Source: EURLEX
Language: en
Format: md

No C 277/18 Official Journal of the European Communities 5. 11. 90

Proposal for a Council Decision in the field of information security

_COM(90) 314 final_

_(Submitted by the Commission on 27 July 1990)_

(90/C 277/05)

THE COUNCIL OF THE EUROPEAN COMMUNITIES,

Having regard to the Treaty establishing the European
Economic Community, and in particular Article 235
thereof,

Having regard to the proposal from the Commission,

Having regard to the opinion of the European Parliament,

Having regard to the opinion of the Economic and Social
Committee,

Whereas the Community has as its task, by establishing a
common market and progressively approximating the
economic policies of the Member States, to promote
throughout the Community a harmonious development of
economic activity, a continued and balanced expansion,
increased stability, accelerated raising of the standard of
living, and closer relations of the States belonging to it;

Whereas the information stored, processed and transmitted
electronically plays an increasingly important role in social
and economic activities;

Whereas the advent of efficient global communication and
the pervasive use of electronic handling of information
emphasizes the need for adequate protection;

Whereas the European Parliament has repeatedly stressed
the importance of information security in its deliberations
and decisions;

Whereas the Economic and Social Committee has emphasized the need to address information security related issues
in Community actions, particularly in view of the impact of
the completion of the internal market;

Whereas it is necessary to develop a global strategy for
information security in order to ensure the security of the
user on the Community level and avoid the creation of new
technical obstacles to communication;

Whereas the inherent complexity of information security
issues calls for subsidiarity, the active involvement of
several sectors and the concerted use of several policies;

Whereas actions on national, international and Community level provide a good basis;

Whereas there is a close link between telecommunications,
standardization, information market and RD&T policies

and the work already undertaken in these domains by the
European Community;

Whereas it is appropriate to assure the concertation of
efforts, by building on existing national and international
work and by promoting the cooperation of the principal
protagonists concerned; whereas it is therefore appropriate
to proceed within the framework of a coherent action plan;

Whereas the responsibility of the Member States in this
domain implies a concerted approach based on a close
collaboration with senior officials of the Member States,

HAS DECIDED AS FOLLOWS:

_Article 1_

1. An action plan in the field of information security
(Infosec) is adopted for a period of 24 months starting on

[...].

2. The action plan is designed to develop a global strategy
providing the users of electronically stored, processed or
transmitted information with protection of information
systems against accidental or deliberate threats.

3. The action will take into account and support the
evolving European and world-wide standardization activities in the field.

_Article 2_

The action plan, the details of which are set out in the
Annex hereto shall comprise the following lines of action :

I. Development of an information security strategy
framework.

II. Analysis of information security requirements.

III. Solutions for immediate and interim needs.

IV. Specifications, standardization and verification of
information security.

V. Integration of technological and operational developments for information security within a general
strategy.

VI. Integration of certain security functions in information

systems.

5. 11. 90 Official Journal of the European Communities No C 277/19

_Article 3_

The action plan shall be implemented by the Commission
in collaboration with the organizations and enterprises
concerned and in close association with the Member States.

_Article 4_

The amount attributed to this action shall be determined in

the course of the annual budgetary procedure.

_Article 5_

The Commission shall send to the European Parliament
and the Council a report on the results of the action within
three months of its completion.

_Article 6_

For the implementation of the action plan, the Commission
shall consult, as necessary, a Senior Officials Group on
Information Security (Sogis). This group shall consist of
two representatives of each Member State and of the
Commission. A Commission representative shall be in the
chair.

The members of the group may be assisted by experts or
advisers depending on the nature of the issues under
consideration.

The proceedings of the group shall be confidential. The
group shall adopt its own rules of procedure. The
secretariat shall be provided by the Commission.

_ANNEX_

SUMMARY OF ACTION LINES

1. Action line I — Development of an information security strategy framework

1.1. _Issue_

1.1.1. Information security is recognized as a pervasive quality necessary in modern society. Electronic
information services need a secure telecommunication infrastructure, secure terminals (including
processors and data bases) as well as secure usage. An overall strategy, considering all aspects of
information security, needs to be established, avoiding a fragmented approach. Any strategy for the
security of information processed in an electronic form must reflect the wish of any society to operate
effectively yet protect itself in a rapidly changing world.

1.2. _Objective_

1.2.2. A strategically oriented framework has to be established to reconcile social, economic and political
objectives with technical, operational and legislative options. The sensitive balance between different
concerns, objectives and constraints has to be found by sector actors working together in the
development of a common perception and agreed strategy. These are the prerequisites for reconciling
interests and needs both in policy making and in industrial developments.

1.3. _Status and trends_

1.3.3. The situation is characterized by growing awareness of the need to act. However, in the absence of an
initiative to concert the efforts it seems very likely that dispersed efforts in various sectors will be taken
which create _de facto_ a situation which will be contradictory, creating progressively more serious legal,
social and economic problems.

1.4. _Requirements, options and priorities_

1.4.4. Such a shared framework would need to address and situate risk analysis and risk management
concerning the vulnerabilities of information and related services, the alignment of laws and
regulations associated with computer telecommunications abuse and misuse, administrative
infrastructures including security policies and how these may be effectively implemented by various

No C 277/20 Official Journal of the European Communities 5. 11. 90

industries/disciplines, and social and privacy concerns (e.g. the application of identification,
authentication and possibly authorization schemes in a democratic environment).

1.4.5. Clear guidance is to be provided for the development of physical and logical architectures for secure
distributed information services, standards, guide-lines and definitions for assured security products
and services, pilots and prototypes to establish the viability of various administrative structures,
architectures and standards related to the needs of specific sectors.

1.4.6. Security awareness must be created in order to influence the attitude of the users towards an increased
concern about security in IT and telecommunication systems.

2. Action line II — Information security requirements

2.1. _Issue_

_1.1.1._ Information security is the inherent prerequisite for the protection of privacy, intellectual property,
commercial confidentiality and national security. This leads inevitably to a difficult balance and
sometimes choices, between a commitment to free trade and a commitment to securing privacy and
intellectual property. These choices and compromises need to be based on a full appreciation of
requirements and the impact of possible information security options to respond to them.

2.1.8. User requirements imply information security functionalities interdependent with technological,
operational and regulatory aspects. Therefore, a systematic investigation of information security
requirements forms an essential part of the development of appropriate and effective measures.

2.2. _Objective_

_2.2.9._ Establishing the nature and characteristics of user requirements and their relation to information
security measures.

2.3. _Status and trends_

2.3.10. Up to now, no concerted effort has been undertaken to identify the rapidly evolving and changing
requirements of the major actors for information security. Community Member States have identified
the requirements for harmonization of national activities (especially of the 'IT security criteria').
Uniform evaluation criteria and rules for mutual recognition of evaluation results/certificates are of
major importance.

2.4. _Requirements, options and priorities_

2.4.11. As a basis for a consistent and transparent treatment of the justified needs of the sector actors it is
considered necessary to develop an agreed classification of user requirements and its relation to
information security provision.

2.4.12. It is also considered important to identify requirements for legislation, regulations and codes of practice
in the light of an assessment of trends in service characteristics and technology, to identify alternative
strategies for meeting the objectives by administrative, service, operational and technical provisions,
and to assess the effectiveness, user-friendliness and costs of alternative information security option
and strategies for users, service providers and operators.

3. Action line HI — Solutions for immediate and interim needs

3.1. _Issue_

3.1.13. At present it is possible to protect adequately computers from unauthorized access from the outside
world by 'isolation' i.e. by applying conventional organizational and physical measures. This applies
also to electronic communications within a closed user group operating on a dedicated network. The

5. 11. 90 Official Journal of the European Communities N o C 277/21

situation is very different if the information is shared between user groups or exchanged via a public, or
generally accessible, network. Neither the technology, terminals and services nor the related standards
and procedures are generally available to provide comparable information security in these cases.

3.2. _Objective_

3.2.14. The objective has to be to provide, at short notice, solutions which can respond to the most urgent
needs of users. These should be conceived as open towards future requirements and solutions.

3.3. _Status and trends_

3.3.15. Some user groups have developed techniques and procedures for their specific use responding, in
particular, to the need for authentication, integrity, and non-repudiation. In general magnetic cards or
smart cards are being used. Some are using more or less sophisticated cryptographic techniques. Often
this implied the definition of user-group specific 'authorities'. However, it is difficult to generalize these
techniques and methods to meet the needs of an open environment.

3.3.16. ISO is working on OSI information security (ISO DIS 7498-2) and CCITT in the context of X400. It is
also possible to insert information security segments into the messages. Authentication, integrity and
non-repudiation are being addressed as part of the messages (Edifact) as well as part of the X400 MHS.

3.3.17. Presently, the EDI legal framework is still at the stage of conception. The International Chamber of
Commerce has published uniform rules of conduct for the exchange of commercial data via
telecommunications networks.

3.3.18. Several countries (e.g. Germany, France, the United Kingdom and the USA) have developed or are
developing criteria to evaluate the trustworthiness of IT and telecommunication products and systems
and the corresponding procedures for conducting evaluations. These criteria have been coordinated
with the national manufacturers and will lead to an increasing number of trusted products and systems
starting with simple products. The establishment of national organizations who will conduct
evaluations and offer certificates will support this trend.

3.3.19. Confidentiality provision is considered by most users as less immediately important. In the future,
however, this situation is likely to change as advanced communication services and in particular mobile
services will have become all pervasive.

3.4. _Requirements, options and priorities_

3.4.20. It is essential to develop as soon as possible the procedures, standards, products, and tools suited to
assure information security on public communications networks. A high priority should be given to
authentication, integrity and non-repudiation. Pilot projects should be carried out to establish the
validity of the proposed solutions. Solutions to priority needs on EDI are looked at in the Tedis
programme within the more general content of this action plan.

4. Action line IV — Specification, standardization and verification for information security

4.1. _Issue_

4.1.21. Information security requirements are pervasive and as such common specifications and standards are
crucial. The absence of agreed standards and specifications may present a major barrier to the advance
of information-based processes and services throughout the economy and society. Actions are required
to accelerate the development and use of technology and standards in several related communication
and computer network areas that are of critical importance to users, industry and administrations.

No C 277/22 Official Journal of the European Communities 5. 11. 90

4.2. _Objective_

4.2.22. Efforts are required to provide a means of supporting and performing specific functions in the general
areas of OSI, ONP, ISDN/IBC, network management and network security for unclassified, but
sensitive, information. Inherently related to standardization and specification are the techniques and
approaches required for verification.

4.3. _Status and trends_

4.3.23. The USA, in particular, have taken major initiatives to address information security in the non-defence
domain. In Europe the subject is treated in the context of IT and telecommunications standardization in
the context of ETSI and CEN/Cenelec in preparation of CCITT and ISO work in the domain.

4.3.24. In view of growing concern, the work in the USA is rapidly intensifying and both vendors and service
provider are increasing their efforts in this domain. In Europe, France, Germany and the United
Kingdom have independently started similar activities but a common effort corresponding to the USA is
only evolving slowly.

4.4. _Requirements, options and priorities_

4.4.25. In information security there is inherently a very close relationship between regulatory, operational,
administrative and technical aspects. Regulations need to be reflected in standards and information
security provisions need to comply in a verifiable manner to the standards and regulations. In several
aspects regulations require specifications which go beyond the conventional scope of standardization,
i.e. include codes of practice. Requirements for standards and codes of practice are present in all areas
of information security, and a distinction has to be made between the protection requirements which
correspond to the security objectives and some of the technical requirements which can be entrusted to
the competent European standard bodies (CEN/Cenelec/ETSI).

4.4.26. Specifications and standards must cover the subjects of information security services (personal and
enterprise authentication, non-repudiation protocols, legally acceptable electronic proof, authorization control), communication services (image communication privacy, mobile communications
voice and data privacy, data and image data-base protection, integrated services security),
communication and security management (public/private key system for open network operation,
network management protection, service provider protection) and certification (information security
assurance criteria and levels, security assurance procedures).

5. Action line V — Technological and operational developments for information security

5.1. _Issue_

5.1.27. Systematic investigation and development of the technology to permit economically viable and
operationally satisfactory solutions to a range of present and future information security requirements
is a prerequisite to the development of the services market and the competitiveness of the European
economy as a whole.

5.1.28. Any technological developments in information systems security will have to include both the aspects
of computer security and security of communications as most present-day systems are distributed
systems, and access to such systems is through communications services.

5.2. _Objective_

5.2.29. Systematic investigation and development of the technology to permit economically viable and
operationally satisfactory solutions to a range of present and future information security requirements.

5.3. _Requirements,_ _options and priorities_

5.3.30. Work on information security would need to address development and implementation strategies,
technologies, and integration and verification.

5. 11. 90 Official Journal of the European Communities N o C 277/23

5.3.31. The strategic R & D work would have to cover conceptual models for secure systems (secure against
compromise), functional requirements models, risk models, and architectures for security.

5.3.32. The technology orientated R & D work would have to include user and message authentication (e.g.
through voice analysis and electronic signatures), technical interfaces and protocols for encryption,
access control mechanisms, and implementation methods for provable secure systems.

5.3.33. Verification and validation of technical system security and its applicability would be investigated
through integration and verification projects.

5.3.34. In addition to consolidation and development of security technology, a number of accompanying
measures are required concerned with the creation, maintenance and consistent application of
standards, and the validation and certification of IT and telecommunication products with respect to
their security properties, including validation and certification of methods to design and implement
systems.

5.3.35. The third RDT Community framework programme might be used to foster cooperative projects at precompetitive and pre-normative levels.

6. Action line VI — Information security provisions

6.1. _Issue_

6.1.36. Depending on the exact nature of the information security features required functions will need to be
incorporated at different parts of the communication systems including terminals/computers, services,
network management to cryptographic devices, smart cards, public and private keys, etc. Some of these
can be expected to be embedded in the hardware or software provided by vendors while others may be
part of distributed systems (e.g. network management), in the possession of the individual user (e.g.
smart cards) or provided from a specialized organization (e.g. public/private keys).

6.1.37. Most of the information security products and services can be expected to be provided by vendors,
service providers or operators. For specific functions, e.g. the provision of public/private keys,
auditing, authorization, there may be the need to identify and mandate appropriate organizations.

6.1.38. The same applies for certification, evaluation and verification of quality of service which are functions
which need to be addressed by organizations independent of the interests of vendors, services providers
or operators. These organizations could be private, governmental, or licensed by government to
perform delegated functions.

6.2. _Objective_

6.2.39. In order to facilitate a harmonious development of the provision of information security in the
Community for the protection of the public and of business interests it will be necessary to develop a
consistent approach as to the provision of information security. Where independent organizations will
have to be mandated, their functions and conditions will need to be defined and agreed and where
required embedded into the regulatory framework. The objective would be to come to a clearly defined
and agreed sharing of responsibilities between the different actors on a Community level as a
prerequisite for mutual recognition.

6.3. _Status and trends_

6.3.40. At present information security provision is well organized only for specific areas and limited to
addressing the specific needs. The organization on a European level is mostly informal and mutual
recognition of verification and certification is not yet established outside closed groups. With the
growing importance of information security the need for defining a consistent approach to information
security provision in Europe and internationally is becoming urgent.

No C 277/24 Official Journal of the European Communities 5. 11. 90

6.4. _Requirements, options and priorities_

6.4.41. Because of the number of different actors concerned and the close relations to regulatory and legislative
questions it is particularly important to pre-agree on the principles which should govern the provision
of information security.

In developing a consistent approach to this question one will need to address the aspects of
identification and specification of functions requiring, by their very nature, the availability of some
independent organization (or interworking organizations). This could include functions such as the
administration of a public/private key system.

In addition, it is required to identify and specify, at an early stage, the functions which in the public
interest need to be entrusted to independent organization (or interworking organizations). This could,
for example include auditing, quality assurance, verification, certification and similar functions.

Proposal for a Council Decision on the conclusion by the European Economic Community of an
Agreement on trade and commercial and economic cooperation between the European Economic

Community and the European Atomic Energy Community and Romania

_SEQ90) 1872 final_

_(Submitted by the Commission to the Council on 8 October 1990)_

(90/C 277/06)

THE COUNCIL OF THE EUROPEAN COMMUNITIES,

Having regard to the Treaty establishing the European
Economic Community, and in particular Articles 113 and
235 thereof,

Having regard to the proposal from the Commission,

Having regard to the opinion of the European Parliament,

Whereas the conclusion by the European Economic
Community of the Agreement on trade and commercial
and economic cooperation between the European Economic Community and the European Atomic Energy
Community and Romania is necessary to achieve the
Community's external relations objectives;

It seems that some of the economic cooperation measures
envisaged in the Agreement exceed the powers of action
provided for in the field of common economic policy,

HAS DECIDED AS FOLLOWS:

_Article 1_

The Agreement on trade and commercial and economic
cooperation between the European Economic Community

and the European Atomic Energy Community and
Romania is hereby approved on behalf of the European
Economic Community.

The text of the Agreement is annexed to this Decision.

_Article 2_

The President of the Council shall give on behalf of the
European Economic Community the notification provided
for in Article 25 of the Agreement ( [1] ).

_Article 3_

The Commission, assisted by representatives of the
Member States, shall represent the Community in the Joint
Committee set up under Article 22 of the Agreement.

(!) The General Secretariat of the Council will publish the date of
entry into force of the Agreement in the _Official Journal_ _of the_
_European Communities._