Security certification for critical information infrastructures: The Italian certification body approach

Critical national infrastructures (CNIs) — defined as any public or private infrastructure whose operation is essential for a country’s security and functioning, including such fundamental sectors as healthcare, economy, energy, transport, communication systems, law enforcement, defence and, in general, public administration — can be affected by a variety of events that can jeopardise their efficiency both directly and indirectly. CNIs increasingly rely on critical information infrastructures (CIIs), such as telecommunications. These networks must guarantee operational viability when critical events occur, as well as under normal working conditions. In some circumstances, critical events can affect not only the CNIs, but also their telecommunication infrastructures. Such failures are not necessarily caused by external events. To guarantee their correct and continuous operation, security aspects of CIIs must therefore be the focus of particular care. Guarantees on the effectiveness and correctness of the security measures deployed in the CII can be obtained through certification. This paper analyses the role of system/product security certification in this context. In particular, the paper describes the certification approach recommended by the Italian national certification body (Organismo di Certificazione della Sicurezza Informatica) to achieve the maximum benefit from the process, in terms of both efficiency and security.