OMG Central Bank Digital Currency (OMG-CBDC) Working Group (WG) Wiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
====== 4. Risk Due to lack of Broad, Wide-Ranging Security Planning ======
|< 100% >|
| [[cbdc:public:cbdc_omg:04_doc:20_comments:brp:q11:start| Return to Question 11]]  |  <WRAP>
<html><b>
<a href="mailto:cbdc-feedback@omg.org?Subject=OMG's CBDC WG Response: 
11.4. Risk Due to lack of Broad, Wide Ranging Security Planning
">Provide Feedback</a></b>
</html>
</WRAP>  |

An important way to make sure the Security Planning is adequate is to design it into the U.S. CBDC from the onset, especially if the U.S. CBDC adopts the use of Distributed Technologies currently in wide use in cryptocurrencies. First, it is important to detail what needs to be secure and why. See Table {{ref>datatypeSecurity}}.

For a more detailed discussion, see the OMG DIDO-RA section on Non-Functional requirements for [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:25_security |Securability]].

<table datatypeSecurity>
<caption>Main reasons why data needs to be secure.</caption>
  * [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:25_security:confidentiality    | Confidentiality]]
  * [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:25_security:04_data_integrity  | Data Integrity]]
  * [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:25_security:nonrepudiability   | Non-repudiation]]
  * [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:25_security:authenticity       | Authenticity]]
  * [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:1.4_req:2_nonfunc:25_security:accountability     | Accountability]]
</table>

All too often, projects try to "bolt-on" security after products are built. When building something as essential and critical to the U.S. as a new financial mechanism such, ie., as the CBDC, it is essential to think about it at every stage of development, starting at the specification of requirements and at each layer of securability. See Figure {{ref>layerSecDarw}} and Table {{ref>layerSec}}

Securability is also a layered stack. At each layer, there are different steps that need to be taken to secure the system. For example, **Culture Security** it may just mean having employees hold a security clearance and/or take Drug Tests. For **Physical Security** it may mean having a locked facility to house the computers and network devices. Data Security might be software and cultural procedures such as encrypting all data stored in a disk drive and using software to access the data.

<figure layerSecDarw>
{{  cbdc:04_doc:15_common:48_natsec:layers_of_security.png?275  |}}
<caption>The layers of Security.</caption>
</figure>

<table layerSec>
<caption>The layers of Security.</caption>
  - [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.a_glossary:p:physicalsecurity    | Physical Security]]
  - [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.a_glossary:d:datasecurity        | Data Security]]
  - [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.a_glossary:n:networksecurity     | Network Security]]
  - [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.a_glossary:p:platformsecurity    | Platform Security]]
  - [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.a_glossary:a:applicationsecurity | Application Security]]
  - [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.a_glossary:c:securityculture     | Culture Security]]
</table>

The OMG's CBDC WG members recommend a close look at the Reference Architecture (RA) defined by [[https://www.omgwiki.org/dido/doku.php?id=dido:public:ra:xapend:xapend.b_stds:tech:omg:ief | Information Exchange Framework (IEF)]]. 

The IEF RA is primarily targeting operational environments that require the ability and capacity to share information within and beyond organizational boundaries (public and private sectors) and are challenged by rapid, unpredictable changes in operational contexts (e.g., threat, risk, roles & responsibilities, scale, scope, and severity). The IEF RA is targeted towards the following areas:

  * Military (coalition and Civilian-Military) operations
  * National Security
  * Public Safety
  * Crisis Management
  * Border Security
  * Emergency Management
  * Peace Keeping
  * Humanitarian Assistance

/**=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
/* To add a discussion page to this page, comment out the line that says 
  ~~DISCUSSION:off~~
*/
~~DISCUSSION:on|Outstanding Issues~~
~~DISCUSSION:off~~
OMG Central Bank Digital Currency (OMG-CBDC) Working Group (WG) Wiki

User Tools

Site Tools

Page Tools
