What is Security by Design?

15 August 2017

Software, hardware and security are subjects that have always been very closely linked. And yet, in the light of increasing networking with the Internet, they will have to dovetail even more closely in the future if protection is to be guaranteed. But something that sounds like common sense is still far from common practice in many sectors. In a digital and networked world, TÜV NORD is the byword for security and trust – which is why the company is continuing to break new ground with the Security by Design principle. Exactly what is involved here is the subject of this brief interview with Markus Wagner from TÜViT, a subsidiary of the TÜV NORD GROUP.

#explore: What is Security by Design?
Markus Wagner: This formulation is relatively easy to explain: What the term means is that security requirements on software and hardware need to be considered right from the development phase of a product so that security vulnerabilities don’t crop up later. After all, the longer the project goes on, the more the costs of eliminating vulnerabilities increase.

#explore: Is this topic relevant to all sectors?

Markus Wagner: Yes, I am convinced that, in the medium term, all sectors will have to address this issue. ‘Security by Design’ plays a particularly important role in the field of the Internet of Things. The aim is to incorporate security mechanisms right from the development stage of the devices. This is because the increasing connectivity of devices and sensors via the internet, combined with the fact that more and more processes are run via software, creates additional vulnerabilities to unwanted attacks. The ‘security by design’ approach ensures significantly better quality and increases the resilience of hardware and software against attacks.

In the case of chip cards, for example, a relatively high security standard has had to be maintained for years. However, many sectors are currently addressing the topic of ‘Security by Design’ for the first time. For so-called smart meter gateways – which receive, process and forward the readings from electricity meters to the energy supplier – there have, for instance, been no security requirements whatsoever to date. That is now changing.

#explore: Why is ‘security by design’ an important issue for TÜViT?
Markus Wagner: As IT specialists, we deal with this on several levels. On the one hand, associations and federal agencies commission us to draw up minimum standards for greater product security. A concrete example of this is data transmission. Users must be able to rely on their data being transmitted securely in encrypted form and not being intercepted by third parties. On the other hand, we advise manufacturers on implementing the principle of Security by Design. We help companies to put the guidelines that have been previously defined into practice. Ultimately, we also verify the security of the software – so TÜViT is involved at every stage, from conception through design to certification. However, different departments and staff members are responsible for the various phases, to ensure that one person does not first draft the guidelines, then advise the client and finally carry out the assessment. This is how we maintain our independence.