Towards a Baltic Sea Region Strategy in Critical ... - Helsinki.fi

CRITICAL INFRASTRUCTURE PROTECTION IN THE BALTIC SEA REGION
different agencies are afforded the same privacy and resources as they would in
dedicated networks, via strong guarantees on data protection and provision of
high-speed data services.
Example use of VIRVE is the integration of VIRVE with the 15 Emergency
Response Centers (ERC) spread across Finland (Juvonen 2005; Vilppunen 2005).
The ERCs receive about two million ambulance police or rescue-related phone
calls made by the public to the 112 emergency number and forwards them to the
appropriate agency via VIRVE. Another example of the use of VIRVE is by the
Radiation and Nuclear Safety Authority (STUK) that has a mission to prevent and
limit the harmful effects of radiation. Radiation measurement data is gathered
every 10 minutes from around 200 monitoring stations in Finland. This data is then
relayed by telemetry modules to STUK and local ERCs via VIRVE using TETRA
IP packet data transfer and SDS messaging as backup (Vesterbacka 2007).
Security assessment methodologies
The increased ubiquity, diverse features and functionality of information systems
have been accompanied by the increase in complexity of implementing necessary
security measures. This has created a need for security frameworks to provide a
streamlined way for assessing and analyzing information system security taking
into account: threats and attacks, vulnerabilities, and security (detection,
correction and prevention) measures. To that end, a range of security assessment
methodologies have been proposed, such as the following:
• CORAS: a UML-like model-based method for analyzing threats and risks
developed by the EU-funded CORAS project.(CORAS 2006)
• OCTAVE®: “Operationally Critical Threat, Asset, and Vulnerability
Evaluation” method is developed by Carnegie Mellon CERT
Coordination Centre (CERT 2003).
• STRIDE: “Spoofing, Tampering, Repudiation, Information disclosure,
Denial of Service and Escalation of privileges” method developed by
Microsoft (Hernan et al 2006).
• EBIOS: “Expression of Needs and Identification of Security Objectives”
method developed by developed by the France’s Central Information
Systems Security Division (Central Information Systems Security
Division 2005).
• eTVRA: eEurope secure and trusted infrastructure Threat, Vulnerability
and Risk Assessment method being developed by Specialist Task Force
(STF) 292, associated with Telecoms & Internet converged Services &
Protocols for Advanced Networks (TISPAN) standardization body of
ETSI (Judith et al 2007).
The focus of this report is on the assessment methodology based on the ITU-T
X.805 security architecture (ITU-T 2003) that was originally developed and
presented for standardization by Lucent Technology (formerly known as Bell
Labs, now Alcatel-Lucent). The architecture was also later accepted by the
International Organization for Standardization (ISO) and the International
Electrotechnical Committee (IEC) as the basis of a joint enterprise standard,
ISO/IEC 18028-2.77 (ISO/IEC 2005).
110 NORDREGIO REPORT 2007:5