Cybersecurity Framework for Mobile Credentials - Revision history

Tom: /* Other Material */

2024-02-28T00:36:02Z

‎Other Material

Tom: /* References */

2024-02-27T23:37:15Z

‎References

Tom: /* Forward Looking Evaluation */

2023-09-29T17:49:42Z

‎Forward Looking Evaluation

Tom: /* Backward Looking Evaluation */

2023-09-29T17:48:59Z

‎Backward Looking Evaluation

Tom: /* Forward Looking Evaluation */

2023-09-29T17:48:32Z

‎Forward Looking Evaluation

Tom: /* Backward Looking Evaluation */

2023-09-29T17:47:41Z

‎Backward Looking Evaluation

Tom: /* Full Title */

2023-03-02T19:36:56Z

‎Full Title

Tom: /* Gaps in Managing Cybersecurity Risks */

2023-03-02T19:35:12Z

‎Gaps in Managing Cybersecurity Risks

Tom: /* Gaps in Managing Cybersecurity Risks */

2023-03-02T19:34:08Z

‎Gaps in Managing Cybersecurity Risks

Tom: /* Gaps in Managing Cybersecurity Risks */

2023-03-02T19:33:26Z

‎Gaps in Managing Cybersecurity Risks

← Older revision		Revision as of 00:36, 28 February 2024
Line 143:		Line 143:

	[[Category: Identity Management]]		[[Category: Identity Management]]
		+	[[Category: Mobile]]

@@ Line 138: / Line 138: @@
 ==References==
 <references />
+===Other Material===
-This page is kept updated at https://tcwiki.azurewebsites.net/index.php?title=Cybersecurity_Framework_for_Mobile_Credentials
+* See also the wiki page on [[Wallet Requests]] for messages between the verifier and the wallet.
 [[Category: Identity Management]]

@@ Line 131: / Line 131: @@
 ====Forward Looking Evaluation====
-This type of evaluation looks at a specific solution using a risk-based analysis.
+This type of evaluation looks at a specific solution using a risk-based analysis to identify vulnerability points of the design and implementation of the solution.
 ==Monitor, Evaluate and Adjust==

@@ Line 128: / Line 128: @@
 ====Backward Looking Evaluation====
-This type of evaluation looks at the current attacks against security to determine if the framework can mitigate know attacks.
+This type of evaluation looks at the current attacks against security to determine if the framework can mitigate known attacks.
 ====Forward Looking Evaluation====

← Older revision		Revision as of 17:48, 29 September 2023
Line 131:		Line 131:

	====Forward Looking Evaluation====		====Forward Looking Evaluation====
		+	This type of evaluation looks at a specific solution using a risk-based analysis.

	==Monitor, Evaluate and Adjust==		==Monitor, Evaluate and Adjust==

← Older revision		Revision as of 17:47, 29 September 2023
Line 128:		Line 128:

	====Backward Looking Evaluation====		====Backward Looking Evaluation====
		+	This type of evaluation looks at the current attacks against security to determine if the framework can mitigate know attacks.

	====Forward Looking Evaluation====		====Forward Looking Evaluation====

@@ Line 1: / Line 1: @@
 ==Full Title==
 A cyber security analysis of privacy enhancing mobile credentials issued to residents by a sovereign entity for the purposes of granting access to controlled privileges with identity assurance appropriate to the value of the license granted.
 ==Context==
 Following in the model of the evolving NIST cyber security framework, this analysis will begin with a full system risk model, including the risk of alienating an already anxious public given the insecurity of existing digital databases.

@@ Line 34: / Line 34: @@
 ==Gaps in Managing Cybersecurity Risks==
-The effect of uncertainty on [[Enterprise]] mission and business objectives may then be considered an “enterprise risk” that must be managed. <ref name=NISTIR /> That is the stated goal, but the result is most often just the creation of a check list that the enterprise can complete and then claim that they are secure. Clearly that approach is not working and a new one is required. To be secure any cybersecurity framework needs to be backed into the development process starting when the architecture is created up to the point where customer documentation is created. The followup steps are well considered in the framework.
+The effect of uncertainty on [[Enterprise]] mission and business objectives may then be considered an “enterprise risk” that must be managed. <ref name=NISTIR /> That is the stated goal, but the result is most often just the creation of a check list that the enterprise can complete and then claim that they are secure. Clearly that approach is not working and a new one is required. To be secure any cybersecurity framework needs to be baked into the development process starting when the architecture is created up to the point where customer documentation is created. The followup steps are well considered in the framework.
 * Identifying the risks including the (financial and reputational) cost and likelihood of occurrence.  The biggest problem with a checklist is that it looks like something that happens after the product is completed and ready for deployment.
 ** Compliance with all regulations, including the ability to report on who had access to what and when. In some cases, like the SEC, that access must be fast and complete to assure that disclosure laws were followed.