Towards a secure information society

The exploitation of all benefits of the information society is only possible if all parties have confidence in its basic structures. The presence of information security and protection of privacy in communications networks and services plays a key role in improving confidence. To achieve this goal, active cooperation of authorities and various players in the sector is needed at both the national and international level.

In collaboration with various stakeholders, the Finnish Communications Regulatory Authority (FICORA) seeks to advance the information security and protection of privacy of the communications networks and services. FICORA supervises the compliance with the laws enacted on the basis of the relevant EU directives and FICORA’s regulations issued under them, maintains a review of the level of information security and gives out general guidelines regarding information security.

Basic concepts of Information Security

Identification means a procedure by which the object, for instance the user or system, is identified. Identification does not necessarily require any measures from the object’s side. Identification means for instance the recognition of fellow employees to belong to the working environment.

Authentication means a procedure to ensure that the data presented in connection with identification is trustworthy. Authentication usually refers to special characteristics of the object, to something in possession of the object or to something he knows. A strong method of authentication is a combination of both of the methods mentioned. Many systems accomplish identification and verification simultaneously, for instance personal data is checked both at the driving licence and by recognising the user. Some systems make the authorisation and authentication simultaneously, for instance the passage control system reads the key card and opens the door.

Non-repudiation means a procedure by which it is possible afterwards to ensure that a certain person has taken a certain measure. Regarding information and data files, non-repudiation may concern for instance the information on the editor on data. In electronic communication, non-repudiation means for instance the measures by which the sender and the recipient of a message are ensured.