Laut einem Artikel auf Heise ist der Elektronischer Personalausweis sicher

Das Bundesamt für Sicherheit in der Informationtechnik (BSI) hat nach einer Pressemitteilung zusammen mit dem Center for Advanced Security Research Darmstadt (CASED) die Sicherheit des PACE-Verfahrens festgestellt. PACE ist das von Patentansprüchen freie Authentifizierungsverfahren (“Password Authentication Connection Establishment”), das den künftigen elektronischen Personalausweis sichern wird. Langfristig soll PACE außerdem die Basic Access Control beim elektronischen Reisepass ersetzen.

Heute habe ich gleich mehrere interessante Artikel bei der BBC gefunden, die sich mit cyber crime, cyber security und cyber war befassen. Klar schein, dass sogenannte cyber-attacks zunehmen und mittlerweile ein Ausmaß an Größe und Professionalität erreicht haben die nicht nur großen wirtschaftlichen Schaden verursachen kann sondern darüber hinaus auch die militärische und administrative Sicherheit ganzer Nationen bedroht. Angriff oder Verteidigung? – Noch scheint Uneinigkeit unter Geheimdiensten, Militärstrategen und Computerexperten über mögliche Strategien zu herrschen.

• US cyber-security ‘embarrassing’

America’s cyber-security has been described as “broken” by one industry expert and as “childlike” by another. The criticism comes as President Obama prepares to release the results of a review he had ordered. Tim Mather, chief strategist for security firm RSA, told BBC News: “The approach we have relied on for years has effectively run out of steam.”

• US ‘should go on cyber-offensive’

A US Air Force officer has told the BBC that his country should create an offensive botnet to target any forces that launch a cyber-attack against it. Speaking on Radio 4′s The Report, Col Charlie Williamson said the US was currently in “defensive mode” on cyber-warfare and that needed to change. Col Williamson – who served with the US Air Force Intelligence, Surveillance and Reconnaissance Agency – says that the US military should be ready to take such an attack to the enemy.”The idea is that if we have the capability to strike back, then a potential attacker has to take that into account before launching an attack.”

• Call to rally against cyber crime

Security professionals are being called on to band together to fight the highly organised cyber criminals of the world. The call was made at a San Francisco conference organised by security firm RSA – the largest event of its kind. RSA President Art Coviello said the online fraudsters “are not bound by any rules of law” and “control massive armies of zombie computers”.

Earlier this week the British former Home Secretary David Blunkett warned of the danger of a cyber attack on the 2012 Olympics, but how big is the risk? Ben Hammersley, of BBC Radio 4′s The Report, assesses the cyber threat from terrorists.

Digitale Selbstverteidigung? Klingt auf deutsch etwas sonderbar, dennoch ist es genau das worum es bei der neuen Kampagne der Electronic Frontier Foundation geht:

“Die Electronic Frontier Foundation hat die Website Surveillance Self-Defense gestartet mit dem Ziel die amerikanische Öffentlichkeit über Gesetze und Technologien aufzuklären, die in den USA für Überwachung durch die Regierung genutzt werden, um Informationen und Methoden zur Verfügung zu stellen, die nötig sind, um das Ausmaß an Bedrohung durch Überwachung einschätzen zu können und die notwendigen Maßnahmen zu ergreifen, um sich zu verteidigen.” Übersetzt von Anne Roth auf Annalist.

• Risk Management
• Data Stored on Your Computer
• Data on the Wire
• Information Stored By Third Parties
• Foreign Intelligence and Terrorism Investigations
• Defensive Technology

Na prima! Was sind schon die Datenskandälchen bei der Deutschen Bahn gegen die massive Bedrohung durch “Cybercrime”  auch bekannt als “gelbe Gefahr”. So oder so ähnliche Stimmungen werden jedenfalls derzeit durch Meldungen in der Presse hervorgerufen.

Major cyber spy network uncovered

An electronic spy network, based mainly in China, has infiltrated computers from government offices around the world, Canadian researchers say. They said the network had infiltrated 1,295 computers in 103 countries.

In der NYT kann man dazu lesen:

Vast Spy System Loots Computers in 103 Countries

A vast electronic spying operation has infiltrated computers and has stolen documents from hundreds of government and private offices around the world, including those of the Dalai Lama, Canadian researchers have concluded. In a report to be issued this weekend, the researchers said that the system was being controlled from computers based almost exclusively in China, but that they could not say conclusively that the Chinese government was involved.

Und bei Heise heißt es:

Britische Geheimdienste warnen vor möglichen chinesischen Cyber-Angriffen

Während aus Kanada die Analysen über das “Ghostnet” kommen, das auch Regierungsrechner infiziert haben soll, warnen britische Geheimdienste, dass China die Möglichkeit erlangt haben könnte, wichtige Infrastruktur in Großbritannien wie Telekommunikationsnetze oder Stromversorgung lahmzulegen. Nach einem vertraulichen Bericht, von dem die Times berichtet, könnte vor allem das neue Kommunikationsnetzwerk von BT gefährdet sein. Die Geheimdienste vermuten, dass Techniken vom chinesischen Telekomkonzern Huawei benutzt werden könnten, um Störungen zu verursachen. Von diesem stammen zentrale Bestandteile des 10 Milliarden Pfund teuren Netzwerks. Zwar habe BT Vorkehrungen vor Angriffen von Hackern oder dem organisierten Verbrechen getroffen, aber diese könnten möglicherweise keinen Schutz “vor gezielten Angriffen durch China” bilden.

Haben Sie ein Facebook Benutzerkonto? Haben Sie sich schon einmal darüber Gedanken gemacht, welche personenbezogenen Daten dort über sie öffentlich zugänglich sind? Einen sehr schöne, detaillierte Zusammenfassung mit 10 Empfehlungen zu Privatsphäre und Sicherheit von Nick O’Neill: 10 Privacy Settings Every Facebook User Should Know

I figured that many people would benefit from a thorough overview on how to protect your privacy on Facebook. Below is a step by step process for protecting your privacy. “The best way to prevent embarrassing items from showing up on Facebook in the future is to not make bad judgements in your personal life.”

1. Use Your Friend List
2. Remove Yourself From Facebook Search Results
3. Remove Yourself From Google
4. Avoid the Infamous Photo/Video Tag Mistake
5. Protect Your Albums
6. Prevent Stories From Showing Up in Your Friends’ News Feeds
7. Protect Against Published Application Stories
8. Make Your Contact Information Private
9. Avoid Embarrassing Wall Posts
10. Keep Your Friendships Private

Einen wunderschönen Essay über den “Preis der Angst vor dem Fremden” haben die Freakonomics in ihrem Blog bei der New York Times geschrieben. Darin stellen sie die Frage “warum Menschen das ihnen Unbekannte / Fremde mehr fürchten als ihnen bekannte Gefahren und Risiken”, selbst wenn diese viel konkreter sind oder eine viel realere Bedrohung für eine Person oder eine Gesellschaft darstellen. Es geht also letztlich um die psychologische Rezeption von “Bedrohung” und darum wie wir damit umgehen.  

As we wrote in Freakonomics, most people are pretty terrible at risk assessment. They tend to overstate the risk of dramatic and unlikely events at the expense of more common and boring (if equally devastating) events. A given person might fear a terrorist attack and mad cow disease more than anything in the world, whereas in fact she’d be better off fearing a heart attack (and therefore taking care of herself) or salmonella (and therefore washing her cutting board thoroughly). Why do we fear the unknown more than the known? That’s a larger question than I can answer here (not that I’m capable anyway), but it probably has to do with the heuristics — the shortcut guesses — our brains use to solve problems, and the fact that these heuristics rely on the information already stored in our memories. And what gets stored away? Anomalies — the big, rare, “black swan” events that are so dramatic, so unpredictable, and perhaps world-changing, that they imprint themselves on our memories and con us into thinking of them as typical, or at least likely, whereas in fact they are extraordinarily rare.

Bruce Schneider sagt dazu in “The Cost of Fearing Strangers”

Nothing I haven’t said before. Remember, if it’s in the news don’t worry about it. The very definition of news is “something that almost never happens.” When something is so common that it’s no longer news—car crashes, domestic violence—that’s when you should worry about it.

Microsoft Senior Security Strategist Steve Riley stellt sich die Frage: Why Identity and Authentication Must Remain Distinct? Dabei nimmt der zunächst die Begriffe und Konzepte von Identity, Authentication und Authorization unter die Lupe.

I would like to explore the concepts of identity, authentication, and authorization, to help you understand their important distinctions, and to help guard you against the increasingly common tendency to combine the first two.

Normalerweise würde ein “Microsoft Senior Security Strategist” bei den meisten Sicherheitsbewussten Computerenthusiasten unter die Rubrik “Klassenfeind” fallen. Dennoch ganz interessant zu lesen wie die so ticken.

Identity. A security principal (you or a computer, typically) wants to access a system. Because the system doesn’t know you yet, you need to make a declaration of who you are. Your answer to the question “Who are you” is the first thing you present to a system when you want to use it. Some common examples of identity are user IDs, digital certificates (which include public keys), and ATM cards. A notable characteristic of identity is that it is public, and it has to be this way: identity is your claim about yourself, and you make that claim using something that’s publicly available. Authentication. This is the answer to the question “OK, how can you prove it?” When you present your identity to a system, the system wants you to prove that it is indeed you and not someone else. The system will challenge you, and you must respond in some way. Common authenticators include passwords, private keys, and PINs. Whereas identity is public, authentication is private: it’s a secret known (presumably) only by you. In some cases, like passwords, the system also knows the secret. In other cases, like PKI, the system doesn’t need to possess the secret, but can validate its authenticity (this is one of many reasons why PKI is superior). Your possession of this secret is what proves that you are who you claim to be. Authorization. Once you’ve successfully authenticated yourself to a system, the system controls which resources you’re allowed to access. Typically this is through the use of a token or ticket mechanism. The token or ticket constrains your ability to roam freely throughout the system. By “caching” your authenticated identity for subsequent access control decisions, it allows you to access only that which the administrators have determined is necessary, thus enforcing the principle of least privilege.