Holistic and Law Compatible IT Security Evaluation: Integration of Common Criteria, ISO 27001/IT-Grundschutz and KORA

Holistic and Law Compatible IT Security Evaluation: Integration of Common Criteria, ISO 27001/IT-Grundschutz and KORA

Daniela Simić-Draws, Stephan Neumann, Anna Kahlert, Philipp Richter, Rüdiger Grimm, Melanie Volkamer, Alexander Roßnagel
Copyright: © 2015 |Pages: 20
DOI: 10.4018/978-1-4666-8473-7.ch047
OnDemand:
(Individual Chapters)
Available
$37.50
Current Special Offers
No Current Special Offers
TOTAL SAVINGS: $37.50

Abstract

Common Criteria and ISO 27001/IT-Grundschutz are well acknowledged evaluation standards for the security of IT systems and the organisation they are embedded in. These standards take a technical point of view. In legally sensitive areas, such as processing of personal information or online voting, compliance with the legal specifications is of high importance, however, for the users' trust in an IT system and thus for the success of this system. This article shows how standards for the evaluation of IT security may be integrated with the KORA approach for law compatible technology design to the benefit of both – increasing confidence IT systems and their conformity with the law on one hand and a concrete possibility for legal requirements to be integrated into technology design from the start. The soundness of this interdisciplinary work will be presented in an exemplary application to online voting.
Chapter Preview
Top

As IT security engineers and lawyers have a different professional background, difficulties often arise when working together on a topic. Even if both strive for the same goal, they usually operate by means of different approaches and different terms or the same term indicates slightly or even totally different concepts. In order to be able to operate effectively, a mutual basis must be found. Already several works have been conducted considering the question of how to enhance security evaluation approaches with legal aspects.

Breaux et al. (Breaux & Antón, 2005a; Breaux & Antón, 2005b; Breaux & Antón, 2008; Breaux, Vail, & Antón, 2008) address the challenges of highly regulated domains, in their case the U.S. Health Insurance Portability and Accountability Act. The authors convert legal texts into formal specifications in terms of rights, obligations, and constraints, thereby resolving ambiguities. Breaux et al. focus their research in one direction towards software engineering. Our work, however, aims at involving legal researchers and computer scientists each in a perpetual discourse moving back and forth between all levels of the design process. Creating this interdisciplinary flexibility turns out to be of central importance so that conflicts between technical goals or conflicts between technological solutions may be solved adequately.

Complete Chapter List

Search this Book:
Reset