Institute for the Protection and Security of the Citizen HAZAS – Hazard Assessment ECCAIRS Technical Course Provided by the Joint Research Centre - Ispra (Italy) Security

Institute for the Protection and Security of the Citizen HAZAS – Hazard Assessment 2 Security Task –Enforce company policy in data access Purpose –Impeding unauthorised users access to the ECCAIRS system –Restricting access to sensitive data to authorised users Methods –Password protected accounts –Encryption –Proprietary file formats –Abstraction of data

Institute for the Protection and Security of the Citizen HAZAS – Hazard Assessment 3 Security Levels Via Repository –Security implemented as repository profiles –No relation with DCOM or DBMS –Identification with username/password for the repository server –Detailed configuration at the server, propagated to the workstation –Maintained at client workstation when no connection to repository possible Configuration –Repository Manager (application) –Setting of Identification, Access and Configuration

Institute for the Protection and Security of the Citizen HAZAS – Hazard Assessment 4 Security Levels Via DCOM –Configuration only required at the Repository Server Security based on Windows domain identities If installed on PDC, then domain user Otherwise, local account: more secure Configuration –Computer Management Windows identity for remote access –DCOMCNFG (application) Access, Launch and Configuration permissions

Institute for the Protection and Security of the Citizen HAZAS – Hazard Assessment 5 Security Levels Via RDBMS –Configuration only required at the Database Server –Security based on RDBMS identities Configuration –RDBMS manager (SQL Enterprise Manager, DBA Studio) –Setting of Identification and Database

Institute for the Protection and Security of the Citizen HAZAS – Hazard Assessment 6 ECCAIRS Profiles –Proprietary format –Encrypted with proprietary encryption algorithm –Sometimes compressed ECCAIRS 4 Data Format –Encrypted with proprietary encryption algorithm –Sometimes compressed XML structure is not encrypted Result –Data only readable if there is a very profound knowledge of the ECCAIRS taxonomy, XML and the E4F specification

Institute for the Protection and Security of the Citizen HAZAS – Hazard Assessment 7 Repository Manager – Security Profile View vs. Security –View profile operates on data in workstation’s memory Assumes entire occurrence record is in memory Operates on screen allocation only Will not show “what is not there” –Security profile operates on data from and to database Will not retrieve from the database Will not write to the database –View profile handles down to sections –Security profile handles down to attributes Configuration issues –Risk of data loss If edit allowed, write back overwrites record in database –Should be synchronised with Browser Application profile –Consider using filter in Data Source profile