QuoVadis Group Overview for EUGridPMA. Snapshot Trust/Link certificate services for the global enterprise –Digital certificates including End User, Qualified,

Slides:



Advertisements
Similar presentations
29e CONFÉRENCE INTERNATIONALE DES COMMISSAIRES À LA PROTECTION DES DONNÉES ET DE LA VIE PRIVÉE 29 th INTERNATIONAL CONFERENCE OF DATA PROTECTION AND PRIVACY.
Advertisements

Launching Egyptian Root CA and Inaugurating E-Signature Dr. Sherif Hazem Nour El-Din Information Security Systems Consultant Root CA Manager, ITIDA.
Policy interoperability in electronic signatures Andreas Mitrakas EESSI International event, Rome, 7 April 2003.
Extended validation SSL March 2007 Tim Moses (chair, CA / Browser Forum)
Topic 8: Secure communication in mobile devices. Choice of secure communication protocols, leveraging SSL for remote authentication and using HTTPS for.
1 Pertemuan 13 eBusiness, AIS, Financial Statement and Accounting Professionals Matakuliah: F0662/ Web Based Accounting Tahun: 2005 Versi: 1/0.
Dr. Mohamed A. Hamada Lecturer of Accounting Information Systems Advanced Auditing Lecture 1 Assurance and Attestation Services.
1 WebTrust for Certification Authorities (CAs) Overview October 2011 WebTrust for Certification Authorities (CAs) Overview October 2011 Presentation based.
1st Expert Group Meeting (EGM) on Electronic Trade-ECO Cooperation on Trade Facilitation May 2012, Kish Island, I.R.IRAN.
Certification Authority. Overview  Identifying CA Hierarchy Design Requirements  Common CA Hierarchy Designs  Documenting Legal Requirements  Analyzing.
ESign-Online Digital Signature Service February 2015 Controller of Certifying Authorities Department of Electronics and Information Technology Ministry.
Jaroslav Pinkava May 2001 Certification Authority in Praxis. Security Aspects. Conference Security and Protection of Information Ing. Jaroslav Pinkava,
Implementation of Electronic Signature Law Kęstutis Andrijauskas Information Society Development Committee under the Government of the Republic.
National Institute of Advanced Industrial Science and Technology Proposals for auditing Yoshio Tanaka Grid Technology Research.
©2008 Prentice Hall Business Publishing, Auditing 12/e, Arens/Beasley/Elder The Demand for Audit and Other Assurance Services Chapter 1.
Information security An introduction to Technology and law with focus on e-signature, encryption and third party service Yue Liu Feb.2008.
DESIGNING A PUBLIC KEY INFRASTRUCTURE
Security Controls – What Works
16.1 © 2004 Pearson Education, Inc. Exam Planning, Implementing, and Maintaining a Microsoft® Windows® Server 2003 Active Directory Infrastructure.
COEN 351: E-Commerce Security Public Key Infrastructure Assessment and Accreditation.
National Institute of Advanced Industrial Science and Technology Auditing, auditing template and experiences on being audited Yoshio Tanaka
PUBLIC KEY INFRASTRUTURE Don Sheehy
6/4/2015National Digital Certification Agency1 Security Engineering and PKI Applications in Modern Enterprises Mohamed HAMDI National.
E-Procurement: Digital Signatures and Role of Certifying Authorities Jagdeep S. Kochar CEO, (n)Code Solutions.
January 2011 As a precaution, re-check the exam time in early January. Various rooms are used, your room will be on your personal timetable, available.
Introduction to PKI Seminar What is PKI? Robert Brentrup July 13, 2004.
The Demand for Audit and Other Assurance Services Chapter 1.
CSE 4482, 2009 Session 21 Personal Information Protection and Electronic Documents Act Payment Card Industry standard Web Trust Sys Trust.
MWD1001 – Website Production Web Browsers Week 11.
Identity Management and PKI Credentialing at UTHSC-H Bill Weems Academic Technology University of Texas Health Science Center at Houston.
Controller of Certifying Authorities Public Key Infrastructure for Digital Signatures under the IT Act, 2000 : Framework & status Mrs Debjani Nag Deputy.
IDA Security Experts Workshop Olivier LIBON Vice President – GlobalSign November 2000.
May 30 th – 31 st, 2006 Sheraton Ottawa. Microsoft Certificate Lifecycle Manager Saleem Kanji Technology Solutions Professional - Windows Server Microsoft.
Deploying a Certification Authority for Networks Security Prof. Dr. VICTOR-VALERIU PATRICIU Cdor.Prof. Dr. AUREL SERB Computer Engineering Department Military.
Lecture 12 Electronic Business (MGT-485). Recap – Lecture 11 E-Commerce Security Environment Security Threats in E-commerce Technology Solutions.
8 Nob 06 / CEN/ISSS ETSI STF 305: Procedures for Handling Advanced Electronic Signatures on Digital Accounting CEN/ISSS Workshop.
Best Practices in Deploying a PKI Solution BIEN Nguyen Thanh Product Consultant – M.Tech Vietnam
Internet Trust Defined. Delivered. Electronic Business the Way It Was Meant to Be.
Codes, Standards & Conformity Assessment GP Russ Chaney CEO, The IAPMO Group
Service Organization Control (SOC) Reporting Options and Information
Using Personal Certificates Jeff D’Angelo Jeremy Hill Network of People, Jan 6, 2005.
WebTrust SM/TM Principles and Criteria for Certification Authorities CA Trust Jeff
1 - 1 ©2006 Prentice Hall Business Publishing, Auditing 11/e, Arens/Beasley/Elder The Demand for Audit and Other Assurance Services Chapter 1.
Logo Add Your Company Slogan China Financial Certification Authority Third-party certification authority Team 13 :吉露露、吴莹莹、潘韦韦 ( CFCA )
Computer Security: Principles and Practice First Edition by William Stallings and Lawrie Brown Lecture slides by Lawrie Brown Chapter 22 – Internet Authentication.
Security Protocols and E-commerce University of Palestine Eng. Wisam Zaqoot April 2010 ITSS 4201 Internet Insurance and Information Hiding.
Configuring Directory Certificate Services Lesson 13.
Chapter 23 Internet Authentication Applications Kerberos Overview Initially developed at MIT Software utility available in both the public domain and.
Secure e-Business Chartered Accountants of Canada Comptables agréés du Canada Overview of WebTrust TM.
Module 9: Fundamentals of Securing Network Communication.
PKI Forum Business Panel March 6, 2000 Dr. Ray Wagner Sr. Director, Technology Research.
Security Overview  System protection requirements areas  Types of information protection  Information Architecture dimensions  Public Key Infrastructure.
Module 9: Designing Public Key Infrastructure in Windows Server 2008.
1. 2 Overview In Exchange security is managed by assigning permissions in Active Directory Exchange objects are secured with DACL and ACEs Permissions.
© 2003 The MITRE Corporation. All rights reserved For Internal MITRE Use Addressing ISO-RTO e-MARC Concerns: Clarifications and Ramifications Response.
EESSI June 2000Slide 1 European Electronic Signature Standardization Hans Nilsson, iD2 Technologies, Sweden.
1 Topic# 7 – Auditing with Technology Readings, Chapter 10 A – COMPUTERIZED AUDIT TOOLS –Electronic Spreadsheets –Automated Working Papers –Generalized.
Security fundamentals Topic 5 Using a Public Key Infrastructure.
Computer and Network Security - Message Digests, Kerberos, PKI –
Creating and Managing Digital Certificates Chapter Eleven.
©2010 Prentice Hall Business Publishing, Auditing 13/e, Arens/Elder/Beasley The Demand for Audit and Other Assurance Services Chapter 1.
PKI Policy Determination Process Input from PKI Decision Process PKI Policy Determination Process Application(s) Workflows Players.
Information Security tools for records managers Frank Rankin.
QuoVadis Group EUGridPMA Update September Overview ► Founded in 1999 in Bermuda, with particular focus providing PKI managed services to multinational.
QuoVadis accreditation with EuGridPMA Alessandro Usai
1© Copyright 2012 EMC Corporation. All rights reserved. Next Generation Authentication Bring Your Own security impact Tim Dumas – Technology Consultant.
QuoVadis Group Roman Brunner, Group CEO Update for EUGridPMA – May 12, 2009.
The technology behind the USPS EPM. AND COMPLIANCE March 25, 2004 Adam Hoffman.
The Demand for Audit and Other Assurance Services
The Demand for Audit and Other Assurance Services
Presentation transcript:

QuoVadis Group Overview for EUGridPMA

Snapshot Trust/Link certificate services for the global enterprise –Digital certificates including End User, Qualified, SSL (including Extended Validation) etc. –Managed PKI (dedicated or shared) –Digital signatures and related technologies Offices in Switzerland, UK, Holland, Bermuda, and New Zealand Focus on acceptance by relying parties –Audits and accreditations –Wide distribution of roots in OS and Browsers

Root Distribution Browsers Microsoft Internet Explorer 5.0+ (including Maxthon and others) Mozilla Firefox (including Camino, Fennec, and Sea Monkey) Opera (including Opera Mini) Safari 1.0+ (including mobile Safari) Google Chrome Konqueror and K-Meleon Operating Systems Microsoft Windows XP+ Apple OS/X+ RIM Blackberry 4+ KDE Clients Apple Mail.app Eudora Microsoft Entourage Microsoft Outlook Microsoft Outlook Express Mozilla Thunderbird Mozilla Sea Monkey RIM Blackberry Mail (part of Core Applications) Other Microsoft Office Open Office Wide array of OSS applications that use the Mozilla Network Security Services (NSS) libraries 3.9+

QuoVadis Services Managed PKI Digital certificates, including Qualified and Advanced certificates, as well as various functional certificates for compliance in Switzerland, Netherlands, UK, and Bermuda. We also provide SSL including the new Extended Validation SSL. Outsourced certification authorities (CA) that can be tailored to the particular needs of a client or community. Rapid-deployment Trust/Link registration authority (RA) web portals for easy issuance for both End User and SSL certificates. Signing Services Trusted time-stamping to reinforce data integrity and non-repudiation in the tracking, storage/archive, or submission of electronic records. Digital signing tools (both client and server side). Root Services Root CA hosting for organisations wishing to set up their own trust anchors. Root CA signing enhances the trust and recognition of customers’ in-house CAs. Our PKI professional services team is skilled in PKI policy, technologies, and integration into customer environments.

Summary of our Audits and Accreditations The accreditations maintained by QuoVadis include: –WebTrust for Certification Authorities –WebTrust for Extended Validation –Swiss Qualified Certification Services Provider –Netherlands Qualified Certification Services Provider –Bermuda Authorised Certification Services Provider

WebTrust for Certification Authorities WebTrust for CAs is the dominant commercial standard to assess CAs Managed jointly by the American Institute of Certified Public Accountants (AICPA) and the Canadian Institute of Chartered Accountants (CICA). The annual WebTrust audit of QuoVadis is performed by Ernst & Young. To obtain and retain the WebTrust seal, the CA must meet all the WebTrust for CAs Principles and Criteria. The following areas are included in the scope of every WebTrust engagement 1.CA Business Practices Disclosure 2.Service Integrity 3.CA Environmental Controls

WebTrust for Certification Authorities 1.CA Business Practices Disclosure 2.Service Integrity 3.CA Environmental Controls

WebTrust for Extended Validation WebTrust for Extended Validation (EV) is used to assess a CA’s controls against the CA/B Forum “Guidelines for the Issuance and Management of EV Certificates”. Only suitably accredited CAs may issue EV SSL certificates. The annual WebTrust for EV audit of QuoVadis is performed by Ernst & Young. The audit tests whether QuoVadis has maintained effective controls to provide reasonable assurance that: –EV Subscriber information was properly collected, authenticated (for the registration activities performed by QuoVadis) and verified, and –The integrity of keys and EV certificates QuoVadis manages is established and protected throughout their lifecycles.

Swiss Qualified Certification Services Provider ZertES is the Swiss digital signature law. ZertES accreditation is granted by the Swiss Accreditation Service (SAS) and the Swiss Federal Office of Communications (BAKOM) based on an audit by KPMG QuoVadis are audited against the requirements of Swiss law and on ETSI standards for Qualified Certification Service Providers and Time Stamping Authorities. The following areas are included in the scope of the audit: –The Certification Service Provider (CSP) requirements of ZertES and the accompanying VZertES regulatory provisions –Requirements for Time Stamping Authorities (TSA) based on ETSI TS and ETSI TS –Requirements for Qualified Electronic Signatures according to ETSI TS , ETSI TS and SR

Netherlands Qualified Certification Services Provider QuoVadis is certified by BSI for compliance with the TTP.NL Scheme for Certification Authorities. The TTP.NL initiative is based on the European Directive for electronic signatures and the European standard ETSI TS This annual audit is performed by KPMG for BSI. Bermuda Authorised Certification Services Provider The Bermuda Authorised Certification Services Provider accreditation is granted by the Ministry of Energy, Telecommunications and E-Commerce. The CSP standard includes elements of ISO (Code of Practice for Information Security Management), EESSI (European Electronic Signature Standardisation Initiative), and WebTrust for CAs. The Accreditation is based on an external review defined in the Bermuda Electronic Transactions Act. This review was performed by Ernst & Young. This Accreditation requires biennial certification by the Government.

QuoVadis Secure Data Centre - Bermuda The QuoVadis Secure Data Centre in Bermuda is a Lampertz SYS-DATA IT Security room that meets a number of international standards. The data centre is a “stand alone” security room with a modular construction with tested wall, ceiling and floor elements. The room is designed to offer protection against fire, humidity, magnetic influences, unauthorized access, explosions, falling debris and radiation. The data centre meets a number of international standards, including: –BS/EN1047-2: the British Standard relating to data centres. The standard includes classification and methods of test for resistance to fire. –Fire protection – meets DIN 4102 F90 fire protection standard (withstand a fire lasting 90 minutes from inside and outside) –Smoke Proof – meets the DIN smoke protection standard –Tightness against water and dust – meets the IP55 EN standard relating to the sealing against intrusion from foreign bodies –Burglar protection – the door system meets the DIN standard (ET2)