Securing Private Communications LE K E NP RA A T JE
|
|
|
- Cody Collins
- 10 years ago
- Views:
Transcription
1 Securing Private Communications LE K E NP RA A T JE Protecting Private Communications Security in E.U. Law: Fundamental Rights, Functional Value Chains and Market Incentives 25 November 2015, Lekenpraatje Ph.D. Thesis Defense, University of Amsterdam
2
3
4 Dutch government: stop using the internet work with letters and bank cheques, just like me!
5 We Must Do Something. This Is Something. Therefore, We Must Do It
6 cloud computing & Patriot Act
7 Reaction Dutch government: NSA will respect Dutch patient privacy!
8 Reaction Amazon: Fearmongers!
9
10 General Research Question Thesis: How should the EU lawmaker protect private communications security?
11 OUTLINE Communications security Why communications security fails Systemic flaws in E.U. communications law Recommendations
12 OUTLINE Communications security Why communications security fails Systemic flaws in E.U. communications law Recommendations
13 Communications Security... Protects: Confidentiality Integrity Availability of information transmitted through networks/systems
14 has been around for a while
15
16 1989: HTTP p2p: files SMTP: mail IP = Foundation 'network' society
17 domestication: digital technology is our BFF
18 IP great for availability, but: communications... confidentiality?... integrity?
19 OUTLINE Communications security Why communications security fails Systemic flaws in E.U. communications law Recommendations
20 Failure classes: Technology Users Markets Surveillance
21 Failure classes: Technology Users Markets Surveillance
22 Snowden Disclosure: TEMPORA Bulk intercepts Submarine cables
23 HTTPS: Snowden disclosure MUSCULAR
24 article: Loopholes to Circumvent the Constitution in both law and technology
25 Last Week!
26 If you secure one part of communications network, Breaches move to the next part of the network. Ergo: Law should secure the entire communications value chain
27 Failure classes: Technology Users Markets Surveillance
28 icloud Fail! Lesson 1: protect against brute force password guessing hack
29 Why? market failure by user lock-in Not Apple, but users feel the pain of hack
30
31 Known for long HTTPS: deep security flaws Many CAs hacks All kept silent All CAs are a weakest link!
32 Across communications security: Highly concentrated security markets HTTPS market 3 CAs sell 75% certs 5 CAs sell 90% certs For top 1k, top 100k and top 1m domains Across web, similar market dynamics
33
34 Market failures across security markets: Information asymmetries Negative externalities User lock in
35 OUTLINE Communications security Why communications security fails Systemic flaws in E.U. communications law Recommendations
36 Historical analysis: 25 years of EU communications law
37 Current laws have old legacies: fx. Breaking state monopolies Not 'scoped' to same functionality regulated
38 HTTPS communications: Only CAs (weakly) regulated
39 Not exactly securing the entire communications value chain EU law offers a patchwork of protection
40 Intensely successful lobbying Some gems of the mid 90s
41 8 april 2014, E.U. Court Data Retention Directive Void
42 Landmark ruling: Human Right to Communications / Data Security 1. Para. 66 on c.i.a.-triad: no sufficient safeguards to ensure full confidentiality and integrity : Quantity Data Sensitivity Data Risk of Abuse 1. 67: Wrongly permits economic considerations for IT-security
43 A Constitutional First Line of Defense
44 OUTLINE Communications security Why communications security fails Systemic flaws in E.U. communications law Recommendations
45 Research Question: How should the EU lawmaker protect private communications security?
46 5 general recommendations: The EU lawmaker should: Implement human rights obligations Resist regulatory capture by national security Definition: ensure all elements of the c.i.a.-triad Scope: technology-neutral along entire communications value chain 5. Intervene in persistent market failures BONUS! Use analytical model developed in case studies :)
47 reform inevitable on long term
48 Or else. work with letters and bank cheques, just like Mr. Donner!
49 Securing Private Communications LE K E NP RA A T JE Protecting Private Communications Security in E.U. Law: Fundamental Rights, Functional Value Chains and Market Incentives 25 November 2015, Lekenpraatje Ph.D. Thesis Defense, University of Amsterdam
50 Thesis, papers, presentations:
Any Colour You Like The History (and Future?) of Communications Security Policy
Any Colour You Like The History (and Future?) of Communications Security Policy NYU Security Seminar, New York 22.04.14 https://www.axelarnbak.nl 2013/14 Fellow Berkman Center & CITP, IviR University of
Acquia Comments on EU Recommendations for Data Processing in the Cloud
Acquia Comments on EU Recommendations for Data Processing in the Cloud Executive Summary On July 1, 2012, European Union (EU) data protection regulators provided guidelines for service providers processing
INFORMATION TECHNOLOGY Policy 8400 (Regulation 8400) Data Security
INFORMATION TECHNOLOGY Policy 8400 (Regulation 8400) Data Security State Fair Community College shall provide a central administrative system for use in data collection and extraction. Any system user
St. Peter s C.E. Primary School Farnworth Email, Internet Security and Facsimile Policy
Learn, sparkle & shine St. Peter s C.E. Primary School Farnworth Email, Internet Security and Facsimile Policy Adopted from the LA Policy April 2015 CONTENTS Page No 1. Introduction 1 2. Guiding Principles
Selecting a Law Firm Cloud Provider: Questions to Ask and Ethical/Security Concerns
Selecting a Law Firm Cloud Provider: Questions to Ask and Ethical/Security Concerns by Sharon D. Nelson, Esq. and John W. Simek 2013 Sensei Enterprises, Inc. It seems like everybody is talking about the
Government Surveillance, Hacking, and Network Security: What Can and Should Carriers Do? Kent Bressie PITA AGM, Tonga April 2015
Government Surveillance, Hacking, and Network Security: What Can and Should Carriers Do? Kent Bressie PITA AGM, Tonga April 2015 1 Network and cybersecurity vs. access Fundamental tension exists between:
Network and Information Security Legislation in the EU
Network and Information Security Legislation in the EU Dr. Marnix Dekker Security expert, Information security officer ENISA @RSA Europe, SPER-R07 Security perspectives Amsterdam, October 31, 2013 www.enisa.europa.eu
Summary of the Dutch Data Protection Authority s guidelines for the Data Breach Notification Act
Summary of the Dutch Data Protection Authority s guidelines for the Data Breach Notification Act On 1 January 2016, the Dutch Data Breach Notification Act will enter into force. The Dutch DPA issued Guidelines
Advanced Eye Care & Optical 499 E Winchester Blvd., Suite 101 Collierville, TN 38017 Phone: 901-850-2366 Fax: 901-850-2367
NOTICE OF PRIVACY PRACTICES THIS NOTICE OF PRIVACY PRACTICES ( NOTICE ) DESCRIBES HOW WE MAY USE OR DISCLOSE YOUR HEALTH INFORMATION AND HOW YOU CAN ACCESS TO SUCH INFORMATION. PLEASE READ IT CAREFULLY.
Iowa Student Loan Online Privacy Statement
Iowa Student Loan Online Privacy Statement Revision date: Jan.6, 2014 Iowa Student Loan Liquidity Corporation ("Iowa Student Loan") understands that you are concerned about the privacy and security of
ClickTale Security Standards and Practices: Delivering Peace of Mind in Digital Optimization
Delivering Peace of Mind in Digital Optimization TABLE OF CONTENTS INTRODUCTION 2 PRIVACY AND ANONYMITY 3 ISO 27001 COMPLIANCE 5 APPLICATION-LEVEL SECURITY 6 PENETRATION TESTING AND SECURITY AUDITS 7 GENERAL
Great ideas, big data and little privacy? Bart Preneel iminds and COSIC KU Leuven
Great ideas, big data and little privacy? Bart Preneel iminds and COSIC KU Leuven 2 3 NSA calls the iphone users public 'zombies' who pay for their own surveillance 4 Snowden revelations NSA: Collect it
10 Hidden IT Risks That Might Threaten Your Business
(Plus 1 Fast Way to Find Them) Your business depends on intelligence. But can you count on your technology? You may not be in the intelligence technology business, but it s probably impossible to imagine
Cyber-Security. FAS Annual Conference September 12, 2014
Cyber-Security FAS Annual Conference September 12, 2014 Maysar Al-Samadi Vice President, Professional Standards IIROC Cyber-Security IIROC Rule 17.16 BCP The regulatory landscape Canadian Government policy
Data Protection Policy
Data Protection Policy Responsible Officer Author Date effective from July 2009 Ben Bennett, Business Planning & Resources Director Julian Lewis, Governance Manager Date last amended December 2012 Review
12 Security Camera System Best Practices - Cyber Safe
12 Security Camera System Best Practices - Cyber Safe Dean Drako, President and CEO, Eagle Eye Networks Website version of white paper Dean Drako video introduction for cyber security white paper Introduction
On-Line Privacy Statement
On-Line Privacy Statement Custom House Financial (UK) Limited Western Union International Bank GmbH, French Branch Effective Date: 1 Mars 2016 In France, services are provided by Custom House Financial
Big Data, Big Risk, Big Rewards. Hussein Syed
Big Data, Big Risk, Big Rewards Hussein Syed Discussion Topics Information Security in healthcare Cyber Security Big Data Security Security and Privacy concerns Security and Privacy Governance Big Data
Committee on Civil Liberties, Justice and Home Affairs - The Secretariat - Background Note on
Committee on Civil Liberties, Justice and Home Affairs - The Secretariat - Background Note on US Legal Instruments for Access and Electronic Surveillance of EU Citizens Introduction This note presents
3Degrees Group, Inc. Privacy Policy
3Degrees Group, Inc. Privacy Policy Your privacy is important to 3Degrees Group, Inc. ( 3Degrees ). The following Privacy Policy discloses the information practices followed by 3Degrees with respect to
10 Hidden IT Risks That Might Threaten Your Law Firm
(Plus 1 Fast Way to Find Them) Your law firm depends on intelligence. But can you count on your technology? You may not be in the intelligence technology business, but it s probably impossible to imagine
DESTINATION MELBOURNE PRIVACY POLICY
DESTINATION MELBOURNE PRIVACY POLICY 2 Destination Melbourne Privacy Policy Statement Regarding Privacy Policy Destination Melbourne Limited recognises the importance of protecting the privacy of personally
Security and Control of Data in the Cloud with BitTitan Data Encryption
Security and Control of Data in the Cloud with BitTitan Data Encryption Contents Ownership and Control of Data in the Cloud... 3 Unstructured Sensitive Information in Email/Calendars... 3 How Can Email
INFORMATION SECURITY GUIDE. Cloud Computing Outsourcing. Information Security Unit. Information Technology Services (ITS) July 2013
INFORMATION SECURITY GUIDE Cloud Computing Outsourcing Information Security Unit Information Technology Services (ITS) July 2013 CONTENTS 1. Background...2 2. Legislative and Policy Requirements...3 3.
Presented by Evan Sylvester, CISSP
Presented by Evan Sylvester, CISSP Who Am I? Evan Sylvester FAST Information Security Officer MBA, Texas State University BBA in Management Information Systems at the University of Texas Certified Information
UAB MY HEALTH REWARDS BIOMETRIC SCREENING PROGRAM NOTICE OF HEALTH INFORMATION PRACTICES
UAB MY HEALTH REWARDS BIOMETRIC SCREENING PROGRAM NOTICE OF HEALTH INFORMATION PRACTICES 1 Effective Date: January 26, 2015 THIS NOTICE APPLIES TO THE UAB MY HEALTH REWARDS BIOMETRIC SCREENING PROGRAM
Software as a Service (SaaS) Requirements
Introduction Software as a Service (SaaS) Requirements Software as a Service (SaaS) is a software service model where an application is hosted as a service provided to customers across the Internet. By
Chapter 6: Fundamental Cloud Security
Chapter 6: Fundamental Cloud Security Nora Almezeini MIS Department, CBA, KSU From Cloud Computing by Thomas Erl, Zaigham Mahmood, and Ricardo Puttini(ISBN: 0133387526) Copyright 2013 Arcitura Education,
Maximum Global Business Online Privacy Statement
Maximum Global Business Online Privacy Statement Last Updated: June 24, 2008. Maximum Global Business is committed to protecting your privacy. Please read the Maximum Global Business Online Privacy Statement
The potential legal consequences of a personal data breach
The potential legal consequences of a personal data breach Tue Goldschmieding, Partner 16 April 2015 The potential legal consequences of a personal data breach 15 April 2015 Contents 1. Definitions 2.
Bodywhys Privacy Policy
Bodywhys Privacy Policy Website Bodywhys respects the privacy of all visitors to our website. This website privacy statement outlines our policy concerning the use and collection of personal information
ELECTRONIC COMMUNICATION & INFORMATION SYSTEMS POLICY
ELECTRONIC COMMUNICATION & INFORMATION SYSTEMS POLICY I. ELECTRONIC COMMUNICATION A. PURPOSE To better serve our citizens and give our workforce the best tools to do their jobs, the Common Council of the
ESTRO PRIVACY AND DATA SECURITY NOTICE
ESTRO PRIVACY AND DATA SECURITY NOTICE This Data Privacy and Security Policy is a dynamic document, which will reflect our continuing vigilance to properly handle and secure information that we are trusted
HIPAA Privacy and Security
HIPAA Privacy and Security Course ID: 1020 - Credit Hours: 2 Author(s) Kevin Arnold, RN, BSN Accreditation KLA Education Services LLC is accredited by the State of California Board of Registered Nursing,
We will not collect, use or disclose your personal information without your consent, except where required or permitted by law.
HSBC Privacy Notice HSBC's Privacy Principles HSBC Bank Canada is a subsidiary of HSBC Holdings plc which, together with its subsidiaries and affiliates, is one of the world s largest banking and financial
Legal and Ethical Issues in Computer Security
Legal and Ethical Issues in Computer Security Prepared By: Rusul M. Kanona Supervised By: Dr. Lo a i A.Tawalbeh Arab Academy for Banking & Financial Sciences (AABFS) Fall 2007 :Objectives for this session
Birkam Health Center Ferris State University NOTICE OF PRIVACY PRACTICES
Birkam Health Center Ferris State University NOTICE OF PRIVACY PRACTICES Effective Date of Notice: October 1, 2013 THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND
SSL and Browsers: The Pillars of Broken Security
SSL and Browsers: The Pillars of Broken Security Ivan Ristic Wolfgang Kandek Qualys, Inc. Session ID: TECH-403 Session Classification: Intermediate SSL, TLS, And PKI SSL (or TLS, if you prefer) is the
Legal Issues Associated with Cloud Computing. Laurin H. Mills May 13, 2009
Legal Issues Associated with Cloud Computing Laurin H. Mills May 13, 2009 What Is Cloud Computing? The cloud is a metaphor for the Internet Leverages the connectivity of the Internet to optimize the utility
WEBSITE PRIVACY POLICY. Last modified 10/20/11
WEBSITE PRIVACY POLICY Last modified 10/20/11 1. Introduction 1.1 Questions. This website is owned and operated by. If you have any questions or concerns about our Privacy Policy, feel free to email us
Privacy and data protection in a post-snowden world. Carly Nyst Head of International Advocacy
Privacy and data protection in a post-snowden world Carly Nyst Head of International Advocacy The great irony is that we re the only ones not spying on the American people. - Keith Alexander, head of the
CMPT 471 Networking II
CMPT 471 Networking II Firewalls Janice Regan, 2006-2013 1 Security When is a computer secure When the data and software on the computer are available on demand only to those people who should have access
Patriot Act Impact on Canadian Organizations Using Cloud Services
Patriot Act Impact on Canadian Organizations Using Cloud Services November 8, 2013 By Scott Wright The Streetwise Security Coach http://www.securityperspectives.com 1 PRESENTATION TITLE Why do nation-states
FKCC AUP/LOCAL AUTHORITY
FKCC AUP/LOCAL AUTHORITY The information contained in this section has its basis in Public Law 93.380. It is further enhanced however, by Florida State Board of Education Administrative Rule 6A-14.51 and
N-CAP Users Guide Everything You Need to Know About Using the Internet! How Electronic Payment Works
N-CAP Users Guide Everything You Need to Know About Using the Internet! How Electronic Payment Works How Electronic Payment Works By Jennifer Hord When it comes to payment options, nothing is more convenient
ONLINE PRIVACY POLICY
ONLINE PRIVACY POLICY The City of New Westminster is committed to protecting your privacy. Any personal information collected, used or disclosed by the City is in accordance with the Freedom of Information
Cyber Warfare. Global Economic Crime Survey. Causes of Cyber Attacks. David Childers, CEO Compli Vivek Krishnamurthy, Foley Hoag LLP. Why Cybercrime?
Cyber Warfare David Childers, CEO Compli Vivek Krishnamurthy, Foley Hoag LLP Global Economic Crime Survey Cyber crime is the fastest growing economic crime up more than 2300% since 2009 1 in 10 companies
The Risks of Cloud Storage
The Risks of Cloud Storage MyWorkDrive.com The Risks of Cloud Storage For all of the benefits cloud storage options provides, we cannot ignore the potential risks of public cloud computing. Even though
Delivering peace of mind in digital optimization: Clicktale's security standards and practices
THE CLICKTALE DIFFERENCE Delivering peace of mind in digital optimization: Clicktale's security standards and practices CONTENTS INTRODUCTION... 2 PRIVACY AND ANONYMITY...2 ISO 27001 COMPLIANCE...4 APPLICATION-LEVEL
Green Pharm is committed to your privacy. We disclose our information practices below and we agree to notify you of:
Privacy Policy is committed to your privacy. We disclose our information practices below and we agree to notify you of: 1. What personally identifiable information of yours or third party personally identification
Securely Yours LLC IT Hot Topics. Sajay Rai, CPA, CISSP, CISM [email protected]
Securely Yours LLC IT Hot Topics Sajay Rai, CPA, CISSP, CISM [email protected] Contents Background Top Security Topics What auditors must know? What auditors must do? Next Steps [Image Info]
LAWYERING IN THE CLOUD CRIB NOTES 2012 Charles F. Luce, Jr. coloradolegalethics.com/ (alpha release)
CHARLES LUCE S LAWYERING IN THE CLOUD CRIB NOTES 2012 Charles F. Luce, Jr. coloradolegalethics.com/ (alpha release) A. Cloud Computing Defined: n. A loosely defined term for any system providing access
Information Management and Security Policy
Unclassified Policy BG-Policy-03 Contents 1.0 BG Group Policy 3 2.0 Policy rationale 3 3.0 Applicability 3 4.0 Policy implementation 4 Document and version control Version Author Issue date Revision detail
IT Best Practices Audit TCS offers a wide range of IT Best Practices Audit content covering 15 subjects and over 2200 topics, including:
IT Best Practices Audit TCS offers a wide range of IT Best Practices Audit content covering 15 subjects and over 2200 topics, including: 1. IT Cost Containment 84 topics 2. Cloud Computing Readiness 225
Privacy and Management of Health Information: Standards for CARNA s Regulated Members
Privacy and Management of Health Information: Standards for CARNA s Regulated Members September 2011 Permission to reproduce this document is granted; please recognize CARNA. College and Association of
Please read this Policy carefully. Your continued use of our sites means that you understand and consent to the terms of this Policy.
EFFECTIVE: February 2016 Version 1.2 CHECK 'N GO PRIVACY POLICY This Privacy Policy ("Policy") applies to the use of Check 'n Go (the "Company") online sites and any Company affiliate or subsidiary sites.
Privacy Policy. PortfolioTrax, LLC. 2015 v1.0. PortfolioTrax, LLC Privacy Policy 2
Privacy Policy 2015 v1.0 Privacy Policy 2 Document Controls and Review This document is to be reviewed once every two quarters and updated to account for any changes in privacy practices that may not have
Jeff M. Bauman, Psy.D. P.A. and Associates FLORIDA-HIPAA PRIVACY NOTICE FORM
Jeff M. Bauman, Psy.D. P.A. and Associates FLORIDA-HIPAA PRIVACY NOTICE FORM Notice of Psychologists Policies and Practices to Protect the Privacy of Your Health Information THIS NOTICE DESCRIBES HOW PSYCHOLOGICAL
CLOUD COMPUTING Contractual and data protection aspects
CLOUD COMPUTING Contractual and data protection aspects Cloudscape VI 25 February 2014, Bruxelles Paolo Balboni Ph.D., Founding Partner, ICT Legal Consulting Domenico Converso LL.M., Senior Associate,
NSA Surveillance, National Security and Privacy
NSA Surveillance, National Security and Privacy Ir Roy Ko Former HKCERT Manager 20 August 2014 HKIE Veneree Club 1 Agenda Background Edward Snowden National Security Agency (NSA) What NSA has done PRISM
Adaptive Business Management Systems Privacy Policy
Adaptive Business Management Systems Privacy Policy Updated policy: Effective on July 01, 2013 This privacy statement describes how Adaptive Business Management Systems collects and uses the personal information
Introduction to Computer Security
Introduction to Computer Security Rev. Sept 2015 What is Computer Security? 2 Computer Security is the protection of computing systems and the data that they store or access 3 Why is Computer Security
Sibford School Student Computer Acceptable Use Policy
Introduction Sibford School Student Computer Acceptable Use Policy The use of the latest technology is actively encouraged at Sibford School but with this comes a responsibility to protect both students
Management and Storage of Sensitive Information UH Information Security Team (InfoSec)
Management and Storage of Sensitive Information UH Information Security Team (InfoSec) Who Are We? UH Information Security Team Jodi Ito - Information Security Officer Deanna Pasternak & Taylor Summers
Understanding HIPAA Privacy and Security Helping Your Practice Select a HIPAA- Compliant IT Provider A White Paper by CMIT Solutions
Understanding HIPAA Privacy and Security Helping Your Practice Select a HIPAA- Compliant IT Provider A White Paper by CMIT Solutions Table of Contents Understanding HIPAA Privacy and Security... 1 What
Privacy in the cloud. DNB has indicated that it considers cloud computing a form of outsourcing.
Privacy in the cloud computing, and the company concerned is required to submit a risk analysis to DNB. 3 Cloud computing entails the saving, processing and using of company data on the servers of a cloud
2. What personal information do we collect and hold?
PRIVACY POLICY Conexus Financial Pty Ltd [ABN 51 120 292 257], (referred to as Conexus, us, we" or our"), are committed to protecting the privacy of the personal information that we collect and complying
TODAY S AGENDA. Trends/Victimology. Incident Response. Remediation. Disclosures
TODAY S AGENDA Trends/Victimology Incident Response Remediation Disclosures Trends/Victimology ADVERSARY CLASSIFICATIONS SOCIAL ENGINEERING DATA SOURCES COVERT INDICATORS - METADATA METADATA data providing
HIPAA Privacy & Security White Paper
HIPAA Privacy & Security White Paper Sabrina Patel, JD +1.718.683.6577 [email protected] Compliance TABLE OF CONTENTS Overview 2 Security Frameworks & Standards 3 Key Security & Privacy Elements
Wrapping Audit Arms around the Cloud Georgia 2013 Conference for College and University Auditors
1 Wrapping Audit Arms around the Cloud Georgia 2013 Conference for College and University Auditors Scott Woodison Executive Director, Compliance and Enterprise Risk Office of Internal Audit and Compliance
Presentation for : The New England Board of Higher Education. Hot Topics in IT Security and Data Privacy
Presentation for : The New England Board of Higher Education Hot Topics in IT Security and Data Privacy October 22, 2010 Rocco Grillo, CISSP Managing Director Protiviti Inc. Quote of the Day "It takes