<?xml version="1.0" encoding="utf-8" ?>
<rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:syn="http://purl.org/rss/1.0/modules/syndication/" xmlns="http://purl.org/rss/1.0/">




    



<channel rdf:about="http://www.opensecurity.at/blog-kollektion/RSS">
  <title>Blog-Kollektion</title>
  <link>http://www.opensecurity.at</link>

  <description>
    
      
    
  </description>

  

  
            <syn:updatePeriod>daily</syn:updatePeriod>
            <syn:updateFrequency>1</syn:updateFrequency>
            <syn:updateBase>2013-06-11T14:25:44Z</syn:updateBase>
        

  <image rdf:resource="http://www.opensecurity.at/logo.png"/>

  <items>
    <rdf:Seq>
      
        <rdf:li rdf:resource="http://www.opensecurity.at/news/further-development-of-opensecurity"/>
      
      
        <rdf:li rdf:resource="http://www.opensecurity.at/news/opensecurity-the-open-source-solution-for-increasing-your-organisations-it-security"/>
      
      
        <rdf:li rdf:resource="http://www.opensecurity.at/news/data-information-and-system-security"/>
      
      
        <rdf:li rdf:resource="http://www.opensecurity.at/news/reliable-open-source-solutions-for-organisations"/>
      
      
        <rdf:li rdf:resource="http://www.opensecurity.at/news/opensecurity-1-0-released-1"/>
      
      
        <rdf:li rdf:resource="http://www.opensecurity.at/news/preview-opensecurity-at-the-d-a-ch-2014-conference"/>
      
      
        <rdf:li rdf:resource="http://www.opensecurity.at/news/webinar-presenting-opensecurity"/>
      
      
        <rdf:li rdf:resource="http://www.opensecurity.at/news/presentation-at-the-open-commons_congress-2014"/>
      
      
        <rdf:li rdf:resource="http://www.opensecurity.at/news/social-scientific-accompanying-research"/>
      
      
        <rdf:li rdf:resource="http://www.opensecurity.at/news/malware-and-threat-protection-in-opensecurity"/>
      
      
        <rdf:li rdf:resource="http://www.opensecurity.at/news/opensecurity-open-source-security-solutions-protecting-employees-and-data-in-public-institutions-2"/>
      
      
        <rdf:li rdf:resource="http://www.opensecurity.at/news/use-case-from-the-viewpoint-of-ikt-sicherheit-bmlvs"/>
      
      
        <rdf:li rdf:resource="http://www.opensecurity.at/news/technical-aspects-of-the-opensecurity-project"/>
      
      
        <rdf:li rdf:resource="http://www.opensecurity.at/news/opensecurity-open-source-security-solutions-protecting-employees-and-data-in-public-institutions-1"/>
      
      
        <rdf:li rdf:resource="http://www.opensecurity.at/news/weiterfuhrung-des-projekts-opensecurity"/>
      
    </rdf:Seq>
  </items>

</channel>


  <item rdf:about="http://www.opensecurity.at/news/further-development-of-opensecurity">
    <title>Further development of OpenSecurity</title>
    <link>http://www.opensecurity.at/news/further-development-of-opensecurity</link>
    <description>The project partners AIT Austrian Institute of Technology GmbH and X-Net Services GmbH will pursue OpenSecurity in terms of cooperation and bring it to the market as a product.</description>
    <content:encoded xmlns:content="http://purl.org/rss/1.0/modules/content/"><![CDATA[<p>The consortium plans to bring OpenSecurity as a product to the market. In addition the consortium plans to develop the prototype further on a European level by involving international experts, research institutes, and companies. In an EU-project the consortium hopes to extend the current network and to bring the subject matter closer to Big Data. The aim is to strengthen Europe’s competence in security related areas and to create a Europe-wide unified standard. In this manner, public authorities and institutions managing sensitive private data should be able to secure maximum protection.</p>
<p>The project partners AIT Austrian Institute of Technology GmbH and X-Net Services GmbH will pursue OpenSecurity in terms of cooperation and bring it to the market as a product. To this end the prototype will be adapted to the needs of the stakeholders (i.e. public institutions and commercial large scale enterprises).</p>
<table align="center" class="invisible">
<tbody>
<tr>
<th><img class="image-inline" src="../resolveuid/9dcc14b26c884617af30cce469fd2d7a/@@images/image/mini" /></th><th><img class="image-right" src="../resolveuid/25b2133605a042ea952b462a2c68432a/@@images/image/thumb" /></th>
</tr>
</tbody>
</table>
<p>Thanks to the complementary strengths of the project partners AIT Austrian Institute of Technology GmbH and X-Net Services GmbH, further development of OpenSecurity in terms of a cooperation model is an ideal basis for the success of the Open Source based solution.</p>
<ul>
<li>X-Net Services GmbH has high level expertise in the implementation of large projects and especially in First and Second Level Support, which plays a major role in such projects. X-Net Services GmbH is in direct contact with customers ensuring a smooth cooperation and system maintenance. If required, X-Net Services GmbH can also adapt and newly implement OpenSecurity solutions within their sphere of competence.</li>
<li>AIT Austrian Institute of Technology GmbH acts as integrator with good contacts to industry and a solid reputation. Due to its large number of highly qualified developers, AIT Austrian Institute of Technology GmbH can acquire and promote large projects, and adapt OpenSecurity to the customers’ needs.</li>
</ul>]]></content:encoded>
    <dc:publisher>No publisher</dc:publisher>
    <dc:creator>Michela Vignoli</dc:creator>
    <dc:rights></dc:rights>
    
      <dc:subject>English</dc:subject>
    
    <dc:date>2014-11-28T09:30:00Z</dc:date>
    <dc:type>News Item</dc:type>
  </item>


  <item rdf:about="http://www.opensecurity.at/news/opensecurity-the-open-source-solution-for-increasing-your-organisations-it-security">
    <title>OpenSecurity: The Open Source Solution for Increasing Your Organisation's IT-Security</title>
    <link>http://www.opensecurity.at/news/opensecurity-the-open-source-solution-for-increasing-your-organisations-it-security</link>
    <description>OpenSecurity offers its stakeholders not only a tool to impede data transfer, but at the same time builds a barrier for employees, which prevents them from sharing data deliberately and protects them from sharing data unintentionally and unknowingly (e.g. by means of malware infected USB-sticks, malware, insecure internet usage, or loss or theft of insecure media).</description>
    <content:encoded xmlns:content="http://purl.org/rss/1.0/modules/content/"><![CDATA[<p>Protection of personal and sensitive data finally came to the centre of attention when numerous internal and secret documents attesting the extent of surveillance practices by the United States National Security Agency (NSA) as well as the rest of the worldwide data espionage community were published. OpenSecurity offers its stakeholders not only a tool to impede data transfer, but at the same time builds a barrier for employees, which prevents them from sharing data deliberately and protects them from sharing data unintentionally and unknowingly (e.g. by means of malware infected USB-sticks, malware, insecure internet usage, or loss or theft of insecure media).</p>
<p>OpenSecurity points out that not all personal data and its interconnections should be freely accessible. Sensitive data as well as inferences from that data related to individuals and their preferences, characteristics, etc. must be safeguarded.</p>
<p>Both the results of the survey and the interviews, which have been conducted with IT-experts from the Linz City Administration and the Austrian Federal Ministry of Internal Affairs in the context of OpenSecurity, suggest distinctly that security aspects of IT-infrastructure in the public sector have gained momentum during the last years. We can assume that the situation is very similar in other public authorities and agencies – provided that those are of a similar size. In addition to the federal agencies (e.g. ministries, courts) and the state institutions (e.g. federal governments, regional courts, and state police departments), the regional administrative authorities and magistrates of bigger cities can be considered as potential prospects as well. Moreover OpenSecurity can be employed in public institutions like universities, museums or libraries. OpenSecurity can be adapted to the needs of larger NGOs/NPOs or commercial enterprises as well.</p>
<p>The software solution has the potential to expand to at least the German-speaking market. To introduce OpenSecurity to the international market the consortium plans to pursue the project on an EU level. The aim is to create a unified EU-standard for the public area as well as for offices and authorities.</p>
<p>Some features of OpenSecurity, which have an impact on the development of its potential, relate to its Open Source based approach.</p>
<ul>
<li><b>Market situation</b>: OpenSecurity is a valuable alternative to other currently available IT-security solutions, e.g. safe-browsing solutions like <a href="http://www.sirrix.de/content/pages/BitBox.htm">Bitbox</a> (Sirrix), <a href="https://surfcanister.com/surfcanister-new/technology">SurfCanister</a> (Quick Heal Technologies), or <a href="http://www.sandboxie.com/">Sandboxie</a> (Sandboxie Holdings).</li>
<li><b>Implementation</b>: OpenSecurity makes an unobtrusive integration into existing infrastructures possible. Smooth transfer and migration of single use cases on a large scale is possible during on-going operations. The administrative effort for migrating to OpenSecurity, or for a first installation of the Open Source solution is not more laborious than the change to a similar proprietary product.</li>
<li><b>Economical benefits</b>: The software is available Open Source and <a href="http://www.opensecurity.at/download">can be downloaded for free from the website</a>. The public sector can profit from savings mainly related to no licensing fees and low costs for further development. OpenSecurity can be fully integrated with existing IT-structures independently from the operating system, and can be adapted to existing usability and accustomed workflows. This means that for training only low or no costs can be expected.</li>
</ul>]]></content:encoded>
    <dc:publisher>No publisher</dc:publisher>
    <dc:creator>Michela Vignoli</dc:creator>
    <dc:rights></dc:rights>
    
      <dc:subject>English</dc:subject>
    
    <dc:date>2014-11-28T09:24:05Z</dc:date>
    <dc:type>News Item</dc:type>
  </item>


  <item rdf:about="http://www.opensecurity.at/news/data-information-and-system-security">
    <title>Data, Information and System Security</title>
    <link>http://www.opensecurity.at/news/data-information-and-system-security</link>
    <description></description>
    <content:encoded xmlns:content="http://purl.org/rss/1.0/modules/content/"><![CDATA[<p>Information and Communication Technologies are being increasingly used in almost all social and economic areas. This has led to extensive changes during the last decades, e.g. in terms of optimising production processes or establishing new distribution models. The thereby created diverse and more flexible configuration possibilities are paralleled by a loss of control and security. That is why numerous security solutions have been developed to support this sector. The aim of IT-security is to protect organisations and humans from harm through failure, manipulations or abuse, which notably occurs in case of information- and data loss.</p>
<table align="center" class="invisible">
<tbody>
<tr>
<th><img class="image-inline" src="../resolveuid/a0c2d43bfb554d0ebffaffc8fa6318fb/@@images/image/preview" /></th>
</tr>
<tr>
<td style="text-align: right; ">
<p>Image by <span class="meta-field photo-desc"><a href="http://www.perspecsys.com" rel="nofollow">www.perspecsys.com</a> License: CC-BY-SA<br /></span></p>
</td>
</tr>
</tbody>
</table>
<p>In a nutshell, IT-security is about safe interaction with information and data. Risks and threats for IT systems always rise at the level of information or at transition points and interfaces where information is transformed from one form into another. An example is user authentication by password entry. A professional IT-security management must ensure protection of IT systems and information during their whole lifecycle, from data creation to editing, transfer, and storage, and finally to deletion.</p>
<p>The Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik - BSI) in Germany lists five different threat categories in their baseline security manual. In general all ofthese threats can be attributed to a missing or inadequate IT-security concept. This comprises in particular IT-infrastructure security (e.g. server, network, computer, and mobile devices), building security, data security, computer virus protection, communication security (e.g. telephone, fax, e-mail, and internet), and contingency plans.</p>
<p>To minimise the risks, IT-security requires a comprehensive analysis of the organisation’s IT-structures and IT-systems. In addition to the exact definition of the devices and resources to be included (e.g. IT-systems, IT-infrastructure, processes) risk analysis is a key feature in order to establish the IT-security concept as substantial part of a risk management process. Such an IT-security concept must describe responses to potential risks and has to meet other requirements, in particular performance targets and quality or architecture requirements.</p>]]></content:encoded>
    <dc:publisher>No publisher</dc:publisher>
    <dc:creator>Michela Vignoli</dc:creator>
    <dc:rights></dc:rights>
    
      <dc:subject>English</dc:subject>
    
    <dc:date>2014-11-28T09:10:00Z</dc:date>
    <dc:type>News Item</dc:type>
  </item>


  <item rdf:about="http://www.opensecurity.at/news/reliable-open-source-solutions-for-organisations">
    <title>Reliable Open Source Solutions for Organisations</title>
    <link>http://www.opensecurity.at/news/reliable-open-source-solutions-for-organisations</link>
    <description></description>
    <content:encoded xmlns:content="http://purl.org/rss/1.0/modules/content/"><![CDATA[<p>Open Source Software (OSS) is an established alternative to commercial software in many application areas. There are many reasons for applying OSS in public institutions, in particular due to their cost-effective integration into existing IT-systems. The liberty to further develop the software gives public institutions the possibility to remain more independent, as they can adapt the employed OSS either by themselves or commission external developers to do so. In a study by the Fraunhofer Institute for Labour-Economy and Organisation (Fraunhofer Institut für Arbeitswirtschaft und Organisation) published in 2006, both cutting license costs and achieving independence from software producers were listed as main goals for public institutions in Germany. More arguments for employing OSS, in addition to economic aspects, are better access to open standards and requests for higher data protection and IT-security.</p>
<p>During the last years a number of public institutions in European cities and communities have successfully integrated Open Source Software in their IT landscape. Renowned examples are Munich (LiMux with Ubuntu Linux, KDE, OpenOffice, Gimp), Leipzig (OpenOffice), Schwäbisch Hall (SUSE Linux, KDE and OpenOffice) or Treuchtlingen (Linux, KDE, Gimp, Scribus, and Inkscape).</p>]]></content:encoded>
    <dc:publisher>No publisher</dc:publisher>
    <dc:creator>Michela Vignoli</dc:creator>
    <dc:rights></dc:rights>
    
      <dc:subject>English</dc:subject>
    
    <dc:date>2014-11-28T08:56:51Z</dc:date>
    <dc:type>News Item</dc:type>
  </item>


  <item rdf:about="http://www.opensecurity.at/news/opensecurity-1-0-released-1">
    <title>OpenSecurity 1.0 released</title>
    <link>http://www.opensecurity.at/news/opensecurity-1-0-released-1</link>
    <description></description>
    <content:encoded xmlns:content="http://purl.org/rss/1.0/modules/content/"><![CDATA[<p>OpenSecurity Version 1.0, released as Beta Software, fulfils a majority of the requirements defined within the scope of the project. Still open requirements have been addressed and are available as concepts, which can be implemented through specific extensions to the OpenSecurity framework. Thus an optimal adaptation to individual customers’ needs and infrastructure is possible. <a href="http://www.opensecurity.at/download">Link to Download</a></p>
<p style="text-align: center; "><img src="http://www.opensecurity.at/newsletter/bilder/opensecurity-logo" title="OpenSecurity Logo" class="image-inline" alt="OpenSecurity Logo" /></p>
<p>The <a href="http://www.opensecurity.at/use-cases/secure-usb-1" class="internal-link"><i>Secure USB</i></a> and <a href="http://www.opensecurity.at/use-cases/secure-web-browsing-1" class="internal-link"><i>Secure Web Browsing</i></a> features have been integrated with an existing Windows-interface and with Windows user workflows. Data import and -export occur via the Windows Explorer. The Secure Browser opens as a window on the desktop and persists user bookmarks. In both mechanisms the user does not need to deal directly with the SecureVirtualMachine. If necessary the OpenSecurity user is being guided through any required steps by tray-notifications and dialogues.</p>
<p>OpenSecurity was tested under normal office conditions by the stakeholder IKT Linz. Additional requirements on the existing infrastructure could be modularly and flexibly implemented.</p>
<h3>Secure USB</h3>
<p>The current version of OpenSecurity allows data import from both unencrypted and encrypted USB-sticks. Imported data is automatically (and potentially centrally, if so configured) virus- and malware scanned. If a potential virus or malware is detected by the system, access to the data is denied. Potential viruses/rootkits that automatically activate upon access, can – if they are able to run on a Linux-system at all – only harm the used disposable SecureVirtualMachine, and not the user workstation.</p>
<p>It is also possible to export data to a USB-stick. In this case the user is requested to initialise the stick with an encrypted container. This way OpenSecurity prevents data loss by prohibiting export to devices other than encrypted USB-sticks.</p>
<p>In addition, it is possible for all data transactions to be recorded on a central logging- or monitoring server. In this way, potential data losses can be tracked.</p>
<p><img src="http://www.opensecurity.at/newsletter/bilder/os-secure-file/@@images/a17cb91d-698f-407e-befb-0512f0de1813.png" title="OS Secure File" class="image-inline" alt="OS Secure File" /></p>
<h3>Secure Web Browsing</h3>
<p>By clicking the desktop- or tray-icon, the user can start the Secure Browser. In OpenSecurity Version 1.0 the open browser Chromium is being used. The browser is executed within a SecurityVirtualMachine, which is graphically integrated with the Windows-interface. It opens as a standard browser window in the usual desktop environment.</p>
<p>Also in this case a virus or malware attack originating from the browser can only affect the SecurityVirtualMachine and cannot contaminate the user workstation. Data from the browsing session can only be transferred via similar mechanisms and security measures as in the USB data import/export feature.</p>
<p><img src="http://www.opensecurity.at/newsletter/bilder/os-secure-browsing/@@images/2a7a0846-c9c5-4fd7-b743-e1e2d29c410f.png" title="OS Secure Browsing" class="image-inline" alt="OS Secure Browsing" /></p>]]></content:encoded>
    <dc:publisher>No publisher</dc:publisher>
    <dc:creator>Michela Vignoli</dc:creator>
    <dc:rights></dc:rights>
    
      <dc:subject>English</dc:subject>
    
    <dc:date>2014-11-28T08:55:00Z</dc:date>
    <dc:type>News Item</dc:type>
  </item>


  <item rdf:about="http://www.opensecurity.at/news/preview-opensecurity-at-the-d-a-ch-2014-conference">
    <title>Preview: OpenSecurity at the D.A.CH 2014 Conference</title>
    <link>http://www.opensecurity.at/news/preview-opensecurity-at-the-d-a-ch-2014-conference</link>
    <description>On September 16 the OpenSecurity Team will present a paper on Security by Isolation Principles in Public Administration at the D.A.CH. Security Conference 2014 in Graz.</description>
    <content:encoded xmlns:content="http://purl.org/rss/1.0/modules/content/"><![CDATA[<p>OpenSecurity protects users against potentially harmful internet resources and malware on USB removable storage devices as well as the unintentional disclosure of confidential information. With OpenSecurity each computer of an organisation is prevented from exchanging data in an uncontrolled manner. By means of virtualisation the system is extended with separate isolated subsystems – e.g. for <a href="resolveuid/799a46c8158842a4bdd2eeaea3259eb2" class="internal-link">safe internet-browsing</a>, or <a href="resolveuid/c744fa9eda4e4d0eac39b20c3ec0e96f" class="internal-link">accessing data on removable storage devices</a>.</p>
<p><img class="image-inline" src="resolveuid/b4543a260575408b8d8d949bbf38de58/@@images/image/preview" /></p>
<p style="padding-left: 30px; "><i>Figure 1: Secure Web Browsing</i></p>
<p> </p>
<p><img class="image-inline" src="resolveuid/a5ce9603e60f43d48b5da49f1cce33fe/@@images/image/preview" /></p>
<p style="padding-left: 30px; "><i>Figure 2: Secure USB</i></p>
<p>As a result, even if a virus is not detected by <a href="resolveuid/10f532b1e5994e349bd8b2f5d662c181" class="internal-link">antivirus software</a> the malware remains enclosed within OpenSecurity‘s isolated virtual machines, and due to the short lifecycles of the orchestrated disposable virtual machines, any malware is quickly disposed of. These features are important for public administration in particular, as these organisations often manage private citizen data. OpenSecurity users profit from the possibility to work safely with resources from unsafe networks within their institutional environment. OpenSecurity is an open source solution, which allows a smooth transfer and migration of single use cases on a large scale during business. Any application in standard subsystems can be transferred and run independently of the operating system – and therefore safely.</p>
<p>Link to the <a class="external-link" href="http://www.syssec.at/dachsecurity2014/">D.A.CH. Security Conference</a></p>]]></content:encoded>
    <dc:publisher>No publisher</dc:publisher>
    <dc:creator>Michela Vignoli</dc:creator>
    <dc:rights></dc:rights>
    
      <dc:subject>English</dc:subject>
    
    <dc:date>2014-08-06T13:35:00Z</dc:date>
    <dc:type>News Item</dc:type>
  </item>


  <item rdf:about="http://www.opensecurity.at/news/webinar-presenting-opensecurity">
    <title>Webinar presenting OpenSecurity</title>
    <link>http://www.opensecurity.at/news/webinar-presenting-opensecurity</link>
    <description>Access the video of the webinar online.</description>
    <content:encoded xmlns:content="http://purl.org/rss/1.0/modules/content/"><![CDATA[<p>The webinar details how the project OpenSecurity provides a solution for protecting employees from disclosing critical or sensitive data. OpenSecurity helps in cases of loss or theft of removable storage devices (e.g. USB-sticks), and against virus, Trojan or similar attacks on computers or notebooks. This is achieved by configuring each computer of an organisation with OpenSecurity software tools to prevent it from exchanging data in an uncontrolled manner.</p>
<p>Through the webinar (in German) you will learn about OpenSecurity’s security concept and gain an overview of current research approaches and the implemented solution.</p>
<p><iframe frameborder="0" height="315" src="http://www.youtube.com/embed/JrRwxUiFPKo?rel=0" width="420"></iframe></p>
<p>This webinar is being organised by IT-NET Austria. IT-NET Austria is a coalition of independent companies with expert status in their fields.</p>
<p><a href="http://www.it-net-austria.at">http://www.it-net-austria.at</a></p>]]></content:encoded>
    <dc:publisher>No publisher</dc:publisher>
    <dc:creator>Michela Vignoli</dc:creator>
    <dc:rights></dc:rights>
    
      <dc:subject>English</dc:subject>
    
    <dc:date>2014-08-06T14:30:00Z</dc:date>
    <dc:type>News Item</dc:type>
  </item>


  <item rdf:about="http://www.opensecurity.at/news/presentation-at-the-open-commons_congress-2014">
    <title>Presentation at the OPEN COMMONS_CONGRESS 2014</title>
    <link>http://www.opensecurity.at/news/presentation-at-the-open-commons_congress-2014</link>
    <description>On 2014-05-21 Nikolaus Dürk presented OpenSecurity at the OC2014 congress in Linz, AT</description>
    <content:encoded xmlns:content="http://purl.org/rss/1.0/modules/content/"><![CDATA[<p>For the third time, OPEN COMMONS_LINZ has organised a congress around current Open Commons topics. Nikolaus Dürk, CEO of X-Net Services, presented the OpenSecurity project in a talk (in German) with the title "OpenSecurity: an Open Source Security System for Sensitive, Citizen-Related Data in Public Administration".</p>
<p>The presentation (in German) can be downloaded here:</p>
<ul>
<li>.<a href="http://www.opensecurity.at/news/OpenSecurity_OpenCommons_Kongress_Linz.odp">odp</a></li>
<li>.<a href="http://www.opensecurity.at/news/OpenSecurity_OpenCommons_Kongress_Linz.ppt">ppt</a></li>
<li>.<a href="http://www.opensecurity.at/news/OpenSecurity_OpenCommons_Kongress_Linz.pdf">pdf</a></li>
</ul>
<p> </p>
<p>OPEN COMMONS_LINZ is an initiative of the city of Linz, which is committed to support and promote Open Commons (digital common properties). Its aim is to grow comprehension for Open Commons among the citizens, and to promote open, free, and transparent structures in the region of Linz. Fair use of cultural assets, conscious and self-determined handling with openness and closeness are central topics.</p>
<p><a href="http://opencommons.public1.linz.at/veranstaltungen/oc14" target="_blank">More information of the OPEN COMMONS_Congress 2014 (in German)</a></p>
<ul>
</ul>]]></content:encoded>
    <dc:publisher>No publisher</dc:publisher>
    <dc:creator>Michela Vignoli</dc:creator>
    <dc:rights></dc:rights>
    
      <dc:subject>English</dc:subject>
    
    <dc:date>2014-08-01T11:30:00Z</dc:date>
    <dc:type>News Item</dc:type>
  </item>


  <item rdf:about="http://www.opensecurity.at/news/social-scientific-accompanying-research">
    <title>Social-scientific accompanying research</title>
    <link>http://www.opensecurity.at/news/social-scientific-accompanying-research</link>
    <description></description>
    <content:encoded xmlns:content="http://purl.org/rss/1.0/modules/content/"><![CDATA[<p>In the context of OpenSecurity, accompanying research is being carried out from a social science perspective. The aim is to analyse contextual aspects of IT-security, usability, privacy, and user acceptance.</p>
<p>For this purpose the consortium member LIquA, the Institute for Qualitative Analyses in Linz, has conducted an online survey with one of the project stakeholders, the City Administration of Linz, in May and June 2013. An online questionnaire with 41 questions was sent to a statistical population of 1.385 users. The questionnaire covered six topics: personal details, using IT within the city administration, private use of IT, importance of IT-security and IT-security behaviour, and IT-security versus usability, as well as attitude towards the introduction of new IT-security measures. An initial analysis has already shown that IT-security is very important for the surveyed employees (with a response rate of 32%).</p>
<p>Detailed analyses regarding password handling, usage of data encryption, or concern for data corruption delivered further interesting insights. The results have also delivered timely additional input for the design of OpenSecurity services. In order to consolidate the results, additional qualitative interviews have been conducted with individual IT managers within the City Administration of Linz and at two other public stakeholders.</p>
<p>Currently the team is working on a third level of analysis by going through a number of studies, papers, and experience reports from the domain of IT-Security and Usability. As a next step the team will issue a potential-analysis from a social science perspective, in which the potential opportunties and risks for the implementation of an OpenSecurity-based solution at stakeholder institutions will be elaborated.</p>]]></content:encoded>
    <dc:publisher>No publisher</dc:publisher>
    <dc:creator>Michela Vignoli</dc:creator>
    <dc:rights></dc:rights>
    
      <dc:subject>English</dc:subject>
    
    <dc:date>2014-05-06T09:30:00Z</dc:date>
    <dc:type>News Item</dc:type>
  </item>


  <item rdf:about="http://www.opensecurity.at/news/malware-and-threat-protection-in-opensecurity">
    <title>Malware and Threat Protection in OpenSecurity</title>
    <link>http://www.opensecurity.at/news/malware-and-threat-protection-in-opensecurity</link>
    <description></description>
    <content:encoded xmlns:content="http://purl.org/rss/1.0/modules/content/"><![CDATA[<p>OpenSecurity defines a process that allows users to communicate with non-institutional networks by means of cryptography and virtualised isolation, as well as malware and threat classification.</p>
<p>IKARUS Security Software GmbH is a member of the OpenSecurity team and is primarily responsible for classification of data. For this IKARUS employs its own proprietary key technology for malware and threat detection. In addition to classification technologies OpenSecurity also employs IKARUS server applications developed for the scalable and highly performant server area.</p>
<p>OpenSecurity is a system with very modular design, which convinces by isolation and encapsulation. In addition to these design aspects it is a project goal to use primarily Open Source products to reduce integration costs. While IKARUS cannot license their products with an open license, they do support the integration of IKARUS software products with Open Source environments.</p>
<p>IKARUS sustains OpenSecurity with their technologies and know-how gained in more than 25 years’ experience in the sector. Due to the defined communication process OpenSecurity is complementary to conventional IKARUS products and adds the existing portfolio. IKARUS sees following benefits for institutions employing OpenSecurity:</p>
<p>1.    Less effort due to centrally administrated scanning of devices;</p>
<p>2.    Safe interaction with the internet without fear of being infected;</p>
<p>3.    Minimal use of resources by client devices;</p>
<p>4.    Low integration costs due to the Open Source approach.</p>]]></content:encoded>
    <dc:publisher>No publisher</dc:publisher>
    <dc:creator>Michela Vignoli</dc:creator>
    <dc:rights></dc:rights>
    
      <dc:subject>English</dc:subject>
    
    <dc:date>2014-05-06T09:30:00Z</dc:date>
    <dc:type>News Item</dc:type>
  </item>


  <item rdf:about="http://www.opensecurity.at/news/opensecurity-open-source-security-solutions-protecting-employees-and-data-in-public-institutions-2">
    <title>OpenSecurity: Open Source Security Solutions Protecting Employees and Data in Public Institutions</title>
    <link>http://www.opensecurity.at/news/opensecurity-open-source-security-solutions-protecting-employees-and-data-in-public-institutions-2</link>
    <description>Security by Isolation for MS Windows</description>
    <content:encoded xmlns:content="http://purl.org/rss/1.0/modules/content/"><![CDATA[<p><img class="image-right" src="resolveuid/d4a44dd6c44442e4903bcc19f76e0982/@@images/image/preview" />The OpenSecurity project was inspired in part by the <a href="http://qubes-os.org/trac">Qubes OS</a> approach to Security by Isolation. Qubes OS achieves a maximum degree of isolation between applications by instantiating these as virtual machine instances on top of the XEN bare-metal hypervisor. In addition, Qubes OS provides secure channels for file sharing, clipboard data exchange, and the user interface.</p>
<p>However, many public bodies in Austria have historically chosen Windows as their end-user environment, and due to path dependence, are highly constrained against moving away from this standard. As a result, it is required that the OpenSecurity project support deployment to Microsoft Windows clients (specifically, MS Windows 7 64-bit is our reference architecture).</p>
<p>It is clear that this is a suboptimal solution in terms of security; indeed, the shortcomings of Windows in this respect <a href="http://www.invisiblethingslab.com/resources/2014/A%20crack%20on%20the%20glass.pdf">have already been analysed</a>. However, given the prevalence of Windows, this solution will have a bigger potential impact on the public sector. And while the resulting implementation of security by isolation will not be perfectly secure, it will nonetheless offer greatly enhanced security that is also compatible with institutional IT rollout and management processes.</p>
<p>During the coming months, our services will be installed in a limited production environment of two public administration stakeholders. These users will be able to provide feedback directly through the OpenSecurity service, and will also participate in an evaluation workshop and online survey. This feedback will allow us to further refine the service in terms of stability and usability.</p>
<blockquote class="pullquote">Image source: <a href="http://en.wikipedia.org/wiki/File:Qubes_security_domains.png">Wikipedia</a> License: <a href="http://creativecommons.org/licenses/by-sa/3.0/deed.en">CC-BY-SA</a><br /></blockquote>]]></content:encoded>
    <dc:publisher>No publisher</dc:publisher>
    <dc:creator>Michela Vignoli</dc:creator>
    <dc:rights></dc:rights>
    
      <dc:subject>English</dc:subject>
    
    <dc:date>2014-05-06T09:30:00Z</dc:date>
    <dc:type>News Item</dc:type>
  </item>


  <item rdf:about="http://www.opensecurity.at/news/use-case-from-the-viewpoint-of-ikt-sicherheit-bmlvs">
    <title>Research interests of BMLVS in the project</title>
    <link>http://www.opensecurity.at/news/use-case-from-the-viewpoint-of-ikt-sicherheit-bmlvs</link>
    <description></description>
    <content:encoded xmlns:content="http://purl.org/rss/1.0/modules/content/"><![CDATA[<p class="KeinLeerraum1">The <i>Command Support Center</i> (FüUZ) is a central service organisation of the <i>Austrian Armed Forces</i> (ÖBH). It provides the <i>Federal Ministry of Defence and Sport</i>s (BMLVS) and the <i>Austrian Armed Forces</i> interoperable, safe, and innovative army command support and IT services, both for the use in Austria and abroad, as well as for administration activities.</p>
<p class="KeinLeerraum1">One cannot imagine the daily office routine without a performant internet connection or communication via email. Avoiding unintentional transfer of classified information through these communication channels is a big concern.</p>
<p class="KeinLeerraum1">The usage of external data storage and mobile devices (laptops, smartphones, etc.) implies the risk of bringing classified information into circulation in case of loss or theft of the devices. This risk can only be reduced by data loss prevention mechanisms (DLP), as well as by encoding the classified information. Next to DLP and in the context of using internet and email the implementation of efficient malware protection mechanisms is an essential component of safe IT systems and information.</p>
<p>The <i>Command Support Center</i> wants to contribute to the OpenSecurity project because DLP and protective measures against malware play an important role in the context of infrastructure. The security solutions developed in the project could be partially or wholly implemented in future IT systems.</p>]]></content:encoded>
    <dc:publisher>No publisher</dc:publisher>
    <dc:creator>Michela Vignoli</dc:creator>
    <dc:rights></dc:rights>
    
      <dc:subject>English</dc:subject>
    
    <dc:date>2014-01-30T15:20:00Z</dc:date>
    <dc:type>News Item</dc:type>
  </item>


  <item rdf:about="http://www.opensecurity.at/news/technical-aspects-of-the-opensecurity-project">
    <title>Technical aspects of the OpenSecurity Project</title>
    <link>http://www.opensecurity.at/news/technical-aspects-of-the-opensecurity-project</link>
    <description></description>
    <content:encoded xmlns:content="http://purl.org/rss/1.0/modules/content/"><![CDATA[<p>After collecting and evaluating different techniques and approaches to Security by Isolation, the OpenSecurity team focused on designing a concrete solution for two different user scenarios that were prioritised by the project stakeholders: the transfer of data to and from mass storage devices and secure Internet browsing.</p>
<p>The work so far has resulted in a set of isolated core components interacting together to orchestrate dedicated virtual machines. The OpenSecurity components created in this process share well-defined open interfaces: RESTful API, CIFS and SSH. These protocols cleanly separate the different components of the OpenSecurity solution space, thus allowing the upgrade or even the complete exchange of these components without disrupting the concept and benefit of the whole system.</p>
<p><img class="image-inline" src="resolveuid/29ac826f266a422c97b6650ab898ab30/@@images/image/large" /></p>
<p>The central component of the OpenSecurity design is the OpenSecurity Management daemon, which starts and stops disposable virtual machines. These machines are instantiated templates which are created from the dedicated OpenSecurity Linux distribution derived from Debian 7.2. Other components take care of user interaction, device driver overlays, and embedding access from and to the virtual machines with respect to the current user session.</p>
<p>The team presented a live proof-of-concept in December, which demonstrated independent Virtual Box machines handling USB mass storage device actions like virus scanning and/or encryption, as well as a tight integration of an Internet Browsing application run inside a virtual machine but shown natively on a Windows 7 user session.</p>
<p>The on-going implementation work is now directed towards making the system stable, performant and flexible. Though the software components written in this context are rather small and the interfaces are all widely known and understood, the complexity stems from the fact that messages often do cross operating system boundaries with impact at very low level system functionalities. This situation plus the special characteristics and divergences of partly closed-source operating systems behaviours - even if coined "standard" - makes this a demanding and sophisticated endeavour.</p>
<p>Finally installation challenges must also be addressed in order to support both simple single-user one-click download setup-files as well as a full blown rollout on to thousands machines directed by a central IT department. As the OpenSecurity integration also relies on a range of well-developed and open source third-party software, version management is yet another complex task of its own to be tackled next.</p>]]></content:encoded>
    <dc:publisher>No publisher</dc:publisher>
    <dc:creator>Michela Vignoli</dc:creator>
    <dc:rights></dc:rights>
    
      <dc:subject>English</dc:subject>
    
    <dc:date>2014-01-30T15:20:00Z</dc:date>
    <dc:type>News Item</dc:type>
  </item>


  <item rdf:about="http://www.opensecurity.at/news/opensecurity-open-source-security-solutions-protecting-employees-and-data-in-public-institutions-1">
    <title>OpenSecurity: Open Source Security Solutions Protecting Employees and Data in Public Institutions</title>
    <link>http://www.opensecurity.at/news/opensecurity-open-source-security-solutions-protecting-employees-and-data-in-public-institutions-1</link>
    <description></description>
    <content:encoded xmlns:content="http://purl.org/rss/1.0/modules/content/"><![CDATA[<p>Every organization must protect their cyber-infrastructure from threats – external or internal. In particular, public agencies that administer private citizen data (e.g. criminal and medical records or residency registers), or who manage national security information have a duty to protect this sensitive information. Whether arising from mistakes, external attacks, social engineering, or malicious intent, human beings will always be a weak link in the IT security chain. There is often an insufficient level of awareness of security risks, which leads to users being targeted by a variety of external threats. A second prevalent problem is that of lost devices (smartphones, tablet-PCs, USB-sticks, laptops etc.).</p>
<p>OpenSecurity should prevent the loss and (un)intentional misuse of sensitive, citizen-related data held by public bodies. The aim of our research is to achieve a higher level of data security and availability, while reducing effort in deployment management and maintenance. To this end, the feasibility and possible implementation of a centralized security layer will be examined based on the principles of security by isolation, virus detection, and encryption. This layer will control, verify, and encrypt any and all communication that takes place on client devices. OpenSecurity will be provided under a license that allows both public verification and customization within heterogeneous ICT-system landscapes.</p>
<p>OpenSecurity is a two-year project, running until October 2014, funded by the Austrian FFG KIRAS security program. The primary stakeholders in the project are the Austrian Ministry of Defence (BMLVS) and the IKT Linz. These stakeholders have provided use cases and requirements for the project and will test and validate the project results. The AIT Austrian Institute of Technology GmbH is the primary research partner, supporting the industrial partners X-NET Services GmbH and IKARUS Security Software GmbH. Under the technical coordination of X-NET, this team is carrying out the technical implementation of the OpenSecurity solutions. The Linz Institute for Qualitative Analysis (LIquA) rounds off the consortium by providing an analysis of the impact of OpenSecurity in the context of employee data protection and privacy.</p>]]></content:encoded>
    <dc:publisher>No publisher</dc:publisher>
    <dc:creator>Michela Vignoli</dc:creator>
    <dc:rights></dc:rights>
    
      <dc:subject>English</dc:subject>
    
    <dc:date>2014-01-30T15:20:00Z</dc:date>
    <dc:type>News Item</dc:type>
  </item>


  <item rdf:about="http://www.opensecurity.at/news/weiterfuhrung-des-projekts-opensecurity">
    <title>Weiterführung des Projekts OpenSecurity</title>
    <link>http://www.opensecurity.at/news/weiterfuhrung-des-projekts-opensecurity</link>
    <description>OpenSecurity wird von den Projektpartnern AIT Austrian Institute of Technology GmbH und X-Net Services GmbH in Form einer Kooperation weitergeführt und als Produkt in den Markt eingeführt. </description>
    <content:encoded xmlns:content="http://purl.org/rss/1.0/modules/content/"><![CDATA[<p>Neben der Marktüberführung des Prototypen zu einem Produkt wird die Weiterführung von OpenSecurity auf europäischer Ebene unter Hinzunahme internationaler Experten, Forschungseinrichtungen und Unternehmen angestrebt. Eine Erweiterung des Netzwerks sowie eine Heranführung der Thematik an Big Data soll in einem EU-Projekt die Kompetenz Europas in sicherheitsrelevanten Bereichen verstärken und zu einem europaweit einheitlichen Standard führen. Auf diese Weise sollen öffentliche Einrichtungen und Institutionen, die sensible bürgerbezogene Daten verwalten, den höchstmöglichen Schutz erfahren.</p>
<p>OpenSecurity wird von den Projektpartnern AIT Austrian Institute of Technology GmbH und X-Net Services GmbH in Form einer Kooperation weitergeführt und als Produkt in den Markt eingeführt. Dazu wird der entwickelte Prototyp als Produkt an die Erfordernisse der Bedarfsträger (v.a. öffentliche Institutionen und kommerzielle Großunternehmen) angepasst.</p>
<table align="center" class="invisible">
<tbody>
<tr>
<th><img class="image-inline" src="../resolveuid/9dcc14b26c884617af30cce469fd2d7a/@@images/image/mini" /></th><th><img class="image-right" src="../resolveuid/25b2133605a042ea952b462a2c68432a/@@images/image/thumb" /></th>
</tr>
</tbody>
</table>
<p>Die Weiterführung von OpenSecurity in einem Kooperationsmodell ist aufgrund der unterschiedlichen, sich ergänzenden, Stärken der beiden Projektpartner AIT Austrian Institute of Technology GmbH und X-Net Services GmbH als ideale Voraussetzung für den Erfolg der entwickelten Open Source basierten Lösung zu sehen.</p>
<ul>
<li>X-Net Services GmbH hat hohe Expertise in der Umsetzung von Großprojekten sowie vor allem in First und Second Level Support, der in solchen Projekten eine große Rolle spielt. Als direkter Ansprechpartner für Kunden sorgt X-Net Services GmbH für den reibungslosen Ablauf in der Zusammenarbeit mit den Kunden sowie für die Wartung des Systems und führt zudem Anpassungen und Adaptionen – sowie Neu-Implementierungen, die sich im Kompetenzbereich von X-Net Services GmbH befinden – der Lösung OpenSecurity nach Bedarf durch.</li>
<li>AIT Austrian Institute of Technology GmbH tritt als Integrator mit guten Kontakten in die Wirtschaft sowie einer hohen Reputation auf. Durch die Vielzahl an hochqualifizierten Entwicklern kann AIT Austrian Institute of Technology GmbH große Projekte akquirieren und vorantreiben sowie OpenSecurity an die Bedürfnisse der Kunden anpassen.</li>
</ul>]]></content:encoded>
    <dc:publisher>No publisher</dc:publisher>
    <dc:creator>Michela Vignoli</dc:creator>
    <dc:rights></dc:rights>
    
      <dc:subject>Deutsch</dc:subject>
    
    <dc:date>2014-11-28T09:30:00Z</dc:date>
    <dc:type>News Item</dc:type>
  </item>





</rdf:RDF>
