Inlägg publicerade under kategorin ‽IT

:

Kommentera
Av Svenn Dybvik - 11 juni 2023 00:00

Personopplysningsloven (utdrag)

https://lovdata.no/dokument/NL/lov/2018-06-15-38/*#*

https://lovdata.no/dokument/NL/lov/2018-06-15-38/KAPITTEL_gdpr-3-4#KAPITTEL_gdpr-3-4

https://lovdata.no/dokument/NL/lov/2018-06-15-38/KAPITTEL_gdpr-3-3#KAPITTEL_gdpr-3-3

https://lovdata.no/dokument/NL/lov/2018-06-15-38/KAPITTEL_gdpr-3-2#KAPITTEL_gdpr-3-2




Lov om behandling av personopplysninger (personopplysningsloven)

EUROPAPARLAMENTS- OG RÅDSFORORDNING (EU) 2016/679 av 27. april 2016 om vern av fysiske personer i forbindelse med behandling av personopplysninger og om fri utveksling av slike opplysninger samt om oppheving av direktiv 95/46/EF (generell personvernforordning) [PVF, GDPR]




KAPITTEL III Den registrertes rettigheter

Avsnitt 3 Retting og sletting


Artikkel 16.Rett til retting

Den registrerte skal ha rett til å få uriktige personopplysninger om seg selv rettet av den behandlingsansvarlige uten ugrunnet opphold. Idet det tas hensyn til formålene med behandlingen skal den registrerte ha rett til å få ufullstendige personopplysninger komplettert, herunder ved å framlegge en supplerende erklæring.


Artikkel 17.Rett til sletting («rett til å bli glemt»)

1. Den registrerte skal ha rett til å få personopplysninger om seg selv slettet av den behandlingsansvarlige uten ugrunnet opphold, og den behandlingsansvarlige skal ha plikt til å slette personopplysninger uten ugrunnet opphold dersom et av de følgende forhold gjør seg gjeldende:

a.personopplysningene er ikke lenger nødvendige for formålet som de ble samlet inn eller behandlet for,

b.den registrerte trekker tilbake samtykket som ligger til grunn for behandlingen, i henhold til artikkel 6 nr. 1 bokstav a) eller artikkel 9 nr. 2 bokstav a), og det ikke finnes noe annet rettslig grunnlag for behandlingen,

c.den registrerte protesterer mot behandlingen i henhold til artikkel 21 nr. 1, og det ikke finnes mer tungtveiende berettigede grunner til behandlingen, eller den registrerte protesterer mot behandlingen i henhold til artikkel 21 nr. 2,

d.personopplysningene er blitt behandlet ulovlig,

e.personopplysningene må slettes for å oppfylle en rettslig forpliktelse i unionsretten eller medlemsstatenes nasjonale rett som den behandlingsansvarlige er underlagt,

f.personopplysningene er blitt samlet inn i forbindelse med tilbud om informasjonssamfunnstjenester som nevnt i artikkel 8 nr. 1.

2. Dersom den behandlingsansvarlige har offentliggjort personopplysningene og i henhold til nr. 1 har plikt til å slette personopplysningene, skal vedkommende, idet det tas hensyn til tilgjengelig teknologi og gjennomføringskostnadene, treffe rimelige tiltak, herunder tekniske tiltak, for å underrette behandlingsansvarlige som behandler personopplysningene, om at den registrerte har anmodet om at nevnte behandlingsansvarlige skal slette alle lenker til, kopier eller reproduksjoner av nevnte personopplysninger.

3. Nr. 1 og 2 får ikke anvendelse dersom nevnte behandling er nødvendig

a.for å utøve retten til ytrings- og informasjonsfrihet,

b.for å oppfylle en rettslig forpliktelse som krever behandling i henhold til unionsretten eller medlemsstatenes nasjonale rett som den behandlingsansvarlige er underlagt, eller for å utføre en oppgave i allmennhetens interesse eller utøve offentlig myndighet som den behandlingsansvarlige er pålagt,

c.av hensyn til allmennhetens interesse på området folkehelse i samsvar med artikkel 9 nr. 2 bokstav h) og i) og artikkel 9 nr. 3,

d.for arkivformål i allmennhetens interesse, for formål knyttet til vitenskapelig eller historisk forskning eller for statistiske formål i samsvar med artikkel 89 nr. 1 i den grad rettigheten nevnt i nr. 1 sannsynligvis vil gjøre det umulig eller i alvorlig grad vil hindre at målene med nevnte behandling nås, eller

e.for å fastsette, gjøre gjeldende eller forsvare rettskrav.

Artikkel 18.Rett til begrensning av behandling

1. Den registrerte skal ha rett til å kreve av den behandlingsansvarlige at behandlingen begrenses dersom et av de følgende forhold gjør seg gjeldende:

a.den registrerte bestrider riktigheten av personopplysningene, i en periode som gjør det mulig for den behandlingsansvarlige å kontrollere riktigheten av personopplysningene,

b.behandlingen er ulovlig og den registrerte motsetter seg sletting av personopplysningene og isteden anmoder om at bruken av personopplysningene begrenses,

c.den behandlingsansvarlige ikke lenger trenger personopplysningene til formålet med behandlingen, men den registrerte har behov for disse for å fastsette, gjøre gjeldende eller forsvare rettskrav,

d.den registrerte har protestert mot behandling i henhold til artikkel 21 nr. 1 i påvente av kontrollen av om hvorvidt den behandlingsansvarliges berettigede grunner går foran den registrertes.

2. Dersom behandlingen er blitt begrenset i henhold til nr. 1, skal slike personopplysninger, bortsett fra lagring, bare behandles med den registrertes samtykke eller for å fastsette, gjøre gjeldende eller forsvare rettskrav eller for å verne en annen fysisk eller juridisk persons rettigheter eller av hensyn til viktige allmenne interesser i Unionen eller en medlemsstat.

3. En registrert som har oppnådd begrensning av behandlingen i henhold til nr. 1, skal underrettes av den behandlingsansvarlige før nevnte begrensning av behandlingen oppheves.

Artikkel 19.Underretningsplikt i forbindelse med retting eller sletting av personopplysninger eller begrensning av behandling

Den behandlingsansvarlige skal underrette enhver mottaker som har fått utlevert personopplysninger, om enhver retting eller sletting av personopplysninger eller begrensning av behandlingen utført i samsvar med artikkel 16, artikkel 17 nr. 1 og artikkel 18, med mindre dette viser seg å være umulig eller innebærer en uforholdsmessig stor innsats. Den behandlingsansvarlige skal underrette den registrerte om nevnte mottakere dersom den registrerte anmoder om det.


Artikkel 20.Rett til dataportabilitet

1. Den registrerte skal ha rett til å motta personopplysninger om seg selv som vedkommende har gitt til en behandlingsansvarlig, i et strukturert, alminnelig anvendt og maskinlesbart format og skal ha rett til å overføre nevnte opplysninger til en annen behandlingsansvarlig uten at den behandlingsansvarlige som personopplysningene er gitt til, hindrer dette, dersom

a.behandlingen er basert på samtykke i henhold til artikkel 6 nr. 1 bokstav a) eller artikkel 9 nr. 2 bokstav a) eller en avtale i henhold til artikkel 6 nr. 1 bokstav b), og

b.behandlingen utføres automatisk.

2. Når den registrerte utøver sin rett til dataportabilitet i henhold til nr. 1, skal vedkommende, når det er teknisk mulig, ha rett til å få overført personopplysningene direkte fra en behandlingsansvarlig til en annen.

3. Utøvelse av rettigheten nevnt i nr. 1 i denne artikkel berører ikke artikkel 17. Nevnte rettighet får ikke anvendelse på behandling som er nødvendig for å utføre en oppgave i allmennhetens interesse eller utøve offentlig myndighet som den behandlingsansvarlige er pålagt.

4. Rettigheten nevnt i nr. 1 skal ikke ha negativ innvirkning på andres rettigheter og friheter.

 

 

 

 

 

 

Personopplysningsloven (utdrag)

https://lovdata.no/dokument/NL/lov/2018-06-15-38/*#*

https://lovdata.no/dokument/NL/lov/2018-06-15-38/KAPITTEL_gdpr-3-4#KAPITTEL_gdpr-3-4

https://lovdata.no/dokument/NL/lov/2018-06-15-38/KAPITTEL_gdpr-3-3#KAPITTEL_gdpr-3-3

https://lovdata.no/dokument/NL/lov/2018-06-15-38/KAPITTEL_gdpr-3-2#KAPITTEL_gdpr-3-2




Lov om behandling av personopplysninger (personopplysningsloven)

EUROPAPARLAMENTS- OG RÅDSFORORDNING (EU) 2016/679 av 27. april 2016 om vern av fysiske personer i forbindelse med behandling av personopplysninger og om fri utveksling av slike opplysninger samt om oppheving av direktiv 95/46/EF (generell personvernforordning) [PVF, GDPR]




KAPITTEL III Den registrertes rettigheter

Avsnitt 4 Rett til å protestere og automatiserte individuelle avgjørelser


Artikkel 21.Rett til å protestere

1. Den registrerte skal til enhver tid, av grunner knyttet til vedkommendes særlige situasjon, ha rett til å protestere mot behandling av personopplysninger om vedkommende, og som har grunnlag i artikkel 6 nr. 1 bokstav e) eller f), herunder profilering med grunnlag i nevnte bestemmelser. Den behandlingsansvarlige skal ikke lenger behandle personopplysningene, med mindre vedkommende kan påvise at det foreligger tvingende berettigede grunner for behandlingen som går foran den registrertes interesser, rettigheter og friheter, eller for å fastsette, gjøre gjeldende eller forsvare rettskrav.

2. Dersom personopplysninger behandles med henblikk på direkte markedsføring, skal den registrerte til enhver tid ha rett til å protestere mot behandling av personopplysninger som angår vedkommende, til slik markedsføring, herunder profilering i den grad dette er knyttet til direkte markedsføring.

3. Dersom den registrerte protesterer mot behandling med henblikk på direkte markedsføring, skal personopplysningene ikke lenger behandles for slike formål.

4. Senest på tidspunktet for den første kommunikasjonen med den registrerte skal vedkommende uttrykkelig gjøres oppmerksom på rettigheten nevnt i nr. 1 og 2, og informasjon om nevnte rettighet skal framlegges på en klar måte og atskilt fra annen informasjon.

5. I forbindelse med bruk av informasjonssamfunnstjenester og uten hensyn til direktiv 2002/58/EF kan den registrerte utøve sin rett til å protestere ved hjelp av automatiserte midler ved bruk av tekniske spesifikasjoner.

6. Dersom personopplysninger behandles for formål knyttet til vitenskapelig eller historisk forskning eller for statistiske formål i henhold til artikkel 89 nr. 1, har den registrerte, av grunner knyttet til vedkommendes særlige situasjon, rett til å protestere mot behandling av personopplysninger om vedkommende, med mindre behandlingen er nødvendig for å utføre en oppgave i allmennhetens interesse.

Artikkel 22.Automatiserte individuelle avgjørelser, herunder profilering

1. Den registrerte skal ha rett til ikke å være gjenstand for en avgjørelse som utelukkende er basert på automatisert behandling, herunder profilering, som har rettsvirkning for eller på tilsvarende måte i betydelig grad påvirker vedkommende.

2. Nr. 1 får ikke anvendelse dersom avgjørelsen

a.er nødvendig for å inngå eller oppfylle en avtale mellom den registrerte og en behandlingsansvarlig,

b.er tillatt i henhold til unionsretten eller medlemsstatenes nasjonale rett som den behandlingsansvarlige er underlagt, og der det også er fastsatt egnede tiltak for å verne den registrertes rettigheter, friheter og berettigede interesser, eller

c.er basert på den registrertes uttrykkelige samtykke.

3. I tilfellene nevnt i nr. 2 bokstav a) og c) skal den behandlingsansvarlige gjennomføre egnede tiltak for å verne den registrertes rettigheter og friheter og berettigede interesser, i det minste retten til menneskelig inngripen fra den behandlingsansvarlige, til å uttrykke sine synspunkter og til å bestride avgjørelsen.

4. Avgjørelsene nevnt i nr. 2 skal ikke bygge på særlige kategorier av personopplysninger nevnt i artikkel 9 nr. 1, med mindre artikkel 9 nr. 2 bokstav a) eller g) får anvendelse og det er innført egnede tiltak for å verne den registrertes rettigheter, friheter og berettigede interesser.

Allmänt · ‽IT · ∴ · interrobangit · § · §IT
Dela · Kommentera  

:

Kommentera
Av Svenn Dybvik - 4 juni 2023 00:00

https://nettvett.no/veiledninger/sikkerhet-i-virksomheter/sikkerhetsledelse/



Sikkerhetsledelse

Håndbok for informasjonssikkerhet

Dette er et eksempel på hvordan du kan lage en enkel håndbok for informasjonssikkerhet til bruk i små og mellomstore virksomheter. Dokumentet kan brukes av bedrifter, kommuner og frivillige organisasjoner for å lage et eget sikkerhetsregelverk. Bytt da ut “Virksomheten” med navnet på din virksomhet.

Slik beskytter du virksomheten mot de vanligste digitale truslene

Lammende løsepengevirus, ødeleggende verdikjedeangrep, altfor vanlige kontokapringer og utspekulert økonomisk svindel. Slik beskytter du din virksomhet mot de vanligste digitale truslene.

Krise- og beredskapsplan

En krise for en virksomhet er når det skjer en hendelse som kan føre til en stor fare for virksomhetens eksistens. Det kan eksempelvis være store økonomiske tap, tap av omdømme eller skade på ansatte. Virksomheter som best kommer gjennom en krise er de som på forhånd har en krise- og beredskapsplan, som trener på denne så de får erfaring med at den virker.

Jobb trygt på hjemmekontoret

I det øyeblikket noen tar med en jobb-PC ut av kontoret, men fortsetter å jobbe mot virksomhetens løsninger, oppstår det en rekke sikkerhetsutfordringer. Vi vet at mange virksomheter ikke har regler for hjemmekontor eller har gitt sine ansatte god nok opplæring i hvordan de skal jobbe utenfor kontoret. Hvordan bør en arbeidsgiver tilrettelegge for hjemmekontor og hva må en ansatt huske på når han eller hun jobber hjemmefra?

Cyberforsikring

Flere forsikringsselskaper gir tilbud om å etablere cyberforsikring til sine bedriftskunder. For personkunder er det ikke like stort utvalg, og de fleste forsikringsselskaper har for personkunder inkludert noe dekning for cyberhendelser i sine innbo-forsikringer.

Mal for informasjonssikkerhetspolicy

Denne veiledningen er en mal for hvordan små og mellomstore bedrifter kan lage sin informasjonssikkerhetspolicy.

Hendelseshåndtering

Alle vil før eller siden oppleve en uønsket hendelse knyttet til sine digitale enheter eller systemer. Da er det viktig å ha tenkt gjennom hvordan man skal håndtere slike hendelser. De som har en strukturert tilnærming til hendelseshåndtering kommer raskere tilbake til normaltilstand, og får redusert konsekvensene av hendelsen sammenlignet med andre.

Sikkerhet på reise i utlandet

Når du er på reise i utlandet er trusselbildet litt annerledes en det er på reise i Norge. De vanlige reiserådene kan også brukes i utlandet, men det er mer å tenke på. I denne veiledningen forklarer vi hvorfor, og hvordan du håndterer det.

Sikkerhetssjekk for virksomheter

Nettvett.no sin Sikkerhetssjekk gir deg muligheten til å sjekke hvilke sikringstiltak din virksomhet har iverksatt innen informasjonssikkerhet

Digital sikkerhetskultur

Den kulturen vi er en del av til enhver tid gir oss et sett av verdier…

Verdt å vite om personvern

Retten til privatliv har en verdi som er vanskelig å måle. Mange av oss ser verdien først når opplysninger om oss havner på avveier og vi opplever at integriteten vår er truet.

Virksomheters sikkerhet i sosiale medier

Alle virksomheter i Norge har en viss tilstedeværelse på nett, og mange velger å være aktive på sosiale medier. I denne veiledningen forklarer vi hva virksomheter bør være oppmerksomme på for å holde seg sikre på sosiale medier.

Økonomisk svindel rettet mot bedrifter

Norske virksomheter, spesielt små og mellomstore bedrifter, er yndede mål for cyberkriminelle som er ute etter penger. I denne veiledningen går vi gjennom noen av de vanligste svindelmetodene for tiden, og hva du kan gjøre for å beskytte deg og din virksomhet.

Internkontroll i praksis – informasjonssikkerhet

Systematisk internkontroll er pålagt offentlige virksomheter. Det er en forutsetning for at virksomhetene skal nå sine mål.

Planlegging og gjennomføring av IKT-øvelser

I denne veiledningen ser vi nærmere hvordan man kan gå fram for å øve på håndtering av IKT-hendelser.

Veiledning for IT-outsourcing

IT-outsourcing innebærer å sette ut en eller flere IT-funksjoner og/eller tjenester i en virksomhet til en eller flere eksterne leverandører isteden for å drive disse selv.

Retningslinjer for Internett og E-post

Denne veiledningen gir eksempler på retningslinjer som kan benyttes internt i en virksomhet. Det anbefaler at punktene gjennomgås med tanke på endringer og tillegg, slik at de tilpasses virksomheten best mulig.

Personellsikkerhet

Lojale medarbeidere er en forutsetning for å oppnå tilfredsstillende sikkerhet. Målet med personellsikkerhet er å sikre at ansatte, kontraktører og konsulenter forstår sitt ansvar og er egnet for rollen de er tiltenkt, og å redusere risikoen for tyveri, svindel eller misbruk av utstyr.

Eksempel på risikoanalyse for bedrift

OppOgFram er en mellomstor norsk produksjonsbedrift. Virksomheten er underleverandør til større virksomheter som igjen krever at alle sine underleverandører skal ha god sikkerhet. Som et ledd av det forlanges det at OppOgFram skal gjennomføre en risikovurdering mtp. informasjonssikkerhet.

Eksempel på risikoanalyse for en kommune

Hjemstedet er en gjennomsnittlig norsk kommune. Informasjonssikkerhet har en ikke spesielt fokus på i det daglige, men IT-avdelingen til kommunen har snakket en stund om at man burde gjøre en risikovurdering i tråd med kravet fra internkontrollforskriften. Rådmannen er ansvarlig for informasjonssikkerheten i kommunen, og er også den som skal ta avgjørelser når det gjelder hvor mye risiko man kan akseptere, og dertil hvilke sikkerhetstiltak en skal prioritere. Lederen for IT-avdelingen tar imidlertid jobben med å starte arbeidet med risikovurderingen. Ansatte i administrasjonen og fag­syste­mene blir involvert sporadisk i arbeidet.

Informasjonssikkerhetspolicy

Denne veiledningen gir en forklaring på hva en informasjonssikkerhetspolicy er og hva en bør tenke på når en virksomhet skal lage en informasjonssikkerhetspolicy.

Risikostyring

I denne veiledningen viser vi til formålet med risikostyring, hva risikostyring er og hvordan risikovurderinger kan gjennomføres og følges opp.

Sikkerhetsledelse

I denne veiledningen ser vi nærmere på ledelse av informasjonssikkerhetsarbeidet.

 

 

 

 

 

 

https://nettvett.no/veiledninger/

 

 


Veiledninger

 
 

Nettvett.no er et nettsted hvor man finner informasjon, råd og veiledninger om sikrere bruk av Internett. Informasjonen er rettet både mot enkeltpersoner fra barn til voksne, forbrukere og små og mellomstore bedrifter.


Sosiale medier

Facebook (Vis alle)


Instagram


Google


Apple


Dropbox


LinkedIn


Outlook/Hotmail


Snapchat






Sikring av datamaskin, mobil og nettbrett

Windows (Vis alle)


Apple (Vis alle)


Android (Vis alle)





Svindel på nett / ID-tyveri

ID-tyveri


Svindel (Vis alle)





Sikrere bruk

Internett (Vis alle)


Hjemme (Vis alle)


På reise





Sikkerhet i virksomheter

Drift (Vis alle)


Sikkerhetsledelse (Vis alle)





Nettbank og netthandel

Nettbank (Vis alle)


Netthandel





Foresatte og de som jobber med barn

Foresatte (Vis alle)


Jobber med barn (Vis alle)

Allmänt · ‽IT · ∴ · interrobangit · § · §IT
Dela · Kommentera  

:

Kommentera
Av Svenn Dybvik - 28 maj 2023 00:00

https://nettvett.no/personvern/

Verdt å vite om personvern

 

Retten til privatliv har en verdi som er vanskelig å måle. Mange av oss ser verdien først når opplysninger om oss havner på avveier og vi opplever at integriteten vår er truet.

Vi har alle noe vi ikke vil dele med andre. Ikke fordi det er ulovlig eller noe vi må skjule, men rett og slett fordi det er privat. Enkelt sagt handler personvern om retten til et privatliv og om retten til å bestemme over egne personopplysninger.

Hva er personopplysninger?

En personopplysning er en opplysning eller en vurdering som kan knyttes til en enkeltperson, slik som for eksempel (ikke uttømmende liste):

  • navn,
  • adresse,
  • telefonnummer,
  • e-postadresse,
  • IP-adresse,
  • bilnummer,
  • bilder,
  • fingeravtrykk,
  • irismønster,
  • DNA-profil,
  • hodeform (for ansiktsgjenkjenning), og
  • fødselsnummer (både fødselsdato og personnummer).

Opplysninger om atferdsmønstre er også regnet som personopplysninger. Opplysninger om hva du handler, hvilke butikker du går i, hvilke tv-serier du ser på, hvor du beveger deg i løpet av en dag og hva du søker etter på nettet er alt sammen personopplysninger. En av utfordringene for personvernet er at vi legger igjen så mange digitale spor. Disse opplysningene utnyttes ofte kommersielt uten at du har samtykket til det.

Sensitive personopplysninger er opplysninger om:

  • rasemessig eller etnisk bakgrunn, eller politisk, filosofisk eller religiøs oppfatning,
  • at en person har vært mistenkt, siktet, tiltalt eller dømt for en straffbar handling,
  • helseforhold,
  • seksuelle forhold, eller
  • medlemskap i fagforeninger.

Les mer her: Hva er personvern?

Felles europeisk personvernregelverk fra 2018

For å styrke tilliten til digitale tjenester og den individuelle innbyggers rettigheter, samt å gjøre det lettere å utveksle personopplysninger over landegrenser, startet EU i 2012 arbeidet med et felles europeisk personvernregelverk. Stikkordene de jobbet utfra var tillit, kontroll, sikkerhet og forenkling. I april 2016 vedtok EU sin personvernforordning; General Data Protection Regulation (GDPR). Den er EØS-relevant som betyr at den også er innført i Norge i 2018. Den norske Personopplysningsloven ble i 2018 justert slik at den innbefatter det europeiske regelverket.

Les mer her: Datatilsynet

De ti viktigste lovendringene fra 2018

Selv om mange av prinsippene i dagens lovverk videreføres, får norske virksomheter flere og strengere plikter enn før. Brudd på reglene kan også gi større økonomiske konsekvenser enn i dag. Dette er de ti viktigste endringene:

 

1. Alle norske virksomheter får nye plikter

Alle virksomheter må sette seg inn i den nye lovgivningen og finne ut hvilke nye plikter som gjelder dem. Ledelsen må sørge for å få på plass rutiner for å overholde de nye pliktene. Alle ansatte må følge de nye rutinene når reglene trer i kraft.

 

2. Alle skal gi god informasjon om hvordan de behandler personopplysninger

Informasjon om hvordan din virksomhet behandler personopplysninger skal være lett tilgjengelig og skrevet på en forståelig måte. Det nye lovverket stiller strengere krav til informasjonens form og innhold enn dagens lovgivning. All informasjon som gis til barn, skal tilpasses barnas forståelsesnivå.

 

3. Alle skal vurdere risiko og personvernkonsekvenser

Dersom et tiltak utgjør en stor risiko for personvernet, må virksomheten også utrede hvilke personvernkonsekvenser det kan ha. Hvis utredningen viser at risikoen er stor og dere selv ikke kan redusere den, skal Datatilsynet involveres i forhåndsdrøftelser.

 

4. Alle skal bygge personvern inn i nye løsninger

De nye reglene stiller krav til at nye tiltak og systemer skal utarbeides på en mest mulig personvernvennlig måte. Dette kalles innebygd personvern. Den mest personvernvennlige innstillingen skal være standard i alle systemer.

 

5. Mange virksomheter må opprette personvernombud

Alle offentlige og mange private virksomheter skal opprette personvernombud. Et personvernombud er virksomhetens personvernekspert, og et bindeledd mellom ledelsen, de registrerte og Datatilsynet. Ombudet kan være en ansatt eller en profesjonell tredjepart.

 

6. Reglene gjelder også virksomheter utenfor Europa

Virksomheter som holder til utenfor Europa må også følge forordningen, dersom de tilbyr varer eller tjenester til borgere i et EU- eller EØS-land. Dette gjelder også om de ikke direkte tilbyr tjenester, men kartlegger adferden til europeiske borgere på nett. De som er etablert i flere land i Europa, skal bare trenge å snakke med personvernmyndighetene i det landet der de har sitt europeiske hovedkvarter.

 

7. Alle databehandlere får nye plikter

Databehandlere er virksomheter som behandler personopplysninger på oppdrag fra den ansvarlige virksomheten. Ofte er det snakk om leverandører av IT-tjenester. De nye reglene pålegger databehandlere å ha rutiner for innsamling og bruk av personopplysninger. Databehandlere skal også si ifra til oppdragsgiveren sin hvis de får instrukser som er i strid med loven. Oppdragsgiver skal også godkjenne databehandlerens underleverandører. Databehandlere kan også bli holdt økonomisk ansvarlig sammen med oppdragsgiver.

 

8. Alle bør samarbeide i egne nettverk og følge bransjenormer

De nye reglene oppmuntrer til sektorvis utforming av retningslinjer og bransjenormer. Om dere følger bransjenormer, vil dere ha de viktigste rutinene på plass. Datatilsynet skal godkjenne bransjenormene.

 

9. Alle får nye krav til avvikshåndtering

Reglene for håndtering av sikkerhetsbrudd blir strengere. Forordningen stiller krav til når det skal varsles, hva varselet skal inneholde og hvem som skal varsles. Kort sagt skal man si fra raskere og oftere enn man gjør i dag.

 

10. Alle må kunne oppfylle borgernes nye rettigheter

Den enkeltes rett til å kreve at hans eller hennes personopplysninger slettes blir styrket. Dette kalles “retten til å bli glemt”. Norske og europeiske borgere vil blant annet kunne kreve å ta med seg personopplysningene sine fra en leverandør til en annen i et vanlig brukt filformat. Dette kalles “dataportabilitet”. De kan også motsette seg profilering. Alle henvendelser fra borgere skal besvares innen en måned.

 

 

Mer informasjon

Hva betyr de nye personvernreglene for din virksomhet?

Hvilke rettigheter har man som enkeltperson?

(Kilde: Datatilsynet)

 

 

 

 

 

 

https://www.datatilsynet.no/personvern-pa-ulike-omrader/internett-og-apper/rad-for-analyse-og-sporing-pa-nettsted/ 

 

Råd for analyse og sporing på nettsted

Det finnes mange analyse- og sporingsverktøy på markedet, men det betyr ikke nødvendigvis at det er lovlig å ta dem i bruk på nettstedet ditt. Her er noen råd på veien.


  1. Forhold deg til personvernforordningen (GDPR)

    Når du tar i bruk verktøy for analyse og sporing på nettstedet, må du være forberedt på å følge reglene i personvernforordningen (GDPR). Dette gjelder selv om du ikke kjenner navnet eller identiteten til de som besøker nettstedet ditt. Analyseverktøyene samler nemlig inn mye informasjon om de besøkende som enten alene eller i kombinasjon kan utgjøre personopplysninger.

    En IP-adresse vil som regel i seg selv regnes som en personopplysning. Cookie-ID, lokasjonsdata eller detaljert informasjon om brukernes enheter kan også utgjøre personopplysninger. Ofte blir slik informasjon kombinert med informasjon om de besøkendes adferd på nettstedet, og da regnes også dette som personopplysninger.
    Les mer om personopplysninger.

     

  2. Minimer datainnsamlingen

    Det er ikke lov å samle inn flere personopplysninger enn du faktisk har behov for. Dersom du i dag har et analyseverktøy som samler inn opplysninger som du ikke bruker til noe, bryter du loven. Velg et analyseverktøy som bare gir deg den informasjonen du trenger og faktisk har nytte av.

    Det er heller ikke lov å lagre personopplysninger lenger enn nødvendig.
    Les mer om dataminimering, lagringsbegrensning og de andre personvernprinsippene.

     

  3. Ikke stol på at cookie-banneret redder deg

    Det er ulike regler for henholdsvis plassering av nettkapsler/cookies og behandling av personopplysninger. Et cookie-banner som bare oppfyller minimumskravene etter de norske cookie-regelverket, gir deg ikke lov til å bruke personopplysningene til de besøkende etter personvernforordningen. Du må da ha et såkalt behandlingsgrunnlag for å behandle personopplysninger. Det vil si at det ikke er fritt fram å behandle brukernes personopplysninger.
    Les mer om behandlingsgrunnlagene.

    Dersom du baserer analyse og sporing på samtykke, må du huske at personvernforordningen setter mange krav for at et samtykke skal være gyldig. For eksempel kreves det en aktiv handling (slik som å trykke på en knapp eller lignende). Det må være like lett å takke nei som å takke ja, og brukere som ikke samtykker, må ikke bli utsatt for negative konsekvenser. Brukerne må forstå hva de eventuelt samtykker til, og det må være mulig å trekke tilbake samtykket. Hvis nettstedet skal bruke personopplysninger til flere formål, skal det også være mulig å samtykke til hvert formål separat.
    Les mer om samtykke.

     

  4. Unngå at andre kan bruke personopplysninger fra nettstedet

    Ofte må du lese tjenestevilkårene nøye for å forstå hva slags verktøy du har med å gjøre. Noen verktøy behandler bare personopplysninger på virksomhetens vegne og slik eieren av nettstedet bestemmer. Andre verktøy tar forbehold om at de selv kan bestemme over personopplysningene eller kan bruke dem for sine egne formål.

    Det krever nøye vurderinger for å at bruk av verktøy i den sistnevnte situasjonen blir lovlig. Med andre ord er det stor fare for å trå feil hvis du ikke vet hva du holder på med. Vår anbefaling er derfor å velge verktøy som lover å bare behandle personopplysninger på dine vegne og slik du bestemmer.

     

  5. Noen nettsider krever mer forsiktighet enn andre

    Noen personopplysninger har særlig beskyttelse etter personvernforordningen. Det kan være opplysninger om noens helse, legning, seksuelle forhold, religion, etnisitet, politiske oppfatning eller filosofiske overbevisning. Dette kaller vi «særlige kategorier personopplysninger». Det skal mer til for å kunne behandle denne typen opplysninger lovlig nettopp fordi de er sensitive.

    På noen nettsteder kan de besøkendes adferd i seg selv avsløre særlige kategorier personopplysninger. Det kan for eksempel være nettsteder som tilbyr tjenester innen psykisk helsehjelp, som selger medisiner eller som er rettet mot visse minoriteter. Vår klare anbefaling er at slike nettsteder unngår sporings- og analyseverktøy som behandler personopplysninger, siden det skal lite til for å bryte loven i slike tilfeller.

    Datatilsynet er også bekymret over bruk av sporingsverktøy på offentlige nettsteder. En undersøkelse gjennomført av Teknologirådet (tekologiradet.no) viste at mange offentlige nettsider bruker sporingsverktøy som er inngripende og/eller som kan tillate tredjeparter å bruke personopplysningene til egne formål. Undersøkelsen tyder på at flere offentlige organer ikke følger loven i dag. Det offentlige bør imidlertid gå foran som et godt eksempel. Dessuten er det i samfunnets interesse at alle tør å oppsøke viktig informasjon fra offentlige organer, uten frykt for overvåking og sporing.

     

  6. Unngå at personopplysninger flyter til utrygge land

    Mange verktøy har kontor eller underleverandører i land utenfor EU/EØS. Dette må du undersøke før du tar i bruk verktøyet. I utgangspunktet er det nemlig ikke lov å overføre personopplysninger ut av EU/EØS. Fjerntilgang fra et land utenfor EU/EØS regnes som en overføring.

    Sjekk tjenestevilkårene og se etter følgende:
    - Kan data sendes til eller behandles i et land utenfor EU/EØS?
    - Tilbyr verktøyet fjernsupport fra et land utenfor EU/EØS?
    - Tar verktøyet forbehold om at det kan utlevere data til myndighetene i et land utenfor EU/EØS?

    Hvis ja: Dersom det aktuelle landet står på lista over land og områder med et tilstrekkelig beskyttelsesnivå, er det OK å bruke verktøyet. Se oversikten her. Dersom landet det er snakk om er USA, sjekk om virksomheten står på lista over godkjente virksomheter.

    Dersom det aktuelle landet derimot ikke står på lista over land og områder med tilstrekkelig beskyttelsesnivå, er situasjonen adskillig mer komplisert. Det krever grundige vurderinger og eventuelt tekniske tiltak for å bruke løsningen lovlig i slike tilfeller. Dersom du ønsker å begi deg ut på dette arbeidet, har vi laget en veileder som forklarer hva reglene krever. Hvis ikke, bør du se deg om etter et annet verktøy.

     

  7. Vær åpen

    De besøkende har rett til informasjon om hvordan du behandler personopplysningene deres. Pass på at du gir ærlig og enkelt forståelig informasjon om dette. Hvis du synes det er ubehagelig å fortelle hva du faktisk gjør med de besøkendes data, er det et tegn på at du kanskje burde endre praksis.
    Les mer om hva du må gi informasjon om.

     

  8. Respekter de besøkendes rettigheter

    Når du behandler de besøkendes personopplysninger, har de en rekke rettigheter. For eksempel har de rett til innsyn i egne data, og de kan noen ganger også be om sletting. Du må være i stand til å behandle slike forespørsler innen én måned. Det kan være at de registrerte må oppgi tilleggsinformasjon for at du skal være i stand til å finne igjen dataene deres i verktøyet.
    Les mer om plikten din til å legge til rette for at de besøkende skal kunne ivareta rettighetene sine
    Vi har også laget en oversiktsside med enkeltpersonenes rettigheter.

     

  9. Les deg opp – og ikke vær redd for å spørre om hjelp

    Det finnes flere plikter i personvernforordningen som ikke er nevnt her – for eksempel når det gjelder hvilke formål du kan bruke personopplysninger til eller informasjonssikkerhet og avvikshåndtering.
    Vi har laget en samleside med alle virksomhetens plikter etter GDPR som kan være til hjelp i arbeidet.

    Dersom du synes det er vanskelig å forstå veiledningene, kan du eventuelt ringe veiledningstjenesten vår.

     

     

     

     

     

     

Åndsverkloven skal sikre inntekter til kunstnere og opphavere, og er vår viktigste kulturlov.

 

Ny åndsverklov trådte i kraft 1. juli 2018.

▼

https://lovdata.no/dokument/NL/lov/2018-06-15-40

Norske myndigheter har trappet opp kampen mot piratkopiering og varemerkeforfalskning.

 

Nettstedet velgekte.no skal bidra til å redusere spredning av piratkopierte og varemerkeforfalskede produkter blant forbrukere og næringsliv.

 

Opphavsretten beskytter kreativt og skapende arbeid. Beskyttelsen innebærer at rettighetshaverne selv bestemmer hvordan arbeidet skal brukes, og gjør det mulig å leve av kreativt arbeid. Ulovlig kopiering og tilgjengeliggjøring av opphavsrettslig beskyttede produkter utgjør en alvorlig trussel mot inntektsgrunnlaget til alle som jobber innenfor kreative næringer.

 

Nettstedet velgekte.no ble opprettet i 2015 av Patentstyret, Kulturdepartementet og Tollvesenet etter oppdrag fra Nærings- og fiskeridepartementet, og gir blant annet informasjon om regelverket knyttet til nedlasting og deling av digitale produkter som musikk, film og programvare.

 

Hvorfor er piratkopiering problematisk?

 

Piratkopiering og varemerkeforfalskning er bevisst etterlikning av et varemerke, et opphavsrettslig beskyttet verk, et design eller et patent.

 

Opphavsrettigheter, varemerker, design og patenter kalles "immaterielle rettigheter". Det engelske uttrykket er "intellectual property rights" (IPR). Immaterielle rettigheter gir innehaveren en enerett til å produsere, markedsføre, importere og selge produktene. Eneretten varer i en viss tidsperiode, og kan anses som en belønning for kreativ innsats.

 

Ved piratkopiering kan forbrukere bli lurt til å tro at produktet er fremstilt av den som sitter med rettigheten, for eksempel fordi varen er merket med rettighetshaverens varemerke. Forbrukerne kan også velge å kjøpe en kopivare selv om de forstår at den er falsk. Ved kjøp av en piratkopiert vare vet du ikke hva du kjøper, fordi varene er produsert utenfor varemerkeinnehaveren og myndighetenes kontroll. Piratvirksomhet omfatter også å tilby kopier og nedlastninger av opphavsrettslig beskyttede verk uten at den som sitter med rettighetene har godkjent det.

 

Piratkopi, replika, fake, vareforfalskninger, kopivarer – ordene brukes litt om hverandre i Norge. På engelsk brukes counterfeiting (varemerkeforfalskninger) om uautorisert kopiering av et originalt produkt, mens piracy brukes om ulovlig nedlastning og kopiering av verk som er beskyttet av opphavsrett, f. eks bøker, filmer, musikk og software. Det er ikke så viktig hvilket begrep man velger å bruke.

 

Piratkopiering er ulovlig. Det er blitt et samfunnsproblem som utvanner kjente merker, og gjør at de som lager ekte varer mister sine inntekter. Du vil vel ikke at din favorittdesigner skal gi opp eller at det bandet du liker best skal slutte å lage musikk? Det gjelder å støtte de som lager ekte og lovlige varer, og ikke de som bare snylter og hermer etter andre. Noen merker er nærmest blitt synonymer for trygghet og kvalitet. De har kanskje en lang historie og innehaveren av merkenavnet har brukt store summer på tekniske nyvinninger, produktsikkerhet, testing av materialer og et attraktivt design. Kopisten kommer rett inn fra sidelinjen uten å ha brukt penger på annet enn å lage en billig kopi. Dette ødelegger både ryktet og livsgrunnlaget for produsenten av det kjente merket.

 

Relevant regelverk

 

Her finner du en oversikt over relevante lover og forskrifter. Lenkene går til Lovdata.

▼

https://www.velgekte.no/fakta-og-regelverk/relevante-regelverk/

 

 

 

Hvorfor er det viktig å beskytte immaterielle rettigheter og verdier?

 

Immaterielle rettigheter sikrer kreative personer, innovatører og virksomheter avkastning for deres innsats, og er derfor en avgjørende faktor for vekst og innovasjon i Norge.

 

Ved å gi folk et insentiv til å være kreative og innovative sikrer immaterielle rettigheter økonomisk vekst som også skaper og beskytter et stort antall arbeidsplasser.

▼

https://www.velgekte.no/fakta-og-regelverk/utvalgte-sporsmal/

 

 

 

Om opphavsrett

 

Hovedregelen er at den enkelte rettighetshaver har rett til å bestemme om og hvordan åndsverket skal gjøres tilgjengelig for andre.

 

Dette innebærer at rettighetshaveren gis en enerett til å fremstille kopier (eksemplar) av verket og å gjøre det tilgjengelig for andre (allmennheten). Som hovedregel krever slik kopiering og tilgjengeliggjøring at det gis tillatelse fra rettighetshaveren. Eneretten gjelder uavhengig av hvordan kopieringen eller tilgjengeliggjøringen skjer. Bruk av verk ved hjelp av digital teknologi er omfattet.

 

 

 

Kopiering til privat bruk

 

Et eksempel på dette er adgangen til å kopiere til privat bruk, som utgjør en helt sentral avgrensning av opphavers enerett. Adgangen til slik kopiering følger naturlig av prinsippet om at opphavsrettslig regulering skal avgrenses mot handlinger som skjer innenfor det private området. Muligheten til slik kopiering gjelder imidlertid ikke dersom kilden det kopieres fra er ulovlig, for eksempel ved tilgjengeliggjøring i fildelingsnettverk uten samtykke fra rettighetshaver.

 

Normal nettlesing kan også skje uten hinder av eneretten.

 

 

 

Hensynene bak loven

 

Beskyttelsen som opphavsretten gir er bl.a begrunnet i å sikre opphavsmenn og utøvende kunstnere muligheter til å få inntekter av sitt skapende arbeid, samt at de som investerer i slikt innhold skal få betalt. En grunntanke er at opphavsrett vil stimulere til kreativitet og produksjon av nye kulturprodukter i samfunnet. Lovens vern er altså ikke bare begrunnet i hensynet til den enkelte rettighetshaver, men også i at skapende virksomhet er i samfunnets interesse.

 

 

 

Konsekvenser

 

Du kan bli straffet med bøter eller fengsel for overtredelse av åndsverkloven. I tillegg kan du komme i erstatningsansvar. Det samme gjelder hvis man medvirker til en overtredelse. Domstolene kan også forby handlinger som medfører fortsatt overtredelse av opphavsretten (forbudsdom).

 

Ved opphavsrettskrenkelser på internett, kan domstolene bestemme at en rettighetshaver som kan sannsynliggjøre krenkelse av opphavsretten fra en bestemt IP-adresse, skal få utlevert identiteten til det abonnementet som kan knyttes til krenkelsen. Dette gjør det mulig for rettighetshavere å håndheve opphavsretten også på internett.

▼

https://www.velgekte.no/nedlasting/om-opphavsrett/

Allmänt · ‽IT · ∴ · interrobangit · § · §IT
Dela · Kommentera  

:

Kommentera
Av Svenn Dybvik - 21 maj 2023 00:00

si vis pacem, para iustitiam


interrobangit

☼

 

 

 

 

 

 

 

 

 


http://interrobangit.bloggplatsen.se/presentation

 

http://interrobangit.bloggplatsen.se/2024/04/27/11817408/

http://interrobangit.bloggplatsen.se/2024/04/21/11817099/

http://interrobangit.bloggplatsen.se/2024/04/20/11817030/

http://interrobangit.bloggplatsen.se/2024/04/14/11816691/

http://interrobangit.bloggplatsen.se/2024/04/13/11816630/

http://interrobangit.bloggplatsen.se/2024/04/07/11816298/

http://interrobangit.bloggplatsen.se/2024/04/06/11816229/

http://interrobangit.bloggplatsen.se/2024/03/31/11815835/

 

http://interrobangit.bloggplatsen.se/2024/03/30/11815777/

http://interrobangit.bloggplatsen.se/2024/03/24/11815431/

http://interrobangit.bloggplatsen.se/2024/03/23/11815377/

http://interrobangit.bloggplatsen.se/2024/03/17/11815023/

http://interrobangit.bloggplatsen.se/2024/03/16/11814964/

http://interrobangit.bloggplatsen.se/2024/03/10/11814616/

http://interrobangit.bloggplatsen.se/2024/03/09/11814550/

http://interrobangit.bloggplatsen.se/2024/03/03/11814215/

 

http://interrobangit.bloggplatsen.se/2024/03/02/11812481/

http://interrobangit.bloggplatsen.se/2024/02/25/11812482/

http://interrobangit.bloggplatsen.se/2024/02/24/11812483/

http://interrobangit.bloggplatsen.se/2024/02/18/11812484/

http://interrobangit.bloggplatsen.se/2024/02/17/11812485/

http://interrobangit.bloggplatsen.se/2024/02/11/11812486/

http://interrobangit.bloggplatsen.se/2024/02/10/11812487/

http://interrobangit.bloggplatsen.se/2024/02/04/11812488/

 

http://interrobangit.bloggplatsen.se/2024/02/03/11812471/

http://interrobangit.bloggplatsen.se/2024/01/28/11812472/

http://interrobangit.bloggplatsen.se/2024/01/27/11812473/

http://interrobangit.bloggplatsen.se/2024/01/21/11812474/

http://interrobangit.bloggplatsen.se/2024/01/20/11812475/

http://interrobangit.bloggplatsen.se/2024/01/14/11812476/

http://interrobangit.bloggplatsen.se/2024/01/13/11812477/

http://interrobangit.bloggplatsen.se/2024/01/07/11809673/

 

http://interrobangit.bloggplatsen.se/2023/12/31/11809080/

http://interrobangit.bloggplatsen.se/2023/12/24/11808436/

http://interrobangit.bloggplatsen.se/2023/12/17/11807843/

http://interrobangit.bloggplatsen.se/2023/12/10/11807032/

http://interrobangit.bloggplatsen.se/2023/12/03/11806437/

http://interrobangit.bloggplatsen.se/2023/11/26/11805948/

http://interrobangit.bloggplatsen.se/2023/11/19/11805462/

http://interrobangit.bloggplatsen.se/2023/11/12/11804748/

 

http://interrobangit.bloggplatsen.se/2023/11/05/11803843/

http://interrobangit.bloggplatsen.se/2023/10/29/11802910/

http://interrobangit.bloggplatsen.se/2023/10/22/11801623/

http://interrobangit.bloggplatsen.se/2023/10/15/11800702/

http://interrobangit.bloggplatsen.se/2023/10/08/11799349/

http://interrobangit.bloggplatsen.se/2023/10/01/11797103/

http://interrobangit.bloggplatsen.se/2023/09/24/11795905/

http://interrobangit.bloggplatsen.se/2023/09/17/11795095/

 

http://interrobangit.bloggplatsen.se/2023/09/10/11794600/

http://interrobangit.bloggplatsen.se/2023/09/03/11794088/

http://interrobangit.bloggplatsen.se/2023/08/27/11793398/ 

http://interrobangit.bloggplatsen.se/2023/08/20/11792985/

http://interrobangit.bloggplatsen.se/2023/08/13/11792494/

http://interrobangit.bloggplatsen.se/2023/08/06/11791981/

http://interrobangit.bloggplatsen.se/2023/07/30/11791456/

http://interrobangit.bloggplatsen.se/2023/07/23/11790886/

 

http://interrobangit.bloggplatsen.se/2023/07/16/11790435/

http://interrobangit.bloggplatsen.se/2023/07/09/11789982/

http://interrobangit.bloggplatsen.se/2023/07/02/11789494/

http://interrobangit.bloggplatsen.se/2023/06/25/11788958/

http://interrobangit.bloggplatsen.se/2023/06/18/11788358/

http://interrobangit.bloggplatsen.se/2023/06/11/11787767/

http://interrobangit.bloggplatsen.se/2023/06/04/11787315/

http://interrobangit.bloggplatsen.se/2023/05/28/11786823/

 

http://interrobangit.bloggplatsen.se/2023/05/21/11786357/

http://interrobangit.bloggplatsen.se/2023/05/14/11785856/

http://interrobangit.bloggplatsen.se/2023/05/07/11785348/

http://interrobangit.bloggplatsen.se/2023/04/30/11784837/

http://interrobangit.bloggplatsen.se/2023/04/23/11783864/

http://interrobangit.bloggplatsen.se/2023/04/16/11782994/

http://interrobangit.bloggplatsen.se/2023/04/09/11782445/

http://interrobangit.bloggplatsen.se/2023/04/02/11810271/

 

http://interrobangit.bloggplatsen.se/2023/03/26/11811111/

http://interrobangit.bloggplatsen.se/2023/03/19/11811112/

http://interrobangit.bloggplatsen.se/2023/03/12/11811113/

http://interrobangit.bloggplatsen.se/2023/03/05/11811114/

http://interrobangit.bloggplatsen.se/2023/02/26/11811115/

http://interrobangit.bloggplatsen.se/2023/02/19/11811116/

http://interrobangit.bloggplatsen.se/2023/02/12/11811117/

http://interrobangit.bloggplatsen.se/2023/02/05/11811118/

Allmänt · ‽IT · ∴ · interrobangit · § · §IT
Dela · Kommentera  

:

Kommentera
Av Svenn Dybvik - 14 maj 2023 00:00

https://www.enisa.europa.eu/publications/enisa-threat-landscape-2023

ENISA Threat Landscape 2023

This is the eleventh edition of the ENISA Threat Landscape (ETL) report, an annual report on the status of the cybersecurity threat landscape. It identifies the top threats, major trends observed with respect to threats, threat actors and attack techniques, as well as impact and motivation analysis. It also describes relevant mitigation measures. This year’s work has again been supported by ENISA’s ad hoc Working Group on Cybersecurity Threat Landscapes (CTL).

https://www.enisa.europa.eu/publications/enisa-threat-landscape-2023/@@download/fullReport

 

 

 

 

 

 

https://www.enisa.europa.eu/


Warfare and Geopolitics are Fuelling Denial-of-Service Attacks


The European Union Agency for Cybersecurity (ENISA)’s new report on the Denial-of-Service (DoS) attacks threat landscape finds 66% of DoS attacks are politically motivated.


The analysis is based on 310 verified Denial-of-Service (DoS) incidents during the reporting period of January 2022 to August 2023. However, this total number only represents the incidents gathered from open sources.

A large-scale study is also included of publicly reported incidents. The study focuses on the motivations of attackers, their goals and the socio-political profiles of targets.

DOS attack threat landscape report 2023

Since the beginning of 2022, DoS attacks have turned into a novel and massive threat using new techniques and are fuelled by warfare motivations.

In the last few years, DoS attacks have become easier, cheaper and more aggressive than ever before. The emergence of new armed conflicts around the world acted as fuel to new waves of DoS attacks where newly formed threat actors pick and choose targets without fear of repercussions.

 

Objective of report:

To provide a better understanding of this type of threat by analysing the motivations and impact of the DoS attacks and raise awareness at the same time by suggesting prevention and remediation recommendations.

The research performed illustrates that most impacted sectors over the reported period covering January 2022 to August 2023 are associated with government services. These attacks stand as retaliation acts triggered by political decisions.

The report highlights that the last few years, DoS attacks have increased in number especially in the public administration and have become easier and more aggressive than before, largely due to geopolitical reasons. The current DoS threat landscape is greatly influenced by the emergence of the recent armed conflicts around the world and especially by the Russia-Ukraine War that fuelled new waves of DoS attacks where recently introduced threat actors select targets without the fear of repercussions.

The study also illustrates that while no sector is exempted from DoS attacks, the government infrastructure has become a preferred target by threat actors that often manage to be successful by causing downtime.

 

KEY TAKEAWAYS

  • The most affected sector was the government administration sector, accounting for receiving 46% of attacks.
  • It is estimated that 66% of the attacks were motivated by political reasons or activist agendas.
  • Overall, 50% of the global incidents were found to be related to the Russian-Ukrainian war.
  • The study shows that 8% of the attacks caused total disruption in the target.
  • The analysis of DoS attacks' motivations and goals is based on the new taxonomy used to classify such attacks based on information publicly available about the attacks the targets for a more systematic analysis approach.
  • Warfare is a key gameplayer and organisations would benefit from prevention and remediation strategies.
  • Reporting of DoS attacks has not reached the maturity needed to allow for the real extent and impact of such attacks.

 

Key challenges

 


The detection, description and analysis of DoS attacks is highly complex and different from other cybersecurity attacks. In other types of cybersecurity attacks, such as exploitation of services or even supply chain attacks, the attackers leave artefacts behind that the incident responders can find, analyse, share, confirm, verify and ultimately use for some explanation or even attribution. In the case of DoS attacks artefacts do not exist or are usually fake ones. This is part of the reasons why official databases of such attacks are difficult to be compiled.

The report sheds light on 3 types of information one must be warned against when seeking to analyse DoS incidents:

  • The good quality of information: paradoxically, this is the information coming from reports and claims made by the attackers themselves.
  • The bad quality of information: information coming from DoS protection providers that actually stopped the attacks.
  • The ugly quality of information: information coming from reports created by the targets.

 

What is a Denial-of-Service or DoS attack?

 

There is a wide range of difficulties when it comes to defining what a DoS attack is.

Denial-of-service attacks (DoS) are defined for this report as availability attacks in which attackers, partially or totally, obstruct the legitimate use of a target's service by depleting or exploiting the target's assets over a period of time.

A Distributed Denial-of-Service (DDoS) attack DDoS is a subset of DoS attacks. DoS attacks can be distributed which means that they may originate from thousands of sources from all over the world, usually relying on large-scale botnets or proxies.

 

Further Information

ENISA Threat Landscape for DoS Attacks - 2023

ENISA Threat Landscape - 2023

Contact

For press questions and interviews, please contact press (at) enisa.europa.eu

 

 

Stay updated - subscribe to RSS feeds of both ENISA news items & press releases!

News items:

http://www.enisa.europa.eu/media/news-items/news-wires/RSS

PRs:

http://www.enisa.europa.eu/media/press-releases/press-releases/RSS

 

 

 

 

 

 

https://www.enisa.europa.eu/news/checking-up-on-health-ransomware-accounts-for-54-of-cybersecurity-threats


Checking-up on Health: Ransomware Accounts for 54% of Cybersecurity Threats


The European Union Agency for Cybersecurity (ENISA) releases today its first cyber threat landscape for the health sector. The report found that ransomware accounts for 54% of cybersecurity threats in the health sector.


The comprehensive analysis maps and studies cyberattacks, identifying prime threats, actors, impacts, and trends for a period of over 2 years, providing valuable insights for the healthcare community and policy makers. The analysis is based on a total of 215 publicly reported incidents in the EU and neighbouring countries.

Executive Director of the European Union Agency for Cybersecurity (ENISA), Juhan Lepassaar, said: “A high common level of cybersecurity for the healthcare sector in the EU is essential to ensure health organisations can operate in the safest way. The rise of the covid-19 pandemic showed us how we critically depend on health systems. What I consider as a wake-up call confirmed we need to get a clear view of the risks, the attack surface and the vulnerabilities specific to the sector. Access to incident reporting data must therefore be facilitated to better visualise and comprehend our cyber threat environment and identify the appropriate mitigation measures we need to implement.”

The findings

The report reveals a concerning reality of the challenges faced by the EU health sector during the reporting period.

  • Widespread incidents. The European health sector experienced a significant number of incidents, with healthcare providers accounting for 53% of the total incidents. Hospitals, in particular, bore the brunt, with 42% of incidents reported. Additionally, health authorities, bodies and agencies (14%), and the pharmaceutical industry (9%) were targeted.
  • Ransomware and data breaches. Ransomware emerged as one of the primary threats in the health sector (54% of incidents). This trend is seen as likely to continue. Only 27% of surveyed organisations in the health sector have a dedicated ransomware defence programme. Driven by financial gain, cybercriminals extort both health organisations and patients, threatening to disclose data, personal or sensitive in nature. Patient data, including electronic health records, were the most targeted assets (30%). Alarmingly, nearly half of all incidents (46%) aimed to steal or leak health organisations' data.
  • Impact and lessons learned by the COVID-19 Pandemic. It is essential to note that the reporting period coincided with a significant portion of the COVID-19 pandemic era, during which the healthcare sector became a prime target for attackers. Financially motivated threat actors, driven by the value of patient data, were responsible for the majority of attacks (53%). The pandemic saw multiple instances of data leakage from COVID-19-related systems and testing laboratories in various EU countries. Insiders and poor security practices, including misconfigurations, were identified as primary causes of these leaks. The incidents serve as a stark reminder of the importance of robust cybersecurity practices, particularly in times of urgent operational needs.
  • Vulnerabilities in Healthcare Systems. Attacks on healthcare supply chains and service providers resulted in disruptions or losses to health organisations (7%). Such types of attacks are expected to remain significant in the future, given the risks posed by vulnerabilities in healthcare systems and medical devices. A recent study by ENISA revealed that healthcare organisations reported the highest number of security incidents related to vulnerabilities in software or hardware, with 80% of respondents citing vulnerabilities as the cause of more than 61% of their security incidents.
  • Geopolitical Developments and DDoS Attacks. Geopolitical developments and hacktivist activity led to a surge in Distributed Denial of Service (DDoS) attacks by pro-Russian hacktivist groups against hospitals and health authorities in early 2023, accounting for 9% of total incidents. While this trend is expected to continue, the actual impact of these attacks remains relatively low.
  • The incidents examined in the report had significant consequences for health organisations, primarily resulting in breaches or theft of data (43%) disrupted healthcare services (22%) and disrupted services not related to healthcare (26%). The report also highlights the financial losses incurred, with the median cost of a major security incident in the health sector estimated at €300,000 according to the ENISA NIS Investment 2022 study. 
  • Patient safety emerges as a paramount concern for the health community, given potential delays in triage and treatment caused by cyber incidents.

 

 

 

 

 

 

New report from the NIS Cooperation Group

The NIS Cooperation Group releases today its report on “Threats and risk management in the health sector – Under the NIS Directive”. As a first assessment on the measures currently in place, the study sheds light on the different cybersecurity challenges in risk mitigation faced by the EU health sector. Together with relevant threat taxonomies and cyber incident data, the report discloses business continuity and mitigation recommendations to limit the likelihood and impacts of a cyber related incident.

 

Background

The ENISA threat landscape reports map the cyber threat landscape to help decision makers, policy makers and security specialists define strategies to defend citizens, organisations and cyberspace.

The report’s content is gathered from open sources such as media articles, expert opinions, intelligence reports, incident analysis and security research reports; as well as through the members of the ENISA Cyber Threat Landscapes Working Group (CTL working group).

The analysis and views of the threat landscape by ENISA is meant to be industry and vendor neutral. Information based on OSINT (Open-Source Intelligence) and the work of ENISA on Situational Awareness also helped document the analysis presented in the report.

 

Further Information

Health Threat Landscape – ENISA report 2023

ENISA topic: Health

ENISA topic: Cyber threats

CSIRT capabilities in healthcare sector – ENISA report 2021

Cloud security for healthcare services – ENISA report 2021

Procurement guidelines for cybersecurity in hospitals

 

 

 

 

 

 


References


 

 

 

 

 

 

https://www.enisa.europa.eu/about-enisa/data-protection

▼

ENISA is committed to the protection of individuals’ privacy and data protection.


The rights to privacy and data protection are fundamental rights, set out in articles 7 and 8 of the EU Charter of Fundamental Rights.


ENISA, as an EU Agency, is subject to the Regulation (EU) 2018/1725 on the protection of natural persons with regard to the processing of personal data by the Union institutions, bodies, offices and agencies. This Regulation has the same level and types of rules for the protection of personal data as the General Data Protection Regulation (GDPR), which is applicable to all EU Member States.


In order to function and meet its tasks and objectives, ENISA needs to collect and further process personal data of its staff members, as well as other natural persons in the context of its different activities in the areas of human resources, procurement and finance, corporate services (e.g. IT services), as well as in the context of the functioning of ENISA’s governance bodies and core operations.


What is personal data?


Personal data is any information relating to an identified or identifiable natural person. An identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, location data, an online identifier or to one or more factors specific to his or her physical, physiological, genetic, mental, economic, cultural or social identity.


Examples of personal data include: names, pictures, contact details, emails, CVs, diplomas, recommendation letters, professional & family life, bank details, transaction information, medical data, judicial & criminal records, CCTV footage, log files, IP addresses, cookies, etc.


How does ENISA process personal data?


ENISA process personal data in accordance with the principles and provisions of Regulation (EU) 2018/1725.


These provisions mandate the personal data shall be:


  • processed lawfully, fairly and in a transparent manner;
  • collected for specified, explicit and legitimate purposes and not further processed in a manner that is incompatible with those purposes (“purpose limitation”);
  • adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (“data minimisation”);
  • accurate and, where necessary, kept up to date (“accuracy”’);
  • kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed  (‘storage limitation’);
  • processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’).

ENISA adheres to its obligations under the Regulation (EU) 2018/1725 and provides for the data subjects rights under this Regulation.


Further information:

ENISA’s central register of data processing activities

Data subjects rights under Regulation (EU) 2018/1725

ENISA’s Data Protection Officer 

Data protection with regard to ENISA’s website

 

https://cybersecuritymonth.eu/

https://cybersecuritymonth.eu/press-campaign-toolbox/visual-identity/banners/ecsm-partnerstoolkit.zip

https://cybersecuritymonth.eu/smarterthanahacker

https://privacyforum.eu/

 

https://www.enisa.europa.eu/publications/pseudonymisation-techniques-and-best-practices

Pseudonymisation techniques and best practices

This report explores further the basic notions of pseudonymisation, as well as technical solutions that can support implementation in practice. Starting from a number of pseudonymisation scenarios, the report defines first the main actors that can be involved in the process of pseudonymisation along with their possible roles. It then analyses the different adversarial models and attacking techniques against pseudonymisation, such as brute force attack, dictionary search and guesswork. Moreover, it presents the main pseudonymisation techniques and policies available today.

https://www.enisa.europa.eu/publications/pseudonymisation-techniques-and-best-practices/@@download/fullReport

 

https://www.enisa.europa.eu/publications/data-pseudonymisation-advanced-techniques-and-use-cases

Data Pseudonymisation: Advanced Techniques and Use Cases

This report, building on the basic pseudonymisation techniques, examines advanced solutions for more complex scenarios that can be based on asymmetric encryption, ring signatures and group pseudonyms, chaining mode, pseudonyms based on multiple identifiers, pseudonyms with proof of knowledge and secure multi-party computation. It then applies some of these techniques in the area of healthcare to discuss possible pseudonymisation options in different example cases. Lastly, it examines the application of basic pseudonymisation techniques in common cybersecurity use cases, such as the use of telemetry and reputation systems.

https://www.enisa.europa.eu/publications/data-pseudonymisation-advanced-techniques-and-use-cases/@@download/fullReport

 

 

https://www.enisa.europa.eu/publications/engineering-personal-data-sharing

Engineering Personal Data Sharing

This report attempts to look closer at specific use cases relating to personal data sharing, primarily in the health sector, and discusses how specific technologies and considerations of implementation can support the meeting of specific data protection. After discussing some challenges in (personal) data sharing, this report demonstrates how to engineer specific technologies and techniques in order to enable privacy preserving data sharing. More specifically it discusses specific use cases for sharing data in the health sector, with the aim of demonstrating how data protection principles can be met through the proper use of technological solutions relying on advanced cryptographic techniques. Next it discusses data sharing that takes place as part of another process or service, where the data is processed through some secondary channel or entity before reaching its primary recipient. Lastly, it identifies challenges, considerations and possible architectural solutions on intervenability aspects (such as the right to erasure and the right to rectification when sharing data).

https://www.enisa.europa.eu/publications/engineering-personal-data-sharing/@@download/fullReport

 

https://www.enisa.europa.eu/news/securing-personal-data-in-the-wake-of-ai

Securing Personal Data in the Wake of AI

This year’s Annual Privacy Forum focused on pressing personal data protection challenges raised by the ever faster-paced developments witnessed today in digital technologies and legislative initiatives.


Organised by the European Union Agency for Cybersecurity (ENISA) together with the directorate general of the European Commission for communications networks, content and technology (DG Connect) and the National Institute for Research in Digital Science and Technology (INRIA), the 2023 edition of the event took place in Lyon, France.

This 11th edition brought together a total of 26 speakers and over 400 participants both physically and remotely.

Panels of experts were given the chance to address some of the most pressing topics in relation to the securing of personal data, including:

  • Emerging Technologies for personal data protection;
  • Machine learning and personal data processing;
  • Personal data sharing under the European Data Strategy;
  • Promoting GDPR compliance and data subject rights.

European Union Agency for Cybersecurity, Executive Director Juhan Lepassaar, commented: “ENISA has been analysing AI risks for the last 5 years. To prepare for a secure and trusted AI, the safeguards need to be in place. Today AI and in particular machine learning pose great challenges to data protection and privacy. Trust is what underpins the secure adoption and maturity of these technologies. Personal data protection measures are an impactful way to gaining this trust.”

Wojciech Wiewiorowski, European Data Protection Supervisor: “It would be reductive to not look at the benefits that AI can bring to society, such as faster decision making and easy-to-use automation. However, the risks to individual rights are significant and can have a profound impact on our democracies. By proactively addressing these risks, we can harness the potential of AI while safeguarding privacy rights. It is crucial to take action now to ensure responsible and ethical implementation of AI technologies.”

Challenges and opportunities: the conference’s key take-aways

  • Within the three panel discussions, regulators from EU Institutions, France, Spain and Norway together with policy makers and industry practitioners, debated on which are the data protection engineering challenges for the years to come, what is the role of Data Protection Authorities in the artificial intelligence era and the data protection prospects and contemplations when processing medical data in the post pandemic era.
  • Further to these discussions, invited speakers also elaborated on the AI regulatory approaches on artificial intelligence across the two sides of the Atlantic and how Zero Knowledge Proof technique can be deployed as a privacy enhancing technique in real life applications.

The Annual Privacy Forum was co-located and organised back to back with the EDPS IPEN workshop as part of their strategic cooperation and the Memorandum of Understanding signed between ENISA and the EDPS in 2022.

 

 

Further Information

 

 

Relevant ENISA publications:

Other information:

 

 

About the Annual Privacy Forum

The Annual Privacy Forum (APF) has become a renowned forum among policy-makers, researchers and industry stakeholders in the area of privacy and personal data protection who join forces to advance information security. The forum is set against the EU legislative background that is mainly, but not exclusively, comprised of the GDPR and the draft ePrivacy Regulation. The event sets the stage for new research proposals, solutions, models, applications and policies. In the last few years, the forum has also developed a deeper industry footprint to complement its original research and policy orientation.

 

 

About the European Union Agency for Cybersecurity (ENISA)

The EU Agency for Cybersecurity has been working in the area of privacy and data protection since 2014, by analysing technical solutions for the implementation of the GDPR, privacy by design and security of personal data processing. The Agency has been providing guidance on data pseudonymisation solutions to data controllers and processors since 2018.

 

Contact

For press questions and interviews, please contact press (at) enisa.europa.eu

Allmänt · ‽IT · ∴ · interrobangit · § · §IT
Dela · Kommentera  

:

Kommentera
Av Svenn Dybvik - 7 maj 2023 00:00

https://www.ncsc.gov.uk/


The National Cyber Security Centre

 

https://www.ncsc.gov.uk/collection/problem-book/hardware-security


https://www.ncsc.gov.uk/collection/cloud/using-cloud-services-securely/how-to-lift-and-shift-successfully


https://www.ncsc.gov.uk/collection/defending-democracy/guidance-for-high-risk-individuals


https://www.ncsc.gov.uk/collection/guidelines-secure-ai-system-development


https://www.ncsc.gov.uk/section/information-for/individuals-families


https://www.ncsc.gov.uk/section/information-for/self-employed-sole-traders


https://www.ncsc.gov.uk/section/information-for/small-medium-sized-organisations


https://www.ncsc.gov.uk/section/information-for/large-organisations


https://www.ncsc.gov.uk/section/information-for/public-sector


https://www.ncsc.gov.uk/section/information-for/cyber-security-professionals

 

https://www.ncsc.gov.uk/collection/defending-democracy

 

 

 

 

 

 

Defending democracy

Introduction

This collection brings together expanded guidance to raise awareness of the cyber threats to democratic processes, institutions, and the people involved in them. The aim is to prevent or reduce related attacks against both organisations and individuals.

The context here is the threat of foreign cyber interference with the aim of influencing UK democratic processes. Democratic events such as elections are attractive targets for adversaries, and organisations and individuals must be prepared for threats, old and new. Defending UK democratic institutions and processes is a priority.

 

Who is this guidance for?

Organisations

  • political parties or organisations, think tanks
  • local authorities, central government, devolved administrations

Individuals

  • working in organisations as above, that puts them at higher risk of targeting
  • working in IT or SOC roles in organisations as above

This collection contains

  1. Guidance for high-risk individuals

    There has been a rise in targeting of individuals’ personal accounts instead of corporate ones, as security is less likely to be managed by a dedicated team. This is not a mass campaign against the public but a persistent effort to target people whom attackers consider to hold information of interest. This guidance sets out how individuals can protect their accounts and devices.

Further guidance will be added to this collection in 2024.

 

 


Guidance for high-risk individuals on protecting your accounts and devices 


What is a high-risk individual?

In a cyber security context, you are considered a high-risk individual if your work or public status means you have access to, or influence over, sensitive information that could be of interest to nation state actors.

 

High-risk individuals include those working in political life (including elected representatives, candidates, activists and staffers), academia, journalism and the legal sector.

 

In recent years there have been a number of targeted cyber attacks against high-risk individuals in the UK, to attempt to gain access to their accounts and devices. This has resulted in the theft and publication of sensitive information, which can also cause reputational damage.



How and why you may be targeted

There are different ways an attacker may gain access to your accounts or devices. Spear-phishing is one method that attackers have used in the past to compromise high-risk individuals.

A joint NCSC advisory with international partners describes this technique and warns of a state actor that has targeted high-risk individuals in the UK in this way.



Using this guidance

This guidance will help you improve the security of personal accounts and devices, and keep you better protected online.

Personal accounts and devices are the responsibility of the individual and may be considered an easy target for threat actors, as they may perceive them to have fewer security measures in place.

 

As far as possible, you should continue to use corporately managed accounts and devices for your work, as they will be centrally managed and secured.



Protecting your accounts

Your personal accounts are a likely target for attackers. If an attacker gains access to one of your accounts, they may be able access to the information on them. Taking the actions below will significantly reduce the chance of a successful attack.

 


Use strong passwords 

When an attacker compromises an account, it is often because they have either stolen or guessed the password. Weak passwords are vulnerable to attack. Research shows that weak passwords often contain names, places or a run of numbers. The more complex a password is, the more secure it becomes. The NCSC recommends using a sequence of three random words to make a password complex but easy to remember.

Having strong passwords can lessen the chance that your account is compromised. Important accounts that contain sensitive information (such as your personal and work email, social media and online banking) should have a strong password that is unique to that account.

It can be difficult to remember passwords, so it’s fine to write them down and keep them safe where other people can’t access them, separate from your devices. You can also use a password manager. Password managers are a convenient and secure way to store your passwords, either in your browser or an app, which uses one ‘master’ password or biometrics. Both Android and iOS devices have secure and trusted password manager functions built in:

Accessing password manager functions on IOS (Apple)

Accessing password manager functions on Android

You should not share your passwords for any of your accounts. Password sharing heightens the risk of account compromise and weakens your online security.

 

Enable two-step verification on your accounts

Setting up two-step verification or 2SV (also known as multi-factor authentication or two-factor authentication) on an account makes it considerably more secure. It means that even if an attacker knows your password, they can’t access your account. It works by asking you to complete a second step when you sign in, usually by entering a code sent by SMS, email or via an app. Authentication apps such as Google Authenticator or Microsoft Authenticator are designed just for this purpose, and are more secure and convenient than SMS.

For some accounts, you can choose to only use 2SV when signing in from a new device or changing your password. This means you don’t have to enter a code every time you use a service.

Where should I set up 2SV?

You should set up 2SV on all personal accounts that could be considered a high-value target for an attacker, such as your email, messaging apps like WhatsApp, and social media. If 2SV isn’t available on an account, make sure it has a strong and unique password or consider changing to a service that offers 2SV.

The NCSC has separate guidance to help you set up 2SV.

Receiving 2SV requests

If you receive a 2SV request that asks if you are trying to access your account but you are not trying to log in, do not grant permission. It's possible that an attacker knows your password and is trying to access your account. In this instance, 2SV is doing its job, but you should change your password. If you use the same password on other accounts, you should change it for them too.

Never share an access code with others, even if prompted, as this can give attackers control of your account.

 


Review your social media use and settings 

Consider how much personal information you are sharing on social media. Attackers may use the information you post to engineer a spear-phishing attack and attempt to gain access to your account and data.

You should also consider maintaining separate professional and personal social media accounts.

You can review the privacy settings for each account to decide what is most appropriate for you. The major platforms provide instructions on how to manage your privacy settings. You can find links to these instructions in the NCSC guidance on using social media safely, alongside additional information on managing your digital footprint and spotting fake accounts.

Be aware that attackers may pose as other people on social media platforms, even if you appear to have mutual contacts. They may seek to cause you reputational damage, by sending you malicious links to click to gain access to sensitive information. It’s possible that over the next few years, attackers may also make increasing use of voice clones or ‘deep fakes’ to trick users to reveal sensitive information.

The UK National Protective Security Authority has guidance about false profiles that helps you spot them on social media and professional networking sites.

For any public social media accounts that you use in a professional context, consider using a social media management service. This means that colleagues or employees will be able to create posts for you without you sharing your passwords. You should avoid using the same password for the management service as any of your social media accounts connected to it. You can read the NCSC guidance on protecting what you publish for further information.



Review your use of messaging apps

Messaging apps such as WhatsApp, Messenger and Signal are now an important part of how we communicate in everyday life. It's important to use them securely and pay special attention when connecting with people professionally.

If you use a messaging app for personal use on a personal device, you should consider the following:

  • use disappearing messages that automatically delete after a set period – by turning this on you will limit what a successful attacker could access if they do manage to get in
  • consider the recipient – are they who they say they are, and who else is in the chat group?
  • avoid accepting message requests from unknown accounts – consider calling first to verify who they are

As with all apps, you should make sure that the latest security updates are installed and set up two-step verification (2SV) for when you log in.





Protecting your devices

As with your accounts, attackers may also try to compromise your devices – computers, phones or tablets – to achieve their aims. If they manage to access them, they can steal sensitive or personal information, carry out monitoring, or even impersonate you.

There are several things you can do to secure your devices.

 

Install updates

Installing security updates promptly is one of the most important things you can do to protect yourself from a cyber attack.

Out-of-date software, apps and operating systems often contain security vulnerabilities, and vendors regularly release updates to fix them. So if you receive a prompt to update your device or apps, you should do it, as it will prevent attackers taking advantage of these security flaws.

Most apps offer an auto-update option, meaning that updates will automatically download when they are available (or when you next connect to wifi), and install at the earliest time suitable for you, or the next time the device restarts. You should make sure this option is enabled on your device. You can read the NCSC guidance on software and app updates to help you enable automatic updates for popular devices and services.

You should only download software and apps from official stores, like Google Play or Apple App Store. They scan software for viruses before making it available, giving you more reassurance that what you’re downloading is safe

 


Use 'Lockdown Mode'

For additional security, you should consider enabling Lockdown Mode for your Apple devices. Lockdown Mode has been designed for individuals who might be targeted by sophisticated threat actors. On Windows devices, you have the option to enable ‘S mode’ which only allows applications from the Microsoft Store to be downloaded and installed. This prevents malicious programs running on your device.



Replace old devices

As older devices are replaced by newer models, vendors stop releasing security updates, making them more vulnerable to attack. You should avoid using devices that are no longer supported and upgrade your device if support is ending soon.

You can check to see if you device is still supported with the Which? phone support checker tool.


Protect physical access

You should protect your devices with a password or pin that must be entered when the device is powered on or restarted. This will help prevent someone who has managed to get physical access to your device accessing the information on it.

To unlock from standby, you can also use a password, PIN or a biometric, such as a fingerprint or facial recognition. Use whichever method you find convenient.

Avoid plugging your devices into public USB charging points, and instead use a traditional power plug.

Most devices come with a feature that allows you to track the location of a device and remotely wipe it if it's lost or stolen. On an iPhone, make sure Find My is turned on, and for Android devices, enable Find My Device.


Know how to erase data from devices

Our devices often contain sensitive work, personal and financial data, which can still be recovered even if the files have been deleted. So it's important to know how to erase the data if a device is lost or stolen, or you permanently give it to someone else to use. The NCSC has guidance to help you securely erase data on your devices.

 

 


What to do if you think you've been attacked

If you receive a suspicious email, do not click on any links, or reply to the email, until you're certain the sender is genuine. The NCSC has guidance on how to spot and deal with phishing emails.

If you receive a suspicious email you should report it to your organisation’s IT support team, who will be able to offer advice, even if has been sent to a personal account.

If you have clicked on a link, or think you’ve been hacked, don’t panic, even if you think you have made a mistake. If something goes wrong on a device or account that your organisation has provided, report it to IT support. The security team shouldn’t blame you for reporting that something has happened to you, as it helps them fix things, and try to stop it happening again, to you or anyone else.

 

 

 

 

 

 


Topics

https://www.ncsc.gov.uk/section/advice-guidance/all-topics?topics=Device

https://www.ncsc.gov.uk/section/advice-guidance/all-topics?topics=Personal%20data

https://www.ncsc.gov.uk/section/advice-guidance/all-topics?topics=Social%20media

 

 

 

 

 

 

 

https://www.ncsc.gov.uk/section/information-for/individuals-families

Individuals & families


  1. What is cyber security?
  2. Cyber Aware and staying secure online
  3. Dealing with common cyber problems
  4. Protecting your data and devices
  5. How to report cyber crim

What is cyber security?

Cyber security is the means by which individuals and organisations reduce the risk of being affected by cyber crime.

Cyber security's core function is to protect the devices we all use (smartphones, laptops, tablets and computers), and the services we access online - both at home and work - from theft or damage. It's also about preventing unauthorised access to the vast amounts of personal information we store on these devices, and online.

Cyber security is important because smartphones, computers and the internet are now such a fundamental part of modern life, that it's difficult to imagine how we'd function without them. From online banking and shopping, to email and social media, it's more important than ever to take steps that can prevent cyber criminals getting hold of our accounts, data, and devices.

 

 

 

 

 

 

Cyber Aware and staying secure online

From banking to shopping, and streaming to social media, people are spending more time than ever online. Cyber Aware is the government's advice on how to stay secure online.

https://www.ncsc.gov.uk/cyberaware

 

 

 

 

 

 

Protecting your data and devices

 

https://www.ncsc.gov.uk/guidance/data-breaches

How to protect yourself from the impact of data breaches
 

https://www.ncsc.gov.uk/guidance/buying-selling-second-hand-devices

How to erase the personal data from your phone, tablets, and other devices
 
 
https://www.ncsc.gov.uk/guidance/smart-security-cameras-using-them-safely-in-your-home
How to protect 'smart' security cameras and baby monitors from cyber attack.
 
 
https://www.ncsc.gov.uk/guidance/securing-your-devices
How to ensure your devices are as secure as possible.
 
 
https://www.ncsc.gov.uk/guidance/video-conferencing-services-using-them-securely
How to set up and use video conferencing services, such as Zoom and Skype, safely and securely
 
 
https://www.ncsc.gov.uk/information/5g-explainer
A summary of what 5G is, how it will affect the UK and how the NCSC is helping to secure it.
 
 
https://www.ncsc.gov.uk/guidance/online-gaming-for-families-and-individuals
How to enjoy online gaming securely by following just a few tips
 
 
https://www.ncsc.gov.uk/guidance/shopping-online-securely
How to shop safely online.
 
 
https://www.ncsc.gov.uk/guidance/what-is-an-antivirus-product
Detect and prevent malicious software and viruses on your computer or laptop.
 
 
https://www.ncsc.gov.uk/guidance/social-media-how-to-use-it-safely
Use privacy settings across social media platforms to manage your digital footprint.
 
 
https://www.ncsc.gov.uk/guidance/sextortion-scams-how-to-protect-yourself
Advice in response to the increase in sextortion scams
 
 
https://www.ncsc.gov.uk/guidance/smart-devices-in-the-home
Many everyday items are now connected to the internet: we explain how to use them safely.

https://www.ncsc.gov.uk/guidance/using-tls-to-protect-data


Using TLS to protect data

Recommended profiles to securely configure TLS for the most common versions and scenarios, with additional guidance for managing older versions.
 
 
  1. Introduction
  2. About TLS
  3. General TLS configuration
  4. Summary
  5. TLS 1.3 configuration
  6. TLS 1.2 configuration
  7. Legacy versions
  8. Third-Party services
  9. Avoiding known insecurities
  10. Choosing a Certificate Authority
  11. Requesting a certificate
  12. Deploying TLS for web servers
  13. Deploying TLS for mail servers
  14. Testing web and mail servers
Allmänt · ‽IT · ∴ · interrobangit · § · §IT
Dela · Kommentera  

:

Kommentera
Av Svenn Dybvik - 30 april 2023 00:00

https://www.ncsc.gov.uk/collection/application-development


Application development

Recommendations for the secure development, procurement and deployment of generic and platform-specific applications.
 

PAGE 1 OF 16

Introduction

Advice on how to minimise the loss of data from applications running on devices handling sensitive data.

It is primarily for risk assessors and application developers, and contains recommendations for the secure development, procurement and deployment of generic and platform-specific applications.

  • We recommend that you read the generic application development section of this guidance in full, before you read the platform-specific guidance sections.
  • Note that the NCSC does not provide services for the assessment of third-party applications; organisations must undertake this work on an individual, per-application basis.

About this guidance

This guidance will help you to:

  • ensure sensitive data is protected appropriately when stored and transmitted
  • minimise the opportunity for accidental data leakage across application boundaries
  • ensure only authorised parties can access sensitive information
  • maximise the usability of applications whilst maintaining security in the development phase
  • restrict access to sensitive data to those applications designed to handle such material in a secure manner

In achieving these goals, the following assumptions are made:

  • devices are configured in line with the NCSC End User Device guidance
  • devices could have other third-party applications installed
  • devices will be in a locked state if lost or stolen
  • attackers can gain total control of devices (such as through jailbreaking/rooting) or otherwise gaining administrative privileges

In addition, the following principles are followed throughout:

  • applications that store, process, handle, or have network access to sensitive information should be developed with security in mind from the start, and should be audited and assessed before use
  • use the functionality of modern platforms to enhance the security of applications (this is the focus of the platform-specific guidance)
  • if sensitive information is stored using the platform’s native functionality, then third-party applications may be able to access that information
  • the specific data that applications can access (and the constraints are involved) must be understood with respect to each platform’s security model

PAGE 2 OF 16

Generic application development

Recommendations for the secure development, procurement and deployment of generic applications.

This guidance provides advice on how to minimise the loss of data from applications running on devices handling sensitive data. It is primarily for risk assessors and application developers, and contains recommendations for the secure development, procurement and deployment of generic applications.

The guidance below is platform-agnostic, and describes how to mitigate common security issues, regardless of the platform used. We recommend that you read this generic application development guidance in full, before you read the platform-specific guidance.

Common security issues

When building an application, you should use the security mechanisms built into the native platform. Common security issues can be grouped into the following three areas:

  • Secure data handling
  • Application hardening
  • Third party applications

Secure data handling

Data storage APIs

  • You should not store sensitive information on a device when it's not required. If it must be stored on a device, make use of any native data storage protection APIs available on the platform.
  • Make a model of the data flow in and out of the device, taking into consideration realistic threats that the system (and its users) may encounter. Most platforms provide documented APIs that allow data to be stored with different levels of protection.
  • Always encrypt sensitive information when stored, protected by an authentication mechanism such as a passcode or platform-specific equivalent. When the sensitive data is no longer required on the device, it should be securely removed.
  • Ensure the applications allows administrators to delete sensitive data from devices if they are compromised or lost.

Cryptography

  • Secure implementation of cryptographic functions requires significant effort to properly design and verify, so wherever possible use native capabilities available on the platform.
  • If using non-native cryptographic schemes, ensure they are reviewed and tested by third party experts.
  • Storing cryptographic keys on the device will reduce the effectiveness of an additional cryptographic layer (as keys stored locally could be recovered from the device). Storing the keys on a remote server would prevent an attacker with physical access to the device from retrieving them. Users should be required to authenticate to the server. Alternately, you can use TPMs (trusted platform modules) and secure enclaves to improve the security of stored keys.

Data access authorisation

  • Store sensitive information securely, and hide it from the user until they have been authenticated (and authorised) to view it.
  • Perform user authentication using the native platform mechanisms, with each account being linked to an individual.
  • Where practical, manage user accounts centrally.
  • When the application has lost focus (or been backgrounded for a short amount of time), the authentication process should be repeated to ensure the identity or permissions of the current user have not changed.

Secure data transmission

  • Send any sensitive information transferred between device and server using an appropriate encryption mechanism. All modern platforms have built-in support for transport layer security (TLS), which is the NCSC's preferred option.
  • Restrict supported ciphers on both ends of the communication, so that only strong ciphers may be used. Take additional steps to maximise the security of the data connection, such as using certificate pinning to ensure the application connects to a host with a known, trusted certificate.
  • Never send sensitive data over an insecure or unencrypted connection, and where possible non-sensitive data should also be sent over a secure connection.
  • Alert the user if any suspicious attributes are detected that indicate the secure communication channel is under attack. In this case, the connection should be denied until a verified secure channel is available.

Session handling

  • Session handling requires appropriate controls to be placed on the backend server to which the application connects.
  • Ensure the backend server treats the application (and its user) as untrusted, until they can provide appropriate authentication.
  • Ensure that sessions timeout periodically and require the user or application to repeat the authentication process. 

Application hardening

Modern platforms typically avoid compiling applications to native code, instead preferring to use an intermediate language running in a container. However, it is possible, and sometimes necessary, to include native code components. As a developer you should be aware of the security differences between native and managed code. Principally, native code does not provide the same protections against memory mismanagement issues, such as buffer overflows and use-after-freevulnerabilities.

Stack protection

  • Compile native code portions of the application to take advantage of any protection mechanisms that are available on the platform.
  • Enable features such as Address Space Layout Randomisation (ASLR) and Stack Canaries during compilation in order to make the application more difficult to exploit. However, these should only be used to increase the effort needed to exploit vulnerabilities, and should not be solely relied upon to prevent exploitation.

Code obfuscation

You can take steps to make your applications more difficult to reverse engineer, but it's important that applications remain secure even when the entire system is understood by an attacker. As such, obfuscation techniques should only be considered to prevent the reverse engineering of technologies to safeguard (for example) intellectual property, and not to provide a robust security system. Even so, you can use obfuscation of both native and managed code to make reverse engineering attempts more difficult. This is also likely to increase the effort required for attackers to understand how to attack and break the application’s security model.

Jailbreak and root detection

Jailbroken or rooted devices are a threat to sensitive data they contain. As a method of hardening the application, consider implementing checks to detect if the device has been compromised. Detection will always be subject to circumvention by a determined attacker, however tests for common jailbreak and rooting methods allow for the application to take appropriate steps, such as alerting the user, or preventing the device from processing sensitive information.


Third party applications

You might be considering deploying third party applications on the same device as applications that handle sensitive data. The primary concerns here are:

  • protecting the enterprise network infrastructure from attack via the third party applications
  • preventing data from leaking from a sensitive datastore into a third party application

Modern platforms have built-in support for segregation of applications and users, which you should use wherever possible.

As the behaviour of third party applications cannot normally be modified, protection has to be provided elsewhere, via network protections and appropriate use of data-stores. Where possible, the developers of any third party applications should be approached in order to gain a deeper understanding of their product.

Applications that are likely to:

  • be sources of data leaks
  • track user movements
  • interfere with other applications

 - should not be installed. If software must be used despite security concerns that cannot be mitigated with technical controls, users should be given training on how best to manage the risk.


PAGE 3 OF 16

Android application development

Recommendations for the secure development, procurement and deployment of Android applications.

This guidance contains recommendations for the secure development, procurement and deployment of Android applications. Please familiarise yourself with the generic application development guidance before continuing.


PAGE 4 OF 16

Secure Android application development

How to securely develop an Android application, including how to store, handle or process sensitive data and the recommended network configuration.

1.1 Datastore hardening

Android, by default, provides each application on a device with access to a private directory to store its files. This protection is implemented using Linux user and group permissions. The security model is further enforced by applying Security-Enhanced Linux mandatory access control policies and leveraging a seccomp system call filter.

Android, as of version 7.0, on devices with file-based encryption (FBE), provides two storage locations on devices with FBE and Direct Boot. On FBE-enabled devices, developers should only store sensitive data in the Credential Encrypted (CE) storage.

Applications are able to access other areas of the device, such as contacts and SMS, by requesting permission from the user at runtime. The user can choose to permit the application access to areas such as the device’s calendar and phonebook, as well as features such as making phone calls or reading the current location. Once permitted, the application may use these features without further interaction from the user.

Despite protection offered by Android's sandboxing, it remains the responsibility of the application to store its data securely and to not undermine any protections that are in place by (for instance):

  • writing data to publicly readable locations such as the external storage
  • handling intents that can be called by any other application on the same device
  • creating files with world readable/writable permissions

Remember that a process running on the device with sufficient permissions, will always be able to read and write any data in any application’s sandbox. We strongly recommended that applications holding sensitive data should build upon the sandbox with more secure functionality by (for example) leveraging the hardware-backed KeyStore.

Ultimately, it is not possible to guarantee the security of data on a device. You should assume that if a user continues to use a device after it has been compromised, the malware will be able to access the data. Android provides an API called SafetyNet for assessing the health and safety of the device. This API examines both hardware and software information about the device, to help determine if it has been tampered with or otherwise modified. We recommend that application developers use the API, then send the signed SafetyNet API results to their own servers to be validated, rather than on the device. SafetyNet should be used as a means to gain confidence about the integrity of the device, but it is not guaranteed to detect a compromise.

1.2 Network protection

The diagram below, taken from the EUD Security Guidance for Android, illustrates the recommended network configuration for Android devices which handle sensitive information. In summary, a VPN is used to bring device traffic back to the enterprise. Access to internal services is brokered through a reverse proxy server, which protects the internal network from attack.


To prevent the application from accessing sensitive internal resources, it is important that the reverse proxy server authenticates any requests from devices. This means that applications on the device which are trusted to access sensitive data must provide authentication with each request so that the reverse proxy can validate the request. Stored credentials must be private to only the trusted applications accessing those resources.

Internet requests from the application should be routed via the standard corporate internet gateway, to permit traffic inspection.

1.3 Secure application development

The following section contains recommendations that an Android application should conform to in order to store, handle or process sensitive data. Many of these recommendations are general good-practice behaviours for applications on Android. A number of documented code snippets and examples are available on the Android developer portal.

Secure data storage

In order to store sensitive data in a secure manner, Android applications should conform to the following:

  • Applications should minimise the amount of data stored on the device. When needed, data should be retrieved from the server over a secure connection, and erased when it is no longer required.
  • Sensitive information, if required, should only be stored in the hardware-backed KeyStore.
  • The device’s external storage (for example the SD card) should not be used by the application to store sensitive data.

Server-side controls

Applications which store credentials should have robust server-side control procedures in place to revoke the credential, should the device or data be compromised.

Secure data transmission

In order to transmit sensitive data securely, Android applications should conform to the following:

  • All off-device communications handling sensitive data should take place over a mutually-authenticated, cryptographically protected, connection.
  • For TLS connections, the application should perform certificate pinning to a known endpoint. This process should leverage the Network Security Configuration. For more information refer to the NCSC’s TLS documentation.
  • Certificates used by the application should be stored on the device using the Android KeyStore provider.

Note that at present there is no API on Android to check the status of the VPN. To securely check the status of the VPN, the internal service with which the application is communicating must be authenticated. The recommended way of performing this authentication is TLS with a pinned certificate. If mutual authentication is required to the internal service, mutual TLS with pinned certificates should be used.

Application security

To hinder the exploitation of any potential memory corruption vulnerabilities, the following recommendations should be followed:
  • The application should be compiled using the latest supported compiler security flags.
  • The application should not be compiled with the debug flag enabled.
  • The application should not use any private APIs.
  • The application should be compiled in release mode with all debug information stripped from the binaries.
  • If Android Studio is used, it should be configured to shrink and optimise Java code.

Security recommendations

The behaviours listed below can increase the overall security of an application.

  • Any data that is deemed necessary to store on the device should be encrypted either with keys that are not stored on the device, or that are stored in the Android KeyStore. Furthermore, key attestation should be used when hardware-backed key storage is available.
  • Where possible, applications should sanitise in-memory buffers of sensitive data after use (if the data is no longer required for operation).
  • Applications that require authentication on application launch should also request this authentication credential when returning back to the foreground after previously being backgrounded by a user, allowing for a small grace period.
  • As the standard Android clipboard is shared between all applications on the device, do not not use it when accessing sensitive data. A private clipboard can be implemented if required by the application.
  • The application should disable both manual and automatic screenshots within activities that display sensitive data by setting secure flags of the window within the application.
  • Applications that use a shared UID will share the same sandbox. This means that if one application was compromised, all data in any application with a shared UID would also be compromised. Developers should share functionality between applications using intents, restricted by permissions.
  • Intents created for IPC between trusted applications should use signature permissions to restrict access by other applications on the device.
  • Applications that use Web Views should limit the features and capabilities to the minimum functionality required.The application should ensure that debugging output has been removed and sensitive information prevented from appearing within the device log files.
    • JavaScript and local file access should be disabled unless specifically required.
    • Caching should be disabled to prevent unnecessary exposure of sensitive data.
  •  
    • The application should ensure that debugging output has been removed and sensitive information prevented from appearing within the device log files.
Allmänt · ‽IT · ∴ · interrobangit · § · §IT
Dela · Kommentera  

:

Kommentera
Av Svenn Dybvik - 23 april 2023 00:00

https://www.ncsc.gov.uk/collection/application-development/android-application-development/questions-for-android-application-developers


PAGE 5 OF 16

Questions for application developers

When procuring an application built by a third party, ask developers these example questions to get an understanding of the security of their products.

For anyone procuring an application built by a third party, you can ask developers the example questions below. Their answers will help you gain more (or less) confidence about the security of their products.

The most thorough way to assess an application before deploying it would be to conduct a full source code review to ensure it meets the security recommendations and contains no malicious or unwanted functionality. Unfortunately, for the majority of third party applications, this will be infeasible or impossible. However, the responses from the third party should help provide confidence that the application is well written and likely to protect information properly.


2.1 Secure data storage

The following questions will help you establish how confident you can be that an Android application stores sensitive data securely.

https://www.ncsc.gov.uk/collection/application-development/android-application-development/questions-for-android-application-developers


2.2 Secure data transmission

The following questions will help you gain confidence in how Android applications transmit sensitive data securely:

https://www.ncsc.gov.uk/collection/application-development/android-application-development/questions-for-android-application-developers


2.3 IPC mechanisms

The following questions will help you gain confidence in how Android applications share sensitive data securely.

https://www.ncsc.gov.uk/collection/application-development/android-application-development/questions-for-android-application-developers


2.4 Binary protection

The following questions will help you gain confidence in how Android applications protect their data within a binary.

https://www.ncsc.gov.uk/collection/application-development/android-application-development/questions-for-android-application-developers


2.5 Server side controls

The following questions will help you gain confidence in how Android applications protect their data on the server side.

https://www.ncsc.gov.uk/collection/application-development/android-application-development/questions-for-android-application-developers


2.6 Client side controls

The following questions are will help you gain confidence in how Android applications protect their data on the client side.

https://www.ncsc.gov.uk/collection/application-development/android-application-development/questions-for-android-application-developers


2.7 Other

https://www.ncsc.gov.uk/collection/application-development/android-application-development/questions-for-android-application-developers



PAGE 6 OF 16

Secure deployment of Android applications

This section recommends how to securely deploy the application, should it be from third party organisation or via an in-house application.

3.1 Third party app store applications

Android supports a number of methods to install new third party applications. The following section divides these into two categories, trusted and untrusted:

Untrusted third party applications

Untrusted applications are those that have been produced by developers that your organisation does not have a relationship with. This includes applications hosted by both Google Play and on third party application stores. In these instances you should assume that the third party application may have unwanted functionality. While this functionality may not necessarily be malicious, these applications should be viewed as potential sources of leakage for sensitive data. You should evaluate whether or not an application can run on the device.

Network architecture components such as the reverse proxy can be used to help restrict third party applications from accessing corporate infrastructure. However, these features should be regarded as techniques to help mitigate the potential threat posed by the installation of third-party applications, they cannot guarantee complete protection.

The ideal method of mitigation is to not allow any third party applications to be installed on the device, though in reality this must be taken on a 'per application' basis. Where possible, developers of the application should be consulted in order to understand better the limitations and restrictions of the application. To help your evaluation, you can use the questions given above (feel free to ask more, these represent the minimum you should find out).

Trusted third party applications

You should learn as much as possible about the security posture of an application, so that the risks of deploying it can be understood and managed wherever possible. Your organisation should, ideally, establish a relationship with developers and work with them to understand how their product does (or does not) meet the security posture expected of it.

You should assess third party applications to decide whether the risk of having their code executing on your devices is outweighed by the benefits that the application brings to your organisation. If third party applications are to be permitted on devices with sensitive data, then the following steps should be taken:

  • Ensure that the applications holding sensitive data do not permit third party application access to the data, for instance making sure that the third party application is not included as one that the user can choose to open sensitive documents with.
  • Ensure that sensitive data would remain secure if the third party application were compromised. For instance, the data should not be accessible due to it being stored in a world-readable location on the device.

Where a third party application is being considered to manage sensitive data, you may also wish to consider commissioning independent assurance. This is particularly true if the application implements its own protection technologies (such as a VPN or data-at-rest encryption), and does not use the native protections provided by Android. Many enterprise applications feature server side components and when present, these should be considered as part of the wider risk assessment..

Private enterprise application catalogues can be created and managed using MDM solutions, allowing organisations to build a set of accepted third party and in-house applications that can either be installed on to every organisational device, or made available for employees to browse and choose to install manually.

Security considerations

When deploying third party applications, the primary concern for an organisation is determining whether these applications could affect the security of the enterprise network, or access data held in a sensitive datastore.

Malware and application level vulnerabilities are of particular concern when developing secure applications for Android. Secure applications must therefore pay particular attention when protecting data both in storage on a device and in transit, if third party applications are permitted on the same device.

You should also consider the security features of the devices that will host your application. A number of manufacturers offer custom security features to protect corporate data from other applications. If the application will only be used on these devices, then permitting third party applications on the same device may be deemed acceptable.

SECURITY REQUIREMENTS

Best practice when using third party applications is as follows:

  • Server side components such as a reverse proxy should be used to restrict network enterprise access to trusted applications.
  • The developers should be contacted in order to better understand the security posture of the application. Use the Questions for Application Developers section as your starting point.
  • Data should be protected from third party applications by restricting their access to sensitive data and functionality.

3.2 In-house applications

In-house applications are those designed and commissioned by an organisation to fulfil a particular business requirement. The organisation can stipulate the functional and security requirements of the application, and enforce these contractually if the development work is subcontracted.

The intention when securing these applications is to minimise the opportunity for data leakage from these applications and to harden them against physical and network-level attacks. For the purposes of this document, these applications are assumed to access, store, and process sensitive data.

SECURITY CONSIDERATIONS

Regardless of whether the application is developed by an internal development team, or under contract by an external developer, you should ensure that supplied binaries match the version which you were expecting to receive. Applications should then be installed onto managed devices through an MDM server or in-house enterprise application catalogue front-end, to gain the benefits of an application being enterprise managed.

SECURITY REQUIREMENTS

Both in-house and third party applications should be deployed directly to devices through an in-house enterprise application catalogue. This means they can be remotely managed, and kept separate from third party applications installed by the user.



PAGE 7 OF 16

Application wrappers

This section covers the different types of application wrappers, giving descriptions and the security considerations of each.

 

4.1 Security considerations

A variety of 'application wrapping' technologies exist on the market today. Whilst these technologies ostensibly come in a variety of forms which provide different end-user benefits, on most platforms (including Android) they essentially work in one of three ways.

Category 1: These provide a remote view of an enterprise service, for example a Remote Desktop view of a set of internal applications that are running at a remote location, or an HTML-based web application. Multiple applications may appear to be contained within a single application container, or may live separately in multiple containers to simulate the appearance of multiple native applications. Usually, only temporary cached data and/or a credential is persistent on the device itself.

Category 2: These are added to an application binary after compilation and dynamically modify the behaviour of the running application (for example to run the application within another sandbox and intercept and modify platform API calls) in an attempt to enforce data protection.

Category 3: The source code to the surrogate application is modified to incorporate a Software Development Kit (SDK) provided by the technology vendor. This SDK modifies the behaviour of standard API calls to instead call the SDKs API. The developer of the surrogate application will normally need to be involved in the wrapping process.

4.2 Security requirements

Category 1 technologies are essentially normal platform applications, but which store and process minimal information, deferring processing and storage to a central location. The development requirements for these applications are identical to other native platform applications. Developers should follow the guidelines given above.

Category 2and category 3 wrapping technologies are frequently used to provide enterprise management to applications via the MDM server that the device is managed by. SDKs are integrated into these MDM solutions and can be used to configure settings in the application or to modify its behaviour. For example, the application could be modified to always encrypt all data or not use certain API calls.

On Android, both category 2 and category 3 wrapping technologies require the surrogate developer’s co-operation to wrap the application into a signed package for deployment onto an Android device. As such, normally only custom developed in-house applications, and sometimes trusted third party applications (with co-operation) can use these technologies. As the robustness of these wrapping technologies cannot be asserted in the general case, they should not be used with an untrusted application; they should only be used to modify the behaviour of trusted applications, or for ease of management of the wrapped applications.

In-house applications should be developed specifically against the previously described security recommendations wherever possible. The use of app-wrapping technologies should only be used as a less favourable alternative method of meeting the given security recommendations where natively meeting them is not possible.

Ultimately, it is more challenging to gain confidence in an application whose behaviour has been modified by a category 2 technology. It is difficult to assert that dynamic application wrapping can cover all the possible ways an application may attempt to store, access and modify data. It is also difficult to make any general assertions about how any given wrapped application will behave. As such, the NCSC cannot give any assurances about category 2 technologies or wrapped applications in general, and hence cannot recommend their use as a security barrier at this time.

However, category 3 technologies are essentially an SDK or library which developers use as they would any other library or SDK. In the same way that the NCSC does not assure any standalone cryptographic libraries, we do not provide assurance in SDKs which wrap applications. The developer using the SDK should be confident of its functionality, as they would be with any other library.



PAGE 8 OF 16

Apple iOS application development

Recommendations for the secure development, procurement and deployment of Apple iOS applications.

This guidance contains recommendations for the secure development,procurement and deployment of iOS applications. Please familiarise yourself with the generic application development guidance section before continuing.

Regarding data at rest and keychain protection classes, the following terminology will be used:

https://www.ncsc.gov.uk/collection/application-development/apple-ios-application-development


Note that the other keychain classes have a ‘This device only’ counterpart. More information about these protection classes can be found within Apple’s security guide document and API documentation.

Allmänt · ‽IT · ∴ · interrobangit · § · §IT
Dela · Kommentera  
Ovido - Quiz & Flashcards