Government backs IT security standard

The government is introducing an accreditation scheme - similar to the familiar kitemark - to ensure IT security products meet quality standards.

Computing has been calling for such a programme for the past two years as part of its Trust campaign (6 February 2003).

The Cabinet Office's Central Sponsor for Information Assurance (CSIA) group, which co-ordinates information security projects across government, will start trialling the 'Claims Test Mark' scheme before the end of year.

It will provide the public and private sectors with greater assurances that products do what vendors claim they are capable of.

The accreditation scheme will primarily be focused on helping government departments, agencies and local authorities select information security products such as anti-virus software, firewalls and disk encryption.

The CSIA-led General Information Assurance Products and Services Initiative will run the scheme and hopes the 'kitemark' type accreditation will provide private sector businesses with a way of gauging the quality of the product they are buying.

'What we are trying to replicate is the Ronseal test, where a product does exactly what it says on the packet,' said Harvey Mattinson, head of accreditation at the CSIA.

The CSIA is working with the United Kingdom Accreditation Service and CESG, the GCHQ-run national technical authority for information assurance, to establish a number of independent test centres and assessment criteria.

'The accreditation process will take weeks, rather than months or years,' CSIA director Dr Stephen Marsh told Computing. 'With certain products and services you need to have this kind of pace, as threats can change so rapidly.'

Vendor products submitted for review will be measured for security, integrity and ease of use, with the CSIA hoping to measure against BS and ISO 7799 standards in the future.

Computing has been calling for software vendors to take more responsibility for the quality of the products they release allowing users to have trust and confidence in the software they install.

'This is an important move we have been calling for for along time, and we hope it will be introduced in the commercial sector as soon as possible,' said Computing editor Michael Gubbins.

'In principal this is a good idea, as it gives people standards they can understand and suppliers something they can strive towards,' said Beatrice Rogers, head of private sector at IT industry body Intellect.

'But the government needs to make it clear what accreditation means.'

'With the ABTA stamp consumers know if an airline collapses they're likely to be protected. Likewise, the government needs to make clear what accreditation means for both public sector authorities and the vendor adopting it,' she said.