World Class Standards Footer text (edit in View : Header and Footer) Security paradigms and RFID RFID03_03 Scott W CADZOW C3L

World Class Standards Footer text (edit in View : Header and Footer) 2 Security and standards development Risk based assessment Design based assurance

World Class Standards History of RFID Origins not terribly well documented Henry Stockman, 1948 Mario Cardullo (US Patent 3,713,148) in 1973 Charles Walton (US Patent 4,384,288) in 1983 Standards development ISO, base standards ETSI?? ITS active, passive transponders, road pricing Footer text (edit in View : Header and Footer) 3

World Class Standards Standards (not radio) ISO 14223/1 Radio frequency identification of Animals, advanced transponders – Air interface ISO HF (13.56 MHz) standard used as the basis of RFID-enabled passports under ICAO ISO HF (13.56 MHz) standard, used for non-contact smart payment and credit cards. ISO UHF (433 MHz) industry standard for active RFID products ISO Industry standard for electronic seals for tracking cargo containers Footer text (edit in View : Header and Footer) 4

World Class Standards Security issues in RFID Well documented Aired in previous RFID workshops Tracking – traffic analysis Masquerade may result Physical weaknesses Chip can be broken Antenna can be broken Antenna can be easily masked Religious fervour ??? Weird claim of RFID as mark of the beast (Revelation 13:16) Footer text (edit in View : Header and Footer) 5

World Class Standards

Paradigm to be adopted Design for assurance Advancement of ITU-T 3 stage method Development in line with Common Criteria (ISO/IEC 15408) Use of ETSI EG as basis Development of Protection Profiles using ES as template Risk analysis as fundamental key in development ETSI TS as the root document Objective and requirements engineering Key to success being developed in TISPAN WI Security architecture and countermeasure analysis Using key capabilities from ISO/IEC Footer text (edit in View : Header and Footer) 7

World Class Standards Definitions to be going on with Objectives Broad intention of system (WHAT) Functions Abstract grouping of features Requirements Implementation detail (HOW)

World Class Standards Understanding of security A Threat, enacted by a Threat Agent, may lead to an Unwanted Incident breaking certain pre-defined security objectives Aim is to avoid Unwanted Incidents Countermeasures restrict the ability of threat agents to operate

World Class Standards The root model for eTVRA

World Class Standards Threat types (#1)

World Class Standards Threat types (#2)

World Class Standards SUMMARY Where we need to go Footer text (edit in View : Header and Footer) 13

World Class Standards Key points Adoption of design for assurance paradigm Risk based development of security functions Distribution of risk based on least cost loss function Cryptographic development with SAGE as partners Systems security development with TISPAN and OCG-Sec as partners Footer text (edit in View : Header and Footer) 14

World Class Standards Thanks for listening Scott CADZOW Cadzow. com Footer text (edit in View : Header and Footer) 15