ENEN
Study on “ICT Security Certification and labelling – Evidence gathering and impact assessment”
Second Interim Report
PwCPage 1
Study on “ICT Security Certification and labelling – Evidence gathering and impact assessment”
Second Interim Report
Table of contents:
5. Stakeholders’ support
6.Work Plan
6.1.Update on Project Tasks
6.1.1.Task 1: Evidence Gathering and Analysis
6.1.2.Task 2: Assess the impact
6.1.3.Task 3: Other specific tasks
6.1.4.Task 0: Project Management
7.Annex
7.1 Minutes of the interviews
7.2 Questionnaire
7.3 Stakeholder Mapping
7.4 An overview of criticism related to Common Criteria
7.5 Cyber Security market Insights
7.6Case Study – “The impact of an EU wide Certification Scheme on Smart-Meter Industry”
7.7Case Study – “The impact of an EU wide Certification Scheme on Alarm Systems Industry”
7.8Case Study – “The impact of an EU wide Certification Scheme on Cloud Computing Industry”
7.9IoT Trust Label - Proposed Requirements as a Basis for Endpoint Trust Labels (from Stakeholder Support)
7.10German Ministry of Interior – Study on “Introduction of a label of quality for IT security features of Internet-enabled products”
7.11Cyber Risks and Cyber Resilience of Critical Infrastructures
7.12The Lack of Appropriate Standards and the Need for a Common International Approach
7.13Economics of Standards
7.14References
5. Stakeholders’ support
The following section described the information gathered through interview activities to selected participants from these categories:
-Smart meters Industry
-Semiconductors industry
-Other private sector representatives
-Members of ICT Certification Authorities
Questions were asked in order to cover the following areas of interest:
-Evidence of fragmentation
-Labelling and information asymmetry
-Policy Option 1: Non-legislative “Soft-law” measures
-Policy Option 2: EU legislative act to extend SOG-IS agreement to all MS
-Policy Option 3: EU general ICT security certification and labelling framework
-Institutional costs
5.1 Evidence of fragmentation
Interview data gathering activities provided key examples of fragmentation of ICT Security Certification across Europe pinpointing what are the cross-border trade challenges the industry must face when entering the market of several EU countries.
Representatives from smart meters industry provided a position on fragmentation in the field of smart metering products, which is worth reporting: “If the question is: Are there countries that accept each other certificates? The answer is no”. As example, it has been explained that there are currently three certification for smart-meters in three countries. In the UK, the certification scheme is called the CPA (Commercial Product Assurance), which is a scheme applied for smart-meters but also for other products. In France they have the CSPN (Certification de Sécurité de Premier Niveau) certification scheme and in Germany they have their own protection profile based on Common Criteria. There are also national communications infrastructure for devices connected to smart-meters including interfaces with the different stakeholders involved such as the German Smart Meter Gateway and in the UK the so-called “Communication Hub”. These are all examples where additional certification requirements are needed for a vendor to access the market of these countries.
Specific examples of fragmentation are widespread. For instance in the field of VPNs related network products, although VPNs are certified against a “collaborative” protection profile (cPP), meaning that the PP has been harmonized with International Mutual Recognition Arrangement, vendors wanting to access the French market have to undergo the additional CSPN certification process (and in some cases a completely new common criteria evaluation). This means that the VPNs requirements must be certified through national approval which in the French case will last from 6 to 9 month and the costs are estimated to around 80k euros as well as the EU approval process which is free of charge but takes 2 months to be completed.
Market fragmentation within the EU exists even for trust service products, which have been certified against US FIPS certification schemes. For Hard Security Modules initial certification of the crypto module acquired through the American FIPS), and the SOGIS members, via CEN, request for additional Common Criteria certificates with related vulnerability analysis. Some European countries accept FIPS certifications for electronic signature products as equivalent to Common Criteria certified, yet other certify their products exclusively through the CC. The share of products certified with both systems, therefore allowing the vendor to sell its product in both US and European markets is even narrower.
Additionally for SSCD products, there are examples in SOGIS Member States where the original common criteria certification is not sufficient for national needs and the product has to undergo again the certification process of that country.
Respondents from National ICT Certification Authority pointed out the fact that fragmentation may exist even within the same country. This may happen as in the case of Italy, where procurement requirements may be established by administrative subject with a fair degree of autonomy. There is also a second example. In Italy, a public local authority (Provincia di Trento), in a public procurement procedure[1] has recommended the security certification of a video surveillance system according to Common Criteria (low assurance, i.e., EAL 1). Duration and costs of this security certification can be estimated in about 6 months and 20K euros.
The intervieweesfrom smart meters industry provided some concerns on the future scenario of multiplication of national certification schemes for what concerns the industry of smart-metering if no action is taken. If MS continue not to accept each other Certification schemes, each MS will continue to improve its own Certification scheme and this could create a strong legacy making harmonisation more difficult. Furthermore, such fragmentation is also happening on the evaluation side. There are only limited number of Conformity Assessment Body that are able to certify against the requirements of different schemes. In this way, additional market entry barrier are created. The interviewers explained that the single most important barrier to trade for the smart metering industry are the costs for certification. Without specifying better the unit of analysis, the respondent stated that the cost of certification is about 1 million and the SMEs are out of this gain. In Germany, only one of the biggest smart-metering companies is starting a certification to enter other markets and all the other companies are present only in the German market”.
5.2 Labelling and information asymmetry
Interviewees from several interviews addressed the issue of information asymmetry. For Semiconductors industry representatives the situation is today polarised between products for public security and consumers’ product. For the former certification is long and costly and only the big company can manage such processes. At consumers’ product level the requirements are lighter, but what is currently needed are solutions that are in between these two extremes. Currently, there is also the need to raise awareness about the importance of security using some forms of labelling schemes. On the other hand, according to some respondents the market problem is not one of fragmentation but rather of awareness and demand.
For Semiconductors industry representatives it is paramount to distinguish customers from users when trying to assess whether there is an information asymmetry with behavioural impacts. The final consumer is not well informed on the security properties of ICT products/services, this is due to a lack of awareness due to absent labelling. From the point of view of industry and government customers, the information in labelling schemes is likely to have an impact on its behaviour and purchases. An example can be found in cable TV that need to be connected to a router for internet connections, these products do not respond to specific security requirements and are vulnerable to hacker attacks. On the other hand, consumers are not aware of this kind of deficiencies, so they continue buying products without considering security requirements.
According to Smart meters industry representatives the situation on information asymmetry is different if we consider business-to-business products. The suppliers buy millions of meters and they of course have good understanding of security specifications of the products and in this domain labelling would not be of much use.
On the other hand, labelling and other means to reduce information asymmetry are important to increase trust in the public and the government should be very interested in this topic. The public opinion is more concentrate on privacy issues (e.g. personal data). For smart-meters, in UK, there is a display connected to the meters and consumers can simply read data on this display. There are devices connected with meters and you could be connected to the meters and read data where you want. The consumer decision to buy a product is often on the utility of the product. You should differentiate what products/device needs to be certified and what devices needs to be labelled.
5.3Policy Option 1: Non-legislative “Soft-law” measures
Whilst some interviewees explained that voluntary labelling schemes and other non-legislative measures may provide some benefits to the industry, this policy option does not stands on its own feet as a way to address the main concerns of market fragmentation and information asymmetry.
On the positive note by letting the industry voluntarily put forward their own labels in coordination with public authorities it allow it to provide information to the users in a cost-efficient way.
The value of voluntary schemes and industry labelling initiatives is positive when considering the national level. Yet when considering cross-border trade of ICT products voluntary labelling approaches seem to pose additional problems. In fact, consumers may have awareness for labels existing at the national level but less so for labels from other countries, which do not abide to a certain degree of cross-country standardisation.
Furthermore, voluntary labelling initiatives may avoid some market inefficiencies that arise with regulated certification schemes, particularly for national or regional schemes that define standards and evaluation methodology and only recognise certain certification bodies within their own territory. Therefore, mandatory certifications which may introduce economic/administrative burdens could be limited by relying on voluntary schemes, which provide greater industry flexibility and rely on a lightweight system to demonstrate to their customers the security level of the products they market.
Against this background, labelling schemes without a sound legal and mandatory framework may lose their purpose in terms of trust and reliability. In fact, the deficiency of such non-legislative policy measures depends on the good will of the industry that adopt such measures and on the likelihood of providing trusted and reliable information to the users.
Labelling also depends on the user perception and quality of information. In fact, for the end-user such labels may lead to more confusion. If the label is too simple, the user could misunderstand the corresponding information. If the label is too complex, the user could be unable to understand it. With respect to business-to-business, marketing the impact of voluntary labelling may not be the most conducive argument in reducing market fragmentation and information asymmetry. When having to purchase very high quantity of products the certification behind the label and the security specifications of the product may be considered more important.
5.4Policy Option 2: EU legislative act to extend SOG-IS agreement to all MS
To face the challenges of market fragmentation and information asymmetry in the ICT security sector the option of extending the SOG-IS agreement to all EU member states did not receive support from any of the interviewees.
The reasons are varied. For Smart meters industry representatives, decision-making between all EU countries may be too burdensome. At the moment SOG-IS goes up to EAL-4 and up to EAL-7 for specific domains. The challenge with SOG-IS is the unanimity of the Member State.
One critique addressed to the extension of the SOG-IS is that the agreement is based on the Common Criteria, which is not the right solution for ICS at the moment (please refer to Annex 7.4 for a developed overview of the criticism of the Common Criteria). Common Criteria costs 500k and lasts more than one year, which is a problem for a vendor. Common Criteria may be a good approach for some kinds of components and products. When the lifecycle of a product is longer than 20 years, we have to find approaches at a system level based on procedures and self-declaration.
The extension of SOG-IS agreement to all MS is not a valid policy option to be considered since there are Member States which are too small and for which the start-up and maintenance of a Certification Authority may be too costly. Not all countries have the ability to join the SOG-IS agreement. Therefore, there is a question of trust between governments. Procedures in France may receive more trust compared to certification procedure in other countries, making their activities superfluous and too costly.
5.5Policy Option 3: EU general ICT security certification and labelling framework
According to the opinions provided by stakeholders interviewed, an EU ICT certification scheme could be a valuable policy options to face the challenges of market fragmentation and information asymmetry of ICT security products.
Representatives from ICT Certification Authority claims that there is an urgent need to establish a proper EU framework that will analyse, select and improve, where necessary, the acceptable approaches for EU wide certification, and will rationalize the certification decisions for both MSs and industry. Harmonizing will only be possible through technical exchanges between the MSs Schemes, which obviously relies on open certification approaches.
The interviewees from ICT Certification Authority think that a mutual recognition agreement of certification schemes existing in different countries have indeed a positive impact on industry costs. As remarked by the Certification Authorities, obviously a recognition agreement would eliminate the need and cost of re-certification in the domain covered by the agreement.
For Smart meters industry representatives it would be welcome to have one methodology on how you asses the risk, how you define security requirements and how you go through certification and a recognition across Europe. It is very important to have flexibility in certification scheme, determine on the risk connected to the product evaluated and the risk connected to the location of the product. Moreover, if MS continue not to accept each other Certification schemes, each MS will continue to improve its own Certification scheme and this will create a strong legacy to be later overcome in order to introduce a general EU framework.
Questions were also addressed on the institutional responsibilities that an EU management board of a possible EU wide certification framework would have. An interviewee explained that ENISA could play a role within industries to help to understand the concerns of the different national agencies. For smart-metering industry representatives, ENISA can play a key a role to harmonize Members States’ Agencies on definition of national requirements and assurance, by making sure that the solutions meet the needs of the industry. ENISA should also cooperate with European and international standardisation institutions. Working with ENISA, it would be important to understand and harmonize the security language of the energy sector, in order to understand each other complementing both energy and smart-meters sectors. Therefore, representative from Smart meters industry explained it would be important to combine the approach of DG CNECT with the approach of DG ENERGY.
5.6Institutional costs
Insights from the interviews to representatives of national ICT Certification Authorities as well as desk research on start-up and maintenance costs of institutions similar to ENISA have been done to provide the following estimates:
- Costs incurred by an IT Certification Authority for the participation in the SOG-IS MRA
- Costs incurred for the start-up of an IT Certification Authority
- Costs incurred for the operational management of an IT Certification Authority
- Costs estimated for the start-up of an EU wide ICT framework management board (6 months)
- Costs estimated for the running of an EU wide ICT framework management board
These estimates are supported by a separate excel file listing the data entries and underlying calculations presented below in a more extended and narrative mode.
1.2.1.Costs incurred by an organization for the participation in the SOG-IS MRA
In relation to the costs incurred by an organization for the participation in the SOG-IS agreement the consortium asked its interviewees to provide the related break down of costs such as the ones to support harmonization activities and to participate into SOG-IS technical meetings.
Representative from National Certification Authority explained that MC meetings take place 1-2 times per year and the JIWG meetings 3-4 times per year respectively. The interviewee explained that on average the yearly travelling costs for three members attending six meetings are approximately 33 thousand euros. In addition, for the preparation of meetings, attendance and national reporting the personnel cost estimated for 0,5 FTE of an Assistant is approximately 25 thousand euros.
Therefore, for one of the Certification Authority that were interviewed the costs incurred for the participation in the SOG-IS MRA are approximately 58 thousand euros.
1.2.2.Costs incurred for the start-up of an IT Certification Authority
Secondly, the consortium aimed at gathering data on the costs incurred for the start-up of an IT Certification Authority such as the costs related to staff competence building on ICT security certification, process setup, accreditation of Conformity Assessment Body and institutional communication etc.)
However for one of the interviewees it was impossible to provide any cost estimate for the start-up of the ICT Certification Authority as it was were created long time ago and most of the personnel initially involved is no longer operative. Moreover, in some cases, analytical cost records on IT Certification Authorities creation were not collected. However, the interviewee stated that the most time-consuming activities were related to drafting of IT Certification Authorities procedures and overall organization compliant to mandate received from the Government law and international standards.