Session 1.6a: PRESENTATION Security requirements Security actions Legislative and Policy issues A comprehensive multipillar approach of security in EU. Electronic Identification & Authentication - Electronic signature Electronic identification for citizens to be used throughout EU. Policy on the interoperability of Member States’ PKIs To apply the outcome of EESSI and eEurope TBs1 & 2 Risk awareness and risk warning Spread use of best practice; Evaluation and certification EU Policy on security products evaluation and certification. Technology
Session 1.6a: Outcome of the discussion (I) ·Security should not be an stopper to the deployment of electronic services. The proportionality principle should be applied. ·Agreement on a universal certificate (certificate of identity) may boost the deployment of electronic services and achieve a critical mass and consequently increase the number of citizens as end users. As a result from this the Administration may have the ability to influence developments of new information society services, particularly B2C e-commerce. ·To keep on working with a pragmatic approach in the interoperability and harmonisation of PKIs, certificates (attributes, optional fields), revocation lists, directories and procedures, certification statement policies, etc, between Member States and European Institutions.
Session 1.6a: Outcome of the discussion (II) · The insterest of the Bridge CA study included in IDA HAM WP is reinforced. · To feed IDA (PCI & HAM) with the results of EESSI, and TBs Public Identity and Identification and Authentication. Also to encourage Member states to use these results. · To follow with interoperability experiences (IDA PKICUG and e-mail) and issue guidelines from the conclusions. · Certificates using smart cards and software certificates; flexibility between these two options depending on the requirements of the service. · CERTs: There is a real need for an inventory of CERT functions and information managed and also exchange of information between them. To encourage the use of security best practices in the development of e-services projects (e.g. ISO/IEC IS 17799).