Work Package Description

Without adequate security systems in place, none of the epSOS services can be used in real-life environments. A security policy is therefore needed to create a secure operational environment for the service deployment. The goal of WP 3.7 is the definition of a security system on the basis of functional service requirements and taking into account the existing level of security implemented in each Member State.

WP 3.7 will select, from different options and on the basis of an option analysis, an appropriate and reliable security system to be integrated into the system architecture.

Each presented option will also include information on the costs of implementation and maintenance compared with the level of security. The proposal will be reported to the Project Steering Board (PSB) for final approval.

Generally, computer security can be characterized as the protection of:

• Confidentiality: information is accessible only to authorized users
• Integrity: accuracy and completeness of information and processing methods
• Availability: authorized users have access to information and associated assets when required
• Accountability/Liability: each communication and each data transaction can be tracked back to a certain originator in a traceable chain of activities.

The epSOS security policy should help to ensure and enforce the above. It should also  provide means of proof and essential checks which give users trust in the information given.

However, these objectives can be further divided and applied to concrete actors, which leads to derived security objectives. The most relevant derived security objectives for the epSOS Large Scale Pilot (LSP) are:

• Entity Authenticity: an actor is who he/she claims to be
• Originator Authenticity: the source of data is as claimed
• Access Control: access to information is restricted to authorised actors/entities
• Non-repudiation of origin: the data Originator cannot deny having the data
• Non-repudiation of delivery: the data Consumer cannot deny having received the data.

Aside from giving technical recommendations, it is also a task of WP 3.7 to set up an epSOS Security Audit Policy. Each National epSOS Portal (NCP) has to pass through this security audit, which has to be conducted yearly to ensure that the provisions of the Security Policy are respected. An epSOS security audit group made up of experts will coordinate the audit procedure and decide if a partner fulfils the epSOS security requirements. The security audit must have been completed by all partners before the start of the epSOS pilot servic