Egyptian Best Practices Securing E-Services

Transcription

1 Egyptian Best Practices Securing E-Services Dr. Sherif Hazem Nour El-Din Information Security Systems Consultant Root CA Manager, ITIDA Agenda Security Measures for E-Services Examples of E- Services Threats Egypt Legalizations Related to E-Services Egypt Procedures to Facilitate E-services Egypt E-Signature Infra-Structure Egypt Computer Emergency Response Team Demos of the Use of Egyptian E-Signature Software and Tools to Secure E-Applications 1

2 Security Measures For E-Services Confidentiality Authentication Data Integrity Non-Repudiation Symmetric Key Encryption Public Key Encryption Techniques Examples of E- Services Threats Confidentiality Attack Bob Sends A Message to John Bob Bob Die John Receives the Message Man In the Middle Attacker reads the message 2

3 Examples of E- Services Threats Authentication and Non-Repudiation Attacks This link is sent the customer to faked web site to harvest logins and personal information. (Phishing ) Examples of E- Services Threats Data Integrity Attack Original Image 1 Tampered Image1 3

4 Examples of E- Services Threats Data Integrity Attack Original Image 1 Tampered Image1 Egypt Legalizations Related to E-Services E-Signature Law Cyber Security and Data Protection Law 4

5 Drafting an Electronic Signature Law National E-Signature Committee (members): Ministry of Communications and Information Technology Ministry of Justice Ministry of Economy and Foreign Trade Ministry of Finance Ministry of Foreign Affairs Ministry of Interior Ministry for Administrative Development Central Bank of Egypt Cabinet Information & Decision Support Center E-Signature Law - In 2004, law no. 15 was officially released to help enforce the e-signature in Egypt and to establish the (Information Technology Industry Development Agency (ITIDA). - The Executive Directive of the E-signature law issued in May The e-signature law establishes legal recognition of electronically (digitally) signed documents and contracts as well as (unsigned) electronic documents - The establishment of ITIDA supports Egypt s e-services industry by securing the Internet as a legally viable medium for online financial activities. 5

6 Continue In 28th, September 2009, Prime Minister Dr. Ahmed Nazif witnessed the launch of E-Signature services for the public and private sectors and the inauguration of the Egyptian Root-CA trust center, marking the e-signature authorization by the Information Technology Industry Development Agency (ITIDA). Egyptian E-Signature Infra-Structure Operates Country XY Cross recognition National ROOT Certification Authority Certifies CSP1 CSP2 CSP3 CSP4 GOV CA Issues Signature Key Holders ( End Users) Gov Employees 6

7 Regulating Digital Certificates Information Technology Industry Development Agency (E-Signature regulator) Request for digital certificates Digital Certificate Providers Digital Certificates Client Organizations The Egyptian Root CA - As one of its primary roles, ITIDA operates the Egyptian Root Certificate Authority (Root CA) according to the highest security standards offering a continuous 24hx7 operation (based on the means of a 2nd hot-standby Trust Center). - The national Root CA is the trust anchor for all relying parties within that domain. Furthermore, the national Root CA is the legal and national base upon which all IT applications, E-commerce and E-business Transactions will be affected. 7

8 Root CA Key Functions Issues digital certificates for licensed certificate service providers (CSPs) and publish them to be available 24/7. Helps to prove or deny instantaneously the validity of digital certificates of the licensed CSPs by providing both OCSP Service and LDAP directory. Root CA has the rights to stop the operation of any CA in case of security deficiencies. Working as TSA (Time Stamping Authority) for CSPs. Continue Responsible for interoperability between other countries providing a point of communication between Egypt and other nations in relations of E-signature. Auditing all the PKI technical requirements of CSP s against the Egyptian executive directives and all the updated international standards. Offers technical consultations to all the community in the field of Information Security especially in Public key Infrastructure. 8

9 Achievements Root CA main trust center with 6 IT fortified rooms and more than 40 different types of servers and security equipments has been implemented to operate 24/7 by 100% highly trained Egyptian staff. GOV- CA trust center is implemented and is ready to serve the governmental organizations. Signing an MOU with the German Root CA to facilitate the cross recognition with the German Root CA. Three private CSPs are ISO certified and passed ITIDA audit (financial, legal and technical) and now are ready to issue digital certificate under the hood of Egyptian Root CA (16000 Certificates Up till now). Continue The first two deployed private CSP have been securely connected to the Root CA main trust center to maintain a copy of all the issued digital certificates and CRLs to maintain client rights in case of disaster. Auditing process by ITIDA is to be continued for the remaining CSPs. Home made E-signature tools are ready to be used (Egyptian Smart Token (with and without Fingerprint). E-Signature Applications (Desktop, Web, and Mobile) 9

10 Cyber Security and Data Protection Law The Law is prepared by Government, Private sector and Academia as well as Legal and technology experts. The Law will be endorsed at the end of this Year Egypt Computer Emergency Response Team Egyptian CERT mandate is to support the Egyptian society in working with protection against IT incidents and is the central report and coordination point for relevant security incidents for the government activities (starts with Telecom and banking sectors). CERT Activities in Egypt can be divided into 2 phases 10

11 1st Phase of Egyptian National CERT The initial activities that the national CERT starts with are as follows: Incident Handling. Incident analysis : forensic collection and analysis Alerts and Warnings. Announcements. Technology Watch. Security Audit. Intrusion Detection. 2nd Phase of Egyptian National CERT Vulnerabilities handling Development of Security Tools Configuration and Maintenance Security Tools, Applications and Infrastructure. Security Quality Management Services 11

12 Demos of the Use of Egyptian E-Signature Software and Tools to Secure E-Applications Pictures from Reality 12

13 ITIDA Cryptography Suite Smart Token Software 13

14 Mobile Phone Application The Future Finalizing the Root CA disaster recover site at the Ministry of finance premises 30 KM apart from the Root CA main site. Doubling the staff to achieve the business continuity. Cross recognizing our Egyptian Root CA with other imitates in other countries. Collaborating with the Egyptian CERT to maintain the work sustainability. 14

15 Questions??????? Thank You 15