DSM 2014/4

Main topic: Human factor in information security

 PUBLISHED: 4.12.2014

  These articles were subject to peer-to-peer review

Interview with Petr Nobst
[Page 6]
Petr Hampl
If you never bought any toys for your people, there would be no technological innovations, says Mr. Petr Nobst, financial director of Pleas, a leading Czech textile company, in his interview for DSM. He explains his view on his company's information asset protection in general, and in particular on issues such as mobile security and cloud computing.

Interview with Jan Ellermann
[Page 10]
Petr Hampl
An expert at the Information Protection Office at Europol, Jan claims that information quality and information security are just different aspects of the same issue. He also speaks about data classification and user training, as well as employee behavior on social networks. In addition, he claims that there is no contradiction between personal data protection and effective prosecution.

Employees as a security risk
[Page 14]
Jana Spoustová
The first part of the article is focused on defense measures against unintentional breaches of information security, namely training, internal communication, ethical codex and non-disclosure clauses. The second part discusses intentional security breaches caused by employees.

Case study: The implementation of digital signatures at O2
[Page 22]
Aleš  Bernášek
The second part of the case study describes the key principles of the implemented solution, the technical architecture and the selection of signature hardware. It also informs about the key processes supported by the solution and sums up the lessons learnt.

The current state of IPv6
[Page 28]
Petr Fojtů
The article discusses explicit security elements, such as IPsec and SeND, as well as elements with implicit impact. It also informs about the latest developments. The last section of the text is focused on the practical aspects of the transition from IPv4 to IPv6.

IP addresses in personal data protection
[Page 31]
Josef Prokeš
A senior expert of the Czech Data Protection Authority explains the point of view of European bodies. He also informs about some problems and issues connected to so called pseudonymisation and the possible impacts on the European Court of Justice.

Key rules of biometric data protection
[Page 34]
Roman Cinkais
In spite of all of its benefits, biometry creates a new risk – the potential abuse of biometric data on users. The article lists the most frequent ways of compromising data, defines the required features of biometry systems and focuses on two key issues, biometric data scanning and insufficient information about biometric security products.

Theorems for the successful implementation of SIEM
[Page 38]
Karel Šimeček
The author explains the basic principles on which SIEM systems are based. He demonstrates that ignoring these principles results in implementations failing. Special attention is paid to the requirement of SIEM implementation into the application layer of ERP and the risk of flooding SIEM during DDoS attacks.