DSI Publications

The report deals with the current situation of IT security law and the chance that there are going to be changes in the near future. Further, it explains the system classification of IT security law and that definitions and regulations are different in every field of expertise. Finally, it deals with the state of the art and gives recommendations.

This article describes the newly enacted or rewritten regulations for the defense against IT attacks as part of IT security law: first the relevant criminal offenses, then the powers of the police and intelligence services, then of the IT security authorities and Internet providers. At the end, the political statements for the 19th parliamentary term will be compared with the remaining need for action in IT security law. Furthermore, the future of IT security law will be discussed in the context of implementation, ongoing development and consolidation.

The report gives an overview on the current situation on cybersecurity and the political handling of that topic. It also recaps the goals and failures of the last four years and recommends action areas.

The report shows that a reporting of vulnerabilities used by the state for active measures is likely to have only a minor effect on the increase in overall technical IT security. On the other hand, the value of the work of the security authorities is in many cases considered high, due to the high tactical enablement against potential malicious actors. The demand of some, that state authorities should refrain from pro-actively exploiting vulnerabilities for active measures therefore does not seem to make much sense; the net effect in security would be negative. Nevertheless, processes can be introduced that allow a more precise assessment and an informed, accountable and cautious handling of offensively used vulnerabilities.

The healthcare industry is undergoing great technological transformations. Hospitals are going digital and medical devices – whether implanted in patients’ bodies or stationed in hospitals – are equipped with increasing computing power and wireless connectivity. Connected healthcare can offer safer, more efficient, and timely medical service delivery. It also presents great economic opportunities – according to a Roland Berger consultancy firm study, the digital healthcare market is set to grow at average annual growth rates of 21 percent until 2020. Yet, the integration of computing and communication technologies in safety-critical medical systems will expose them to the same network and information security (cyber security) threats as other information technology (IT) systems. Research and real-world incidents have shown that IT security risks in healthcare are systemic. Cyber attacks’ impact on the privacy of patient data has already been established. More recently, their potential impact on patient health and safety has been raising concerns for healthcare organizations, regulators, and medical device manufacturers alike. The management and governance of related risks requires comprehensive standardization, regulation, and best practices to encompass both IT security and safety. DSI has analyzed the convergence of safety and security risks in healthcare and the Internet of Things through a review of the relevant literature, as well as expert interviews and a workshop with representatives from health organizations, medical device manufacturers, IT security experts, safety engineers, regulators, and certification bodies. On this basis, DSI has developed recommendations for policy and industry, which are presented by this paper after a short analysis of the current status of security in connected healthcare.