1. Future ICT Landscapes – Security and Privacy Challenges & Requirements Simone Fischer-Hübner IVA Workshop, Stockholm 24th May 2012

2. Part I: Security & Privacy Challenges Part II: Requirements for Protecting Identity, Privacy & Security

3. ICT Trends & Challenges Open Communication Infrastructures (e.g., VoIP) Outsourcing, Cloud Computing Web 2.0, ”free” services Smart Devices Ambient Intelligence …

4. Open Communication Infrastructure Threats: Example: PSTN vs. VoIP PSTN: Public switched telephone network Circuit switching: Bandwidth reserved Fixed route VoIP: Voice over IP Packet Switching: Dynamic bandwidth Unfixed route

5. Pros and Cons of VoIP + Low cost Software based equipment Reused infrastructure Services integration More features: video, data, presence, game… - Quality Latency Dynamic bandwidth Packets order Security Open environment Shared infrastructures Emergence calls Not bound with physical location, no guarantee

6. VoIP: Security Vulnerabilities and Threats Availability threats: Denial of Service Confidentiality threats: Eavesdropping Timing attacks Integrity threats: Signaling messages modification Media injection Replay attacks Privacy threats: Call Spam (SPITs) Traffic Analysis

7. Cloud Computing – Security Challenges Security risks: Malicious insiders, data loss / leackages, shared technology vulnerabilities, downtime,… Cloud service users lack Understanding of risks Control over what happens with data Means for redress

8. Web 2.0 http://www.ethannonsequitur.com/ User Profiling ”Face rape” Lifelong privacy issues ….

9. Part I: Security & Privacy Challenges Part II: Requirements for Protecting Identity, Privacy & Security

10. Newly proposed EU Data Protection Rules (Data Protection Regulation proposed 25 January 2012) ”Right to be forgotten” Explicitly given consent, more transparency of data handling, easy-to- understand policies Easier exercising of data subject rights (electronically, in relation to all recipients) Increased accountability, privacy breach notification, higher penalites Privacy by Design (PbD), Privacy by Default

11. Privacy-enhancing Identity Management User control - Audience segegration Data minimisation Pseudonymity, Unlinkability ID theft protection, reliability Clauss/Köhntopp 2001

12. Enabler PETs: Anonymous Credentials (PrimeLife, ABC4Trust) www.abc4trust.eu

13. Transparency & Accountability Tools: Regulators, auditors, business governance service Cloud service supply chain/network Trusted services supporting accountability Chain of Accountability Cloud service users Cloud service Corrective Detective Preventiv e Cloud service users: control and transparency over how their data is used, and support in obtaining redress Service providers: techniques to make services more trustworthy, satisfy business policies and allow differentiation Regulators/auditors: assurance about compliance with policies and regulations

14. Questions ? http://www.cs.kau.se/~simone/