EU-SEC - The European Security Certification Framework

Date: 
01/01/2017 to 31/12/2019

Introduction

In recent years the ICT market has evolved toward a cloud-based approach. This shift together with the rapidly changing legal and regulatory landscape has heavily impacted security assurance, governance and compliance. The information security market players have tried to provide suitable solutions to cope with issues such as

  1. lack of means to provide higher level of assurance (e.g continuous monitoring and auditing),
  2. privacy not adequately taken into account,
  3. limited transparency and
  4. lack of means to streamline risk management and compliance.

In the certification space this has resulted in the creation of several schemas creating an additional problem, i.e. the proliferation of certification scheme. The project EU-SEC will improve the effectiveness and efficiency of existing approaches for assurance and compliance. The EU-SEC aims to create a framework under which existing, certification and assurance approaches can co-exist.

The three core ideas behind the EU-SEC project are that an effective and efficient approach to trust, assurance and compliance has to:

  1. balance the need of nations and business sectors to develop their specific certification schemas with the need of CSPs to reduce compliance costs
  2. avoid that humans (auditors) do activities that can be performed by machines (e.g. collecting data)
  3. make sure that accurate and reliable evidences/information are provided to relevant people, in a timely fashion, leveraging as much as possible automatic means.

The EU-SEC framework will equip stakeholders in the ICT security ecosystem with a validated governance structure, a reference architecture, and the corresponding set of tools to improve the efficiency and effectiveness of their current approach to security governance, risks management, assurance and compliance. The EU-SEC aims to enhancing trustworthiness and transparency in the ICT supply chain through business cases developed and piloted by industrial partners.

Week: 
Friday, 23 March, 2018

Project type:

News

Europol - Internet Organised Crime Threat Assessment 2018

Europol has just released its fifth annual Internet Organised Crime Threat Assessment (IOCTA).

The report offers a unique law enforcement view of the emerging threats and key developments in the field of cybercrime over the last year and warns of 15 ways in which people can fall prey to cyber criminals.

Events

29/09/2018 to 05/10/2018
Cryptology And Network Security - 30th September/ 3rd October 2018 - Naples (Italy)

The International Conference on Cryptology And Network Security (CANS) is a recognized annual conference, focusing on all aspects of cryptology, and of data, network, and computer security. CANS 2018 will be held in Naples from the next 30th September until the 3rd October.

06/10/2018 to 11/10/2018
Security of Personal Data Processing Event - 8th October - Athens (Greece)

ENISA and Cyberwatching.eu co-organize in October 8, 2018 a workshop on security measures (article 32 GDPR) in Athens.