Identifikacija i potvrđivanje identiteta subjekta prilikom izdavanja kvalificiranih certifikata za elektroničke potpise i pečate

professional thesis

• Title (english): Identification and confirmation of subject identity during the process of issuing qualified certificates for electronic signatures and stamps
• Author: Klaudija Jonjić
• Mentor: Boris Vrdoljak (mentor)
• Committee member: Nikola Hadjina (predsjednik povjerenstva)
• Committee member: Boris Vrdoljak (član povjerenstva)
• Committee member: Mario Spremić (član povjerenstva)
• Granter: University of Zagreb; Faculty of Electrical Engineering and Computing; Zagreb
• Defense date and country: 2018, Croatia
• Scientific / art field, discipline and subdiscipline: TECHNICAL SCIENCES; Computing

Abstract

U ovom radu prikazana je zaštita jednog dijela informacijskog sustava (IS) pružatelja usluga povjerenja, odnosno usluga certificiranja, odgovornog za upravljanje sustavom i životnim vijekom digitalnih certifikata. Jedna od aktivnosti prilikom izdavanja kvalificiranih certifikata za elektroničke potpise i pečate je identifikacija i potvrđivanje identiteta subjekta (korisnika). Taj postupak provodi se sukladno eIDAS uredbi br.910/2014. Cilj rada je utvrditi koje vrste mogućih problema se očekuje tijekom fizičke identifikacije i potvrđivanja identiteta subjekta. Analizom i procjenom rizika sigurnosti informacijskog sustava u skladu sa standardiziranom metodologijom, primjenom kontrola iz ISO 27001, ISO 27002 i kontrole iz „dobre prakse“, predloženo je kako ovladavati rizicima, odnosno kako umanjiti ili otkloniti postojeće probleme. Najviše potencijalno mogućih problema se očekivalo od ljudskih resursa zbog nedostatka svijesti o informacijskoj sigurnosti što su rezultati ovog rada i potvrdili. Utvrđeno je i da se relativno jeftinim tehničko/upravljačkim sigurnosnim kontrolama ti problemi mogu svesti na prihvatljivu razinu.

Abstract (english)

This study presents the protection of one part of the information system (IS) of the trusted provider, i.e. certification service, responsible for the system management and the duration of digital certificates. One of the activities in issuing qualified certificates for electronic signatures and stamps is indetification and verification of the subject (user) identity. This procedure is carried out in accordance with the eIDAS Regulation No.910/2014. The aim of the paper is to determine which types of possible problems are expected during the physical identification and verification of the subject identity. By analyzing and assessing the risk of information system security in accordance with the standardized methodology, applying ISO 27001, ISO 27002 and "good practice" controls, it is proposed to master the risks, respectively to mitigate or eliminate existing problems. The most probable problems were expected to derive from human error due to lack of awareness of information security which is confirmed by the results of this work. It was also found that relatively inexpensive technical/management security controls can reduce these problems to an acceptable level.

• Keywords: pružatelj usluga povjerenja; kvalificirani digitalni certifikat; identifikacija i potvrđivanje identiteta subjekta; eIDAS uredba br.910/2014; rizik sigurnosti informacijskog sustava
• Keywords (english): trusted provider; qualified digital certificate; identification and verification of identity of the subject; eIDAS Regulation No.910 / 2014; Information Security Risk
• Language: croatian
• URN:NBN: urn:nbn:hr:168:991048
• Study programme: Title: Specialist study programme in information security; Study programme type: university; Study level: postgraduate specialist; Academic / professional title: Specijalist informacijske sigurnosti (Specijalist informacijske sigurnosti)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Closed access
• Created on: 2022-09-27 10:10:17