syssec_red_book

21. RISEPTIS Report• Taking advantage of the digital profile has severe consequences. A thirdparty can take advantage of public information in arbitrary ways, givingrise to numerous fraudulent possibilities for would-be identity-thieves.The weakest links in the data storage chain. Digital data can be stored onhigh-profile servers, where sophisticated security mechanisms are applied.However, it is still hard to guarantee that those data are never going to leak,since data are frequently transferred in data storage devices, such as CDs orUSB sticks. These devices offer easy physical access. An attacker can alterthe integrity of the data in transfer, break their confidentiality, or recycle thedata with malicious purpose. Data encryption, if effectively used, can reducesuch risks. However, data breach degrades the trust associated with victimcompanies or governments, even when the attacker reaps no practical benefit.21.2 RecommendationsThe report provided the following recommendations:“Recommendation 1: The EC should stimulate interdisciplinary research, technologydevelopment and deployment that addresses the trust and securityneeds in the Information Society. The priority areas are:• Security in (heterogeneous) networked, service and computing environments,including a trustworthy Future Internet,• Trust, Privacy and Identity management frameworks, including issuesof meta-level standards and of security assurances compatible with ITinteroperability,• Engineering principles and architectures for trust, privacy, transparencyand accountability, including metrics and enabling technologies (e.g.,cryptography),• Data and policy governance and related socio-economic aspects, includingliability, compensation and multi-polarity in governance and itsmanagement.”“Recommendation 2: The EC should support concrete initiatives that bring togethertechnology, policy, legal and social-economic actors for the developmentof a trustworthy Information Society. (The Partnership for Trust in Digital Lifecould be a first step.)”“Recommendation 3: The EC, together with the Member States and industrialstakeholders, must give high priority to the development of a common EUframework for identity and authentication management that ensures compliancewith the legal framework on personal data protection and privacy and128