by Katharina Schuldt
Global networking has developed rapidly in recent years, but security has not been able to keep up with this pace. 20 years ago, Sandworm and WannaCry might have been considered names for cartoon characters or children’s toys. Today, they are known to almost everyone as an example of the most violent hacking attacks in history, which caused extensive damage worldwide.
Security by Design
How do we prevent the misuse of our data? Let’s take a closer look at how global players guarantee data security and what standards they work with. The security specialist, mechanical engineer and software provider Mühlbauer in Roding, Germany, offers complete solutions for border crossing security systems, e.g. for airports. The company strictly advises against first developing a product or process and then protecting it against cyber attacks afterwards. At Mühlbauer, all protective measures are already considered and sensibly integrated during development. The key term here is “security by design”. For example, networks are separated right from the start and connections are only created where they are needed. This means that data and information only reaches people they are intended for. The general rule here is: When handling, managing and sharing data, only authorized users should be able to access the information – confidentiality and integrity are top priorities.
To ensure this, Mühlbauer equips its software with a public key infrastructure that enables digital certificates to be generated, distributed and verified. A public key, for instance, is used for encryption, a private key for decryption. The so-called Trusted Root Certificates may only be issued by specified Certification Authorities and, of course, may only be viewed and edited by authorized persons. All actions taken are traceable and cannot be denied. This creates a transparent Chain of Trust that immediately exposes manipulation or attacks by non-authorized parties.
“I am not worth the attack”
Furthermore, Mühlbauer attaches importance to reducing the attractiveness of each network. Decentralized systems do not offer as much loot as centralized, all-encompassing databases, and are not quite as rewarding for hackers. This is particularly important for networks dealing with highly sensitive documents such as digital identity documents, for which the German government has just decided to put them on an equal footing with physical identity documents (ID card and passport).
To stop wasting further cartoon character names on cyber attacks, we have to consider and take all the necessary actions as soon as we create a system. At a time when more and more countries are laying the basis for digital IDs and using it for Identification for online transactions, cyber security can no longer play a secondary role.
