Information Technology - Security techniques and standardization

Abstract

A brief history of international standardization of IT security techniques is given beginning with the first working group within ICO/TC97 in 1980. Nowadays security is dealt with by an increasing number of standardization committees. Many of these however are considering security techniques within the framework of other topics such as architecture or special applications. The GMD participates in some of these committees especially in the subcommittee ISO/IEC JTC I/SC 27 which is standardizing generic IT security techniques and mechanisms. The emphasis of this article is on the work of SC27. The scope and a short description of the programme of work of SC27 is given including the most important security mechanisms based on cryptography relating, for instance, to authentication, access control, confidentiality, data integrity, and non-repudiation. The results of a discussion, whether cryptographic algorithms should be standardized or not, are described. The classification of IT security standards is given to set up a link to the environment of IT security techniques and mechanisms.