An Overview - From Identification to Authorization (and General Data Protection Regulation (GDPR))

1. IT SECURITY – AN OVERVIEW
INSPIRATION FROM
ISO 2700X - DR. DANIEL SOPER – ”NYE SIKKERHEDSMODELLER” - GDPR
LARS KRAG KONGSGAARD - SENIOR PROJECT MANAGER 1

2. IT SECURITY
• Tenets
• Threats
• Attacks
• Availability
• Cryptographic
• Monitoring
• Roles
• Access Models
• Recovery
• Continuity
• Medias
• Platform
• Points
• Nodes
• Devices
• Protocols
• Segmentations
• Detection
• Controls
• Changes
• Configurations
• Incidents
• Assessments
• Risk
Management
• Applications
• Databases
• Devices
• Networks
• Operating
Systems
• Configurations
• End Points
• Health
• Safety
• Environment
• Surveillance
• Control
• Deterrence
• Site
• Barriers
• Mounting
• Cooling
• Power
• Transmission
Essentials Architecture Governance Hardening Physics
LARS KRAG KONGSGAARD - SENIOR PROJECT MANAGER 2

3. NEW PARADIGM -
FROM IDENTIFICATION TO AUTHORIZATION
• Authorization based on validation
• Prevention based on segmentation
• Security by design
• Privacy by design
• Credentials depending on Context
LARS KRAG KONGSGAARD - SENIOR PROJECT MANAGER 3

4. NEW MODELS FOR SECURITY
FROM IDENTIFICATION TO AUTHORIZATION
• Properties
• Authentication
• Responsibility
• Communication
Channel
• Integrity
• Responsibility
• Role
• Information
• Validity
• Private Key
• Authorization
per transaction
• Pseudonyms
• Authorization
disconnection
from
Identification
• Semantic
Interoperability
• Stakeholder
Segmentation
• Stakeholder-
based
Metadata
• Implicit - no
action for User
• Context
dependent
Credentials
• Transaction
Segmentation
• Information
disclosure based
on need
• Purpose-specific
Keys
• Transaction
Context
• Transparency
• User control
• Consent
• Code of conduct
• Virtual Identity
• Information
Level
Negotiation
• Data Enrichment
Control
• Positive
Properties
• Negative
Properties
• Holder
• Situation
• Issuer
• Usage
• Protocol
• Selective
Disclosure
• Undeniability
• Verifiable
Encryption
Authorization Prevention
Privacy by
Design
Security by
Design
Credentials
LARS KRAG KONGSGAARD - SENIOR PROJECT MANAGER 4

5. ENHANCED GENERAL DATA PROTECTION REGULATION
(GDPR) AGREED BY EUROPEAN PARLIAMENT.
• Deadline: GDPR compliance before May 25, 2018
• Failure: GDPR compliance failure subject to penalties and fines
• Application: European Union (consumer and personal data across EU nations)
• Key Requirements for GDPR privacy and data protection:
• Consent of subjects for data processing
• Privacy Protection by means of Anonymizing collected data
• Data breach notifications
• Safe transfer of data across borders
• Appointment of officer for GDPR compliance data protection for certain companies
LARS KRAG KONGSGAARD - SENIOR PROJECT MANAGER 5