Report - Guardian

188 The LSE Identity Project Report: June 2005- The system will have to accept and respond to hundreds or even thousands ofidentity enrolment and verification requests each minute; enrolment requestswill involve a large processing load and a proportion will require costly and timeconsuming manual intervention;- All personnel involved with the system will need to be security vetted to preventcriminal infiltration of NIR operations or ‘insider’ attacks.Most experienced systems designers will immediately recognise that this combinationof requirements poses an extreme challenge even without the security requirements.Even if the security requirements are undertaken the system becomes infeasible unlesssubstantial pruning and simplification is undertaken.The following sections will consider security and safety aspects of the proposal andsome of the dilemmas that will be faced if a system of this scale and complexity ispursued.Secure Information SystemsSince many governments have recognised the need for secure computer systems,internationally recognised criteria have been created to describe the ‘security quality’achieved by computer systems. In the UK, the Communications Electronic SecurityGroup (CESG) administers the UK's contribution to this field. 462The basic principle used is that if a computer system faces higher security risks, it willneed to be of higher security quality in order to counter them (the technical term used todescribe security quality is ‘security assurance’). Typical factors that increase the risks,and hence the security assurance needed, are:1. the scale and the complexity of the system2. the number of users3. the security sensitivity of data held on the system4. whether it has connections to other computer systems, especially untrusted ones5. whether it is connected to the Internet6. whether it is likely to be an attractive target for attackThe security assurance levels used for assessing computer systems range from EAL 0,which is ‘inadequate assurance’, to EAL 7, which is the highest assurance that isconsidered to be practical (which can only be achieved in small, simple systems). 463Systems of the character of the National Identity Register are large, complex systemsthat hold considerable quantities of sensitive data. Such systems also face high levels ofsecurity risk because of their connections to other computers, and even to the Internet.The general view is that such systems require the highest levels of security assurance atEAL 6 or higher, but there are no systems of this character on the market that are higherthan EAL 4. For example, the UK certified products list 464 contains no operatingsystems and no databases with security qualities above EAL 4, which is two or more462 http://www.cesg.gov.uk/site/iacs/463 http://www.cesg.gov.uk/site/iacs/index.cfm?menuSelected=1&displayPage=13464 http://www.cesg.gov.uk/site/iacs/index.cfm?menuSelected=1&displayPage=151