@mcflyhh @1sand0s @xvandervoort @DIVDnl @HonkHase Our goal is to increase the security of supply of critical infrastructure services to the German population by supplementing and expanding the state's coping capacities to deal with major emergencies caused by cyber attacks.
@mcflyhh @1sand0s @xvandervoort @DIVDnl @HonkHase We believe that the probability of a widespread failure of critical infrastructure has become so high that it is no longer sufficient to improve IT security alone. We must also create capacities that can help restore and reboot critical services.
@mcflyhh @1sand0s @xvandervoort @DIVDnl @HonkHase As a first step, we recommend that you start by analyzing what coping capacities your state has at its disposal to cope with scenarios such as a large-scale failure of critical infrastructure.
@mcflyhh @1sand0s @xvandervoort @DIVDnl @HonkHase When we did this, we noticed that the German Incident Response Teams that exist have so far only been concerned with how "state and government operations can be ensured".
We also need teams that take care of the 2nd objective, the restoration of the supply of the population.
We also need teams that take care of the 2nd objective, the restoration of the supply of the population.
@mcflyhh @1sand0s @xvandervoort @DIVDnl @HonkHase In addition to this work, we also develop constructive detailed political demands as to which legal changes are necessary to improve the IT security of critical infrastructures.
@mcflyhh @1sand0s @xvandervoort @DIVDnl @HonkHase For example:
"Software used in critical infrastructure should always be open source. Where this is not possible, the source code should at least be kept in escrow."
"Software used in critical infrastructure should always be open source. Where this is not possible, the source code should at least be kept in escrow."
@mcflyhh @1sand0s @xvandervoort @DIVDnl @HonkHase We demand the independence of the Federal Office for Information Security (BSI) from the Federal Ministry of the Interior (BMI) in order to give all those who are subject to an obligation to report security vuln. the assurance that reported vuln. cannot be exploited by police.
