture and the environment
signed a protocol for studying and financing a project for desalination in Almeria as a possible way of
remedying the water shortage in that region. In 2001 CIRCE (centre for research on energy resources and
consumption) also drew up another report for the Ministry for the Environment.

The research findings support the desalination option and conclude that desalination plants, as well as
offering optimum energy yield by using new technologies, would make it possible to supply 82 cubic
hectometres per year at a price of EUR 0,30 per cubic metre in Almeria, whereas 90 cubic hectometres
per year are supposed to be delivered under the National Hydrological Plan. The area’s water needs could
thus be covered with less impact on the environment and the water would cost less than the water
diverted under the SNHP (EUR 0,34 per cubic metre).

Does the Commission know about these reports? If not, does it not consider that the SNHP project and its
funding should be suspended until existing alternative projects have been assessed, such as those submitted
by the government of Aragón or the aforementioned desalination plants, which have a lesser social,
economic and environmental impact?