TC ENTERPRISE ID Why PKI? Determining the Business Value of Deploying Digital Certificates © 2007 TC TrustCenter GmbH · A TC TrustCenter Whitepaper TC ENTERPRISE ID Why PKI? Whitepaper Introduction Today there is a wide range of technology, products and solutions for securing an enterprise’s electronic infrastructure. As with physical access security, the levels of security implemented should be commensurate with the level of complexity of the enterprise, the applications in use, the data in play, and the measurement of the overall risk at stake. The most basic method of electronic security, the password, is often the default authentication method for granting access to computing resources. While appropriate for some resources, it does not mean that this method alone is well suited where securing sensitive data is vital. This paper discusses some of the methods currently in use today to secure the electronic enterprise, and highlights the relevance of using Public Key Infrastructure (PKI) as a security mechanism for securing data, identifying users, and establishing a chain of trust. Today, PKI is most widely known and linked to Secure Sockets Layer (SSL) deployments. In this most prevalent use of PKI, a strong encrypted tunnel between two points is created and used for the duration of a connected session. This allows for the secure exchange of information from an end-user to a particular website, such as entering one’s username/password and credit card details. The use of SSL for on-line business has been widely adopted and generally works quite well for securely purchasing items over the Internet. However, there is much more to PKI than just SSL deployment. While SSL and PKI enable a secure environment to exchange information, SSL does not verify the individual on the other end of the transaction. A person can purchase goods on the Internet using SSL and still be sending over stolen credit card numbers. SSL will ensure that nobody else steals them while they are being transmitted! PKI, on the other hand, deployed with digital certificates associated to the individual, will automatically verify that the individual on the other side of the transaction is in fact the person you want to exchange information with. The ability to clearly verify the individual on the other side of a transaction opens up a much larger universe of information and applications that can be shared and processed. Companies routinely expose highly sensitive digital data that are central to their operations. This can range from storing transaction records of customers on laptops to electronic notarization of documents via the Web, to bank transfers, to any exchange or storage of digital information that you need to ensure is genuine, or that the person on the other end of the digital universe is the person they say they are. For those many and varied purposes, public key cryptography is widely recognized as the only practical mechanism capable of addressing this challenge in a controlled and managed way in a commercial environment. A full enterprise PKI-based security system may not be a fit for all business environments, but more and more companies are finding that they can benefit from using PKI to secure enterprise’s electronic infrastructure. According to a recent survey by the Aberdeen Group, the issuance of new certificates is growing over 50% each year and more technology solutions are providing native PKI support out-of-the-box.1 A full Enterprise PKI deployment offers a unique value in managing the risk of both internal and external communications between employees, partners and customers, and to secure transactions and communications across a wide range of disparate platforms, applications and devices. Definition of a PKI The concept of PKI has been around since 1976 and commercially available since 1994. A PKI enables users of a public network, such as the Internet, to securely and privately exchange data and business transactions through the use of a public and a private cryptographic key pair that is obtained and shared through a trusted authority, also known as a Certificate Authority (CA). The public key infrastructure provides for a digital certificate that can identify an individual, an organization, or a device, and directory services that can store and, when necessary, revoke the certificates. 1 Derek E. Brink, (2007). Encryption and Key Management , retrieved October 16 http://www.aberdeen.com/summary/report/benchmark/4262-RA-encryption-key-management.asp 2/11 Along on Page 3 » en. 12 | 2007 TC TrustCenter GmbH Sonninstrasse 24-28 | 20097 Hamburg | Telefon +49 40 80 80 26 0 | Fax +49 40 80 80 26 126 | [email protected] | www.trustcenter.de TC ENTERPRISE ID Why PKI? Whitepaper » » The basic idea is that sensitive data is protected through encryption. Each end-user device has encryption software and two keys: a public key for distribution to other users, and a private key, which is kept and protected by the owner. A user encrypts a message using the recipient's public key. When the message is received, the user will decrypt it with his private key. Users may have multiple key pairs to maintain discrete communications with different groups. « Barton McKinley, The ABCs of PKI, CNN.com « How are Digital Certificates used in Today’s Enterprise? There are numerous applications that incorporate PKI in a typical corporate enterprise today. Some of the more common applications are as follows: > Web Server Authentication through Secure Socket Layer (SSL) > Virtual Private Network (VPN) Server Authentication (IPSec and SSL) > Client Authentication to Web Servers (Internet/Intranet/Extranet) and VPNs > Digital signing of e-mails, forms, documents and invoices > Encryption of e-mails, documents, forms, transactions and files in transit > Encryption of data at rest on laptops, thumb drives, mobile phones, etc. > Code signing / mobile phone code signing Electronic vs. Digital Signatures: There is generally much confusion between the terms “electronic signature” and “digital signature”, and often these terms are improperly used interchangeably. There is a major distinction between the two terms and they can be distinguished through the following definitions: > Electronic Signature: The Uniform Electronic Transactions Act2 (UETA) defines an electronic signature as "an electronic sound, symbol, or process, attached to or logically associated with a record and executed or adopted by a person with the intent to sign the record." The use of electronic signatures may broadly comply with some government signature legislations, but this process does not necessarily allow for data integrity assurance, or enforcement at a later time of the origin and time of the transaction. 2 UNIFORM ELECTRONIC TRANSACTIONS ACT (1999), http://www.law.upenn.edu/bll/archives/ulc/fnact99/1990s/ueta99.htm 3/11 Along on Page 4 » en. 12 | 2007 TC TrustCenter GmbH Sonninstrasse 24-28 | 20097 Hamburg | Telefon +49 40 80 80 26 0 | Fax +49 40 80 80 26 126 | [email protected] | www.trustcenter.de TC ENTERPRISE ID Why PKI? Whitepaper > Digital Signature: A digital signature is PKI-based and provides the controls required by organizations that must retain and prove the integrity, authenticity and reliability of electronically signed records (through real-time certificate and signature verification, timestamps, etc.). A digital signature is a form of electronic signature but implements asymmetric cryptography. Crypto-based digital signatures remain the only genuine way to secure valuable or sensitive communications and can be used to authenticate the identity of the sender of a message or the signer of a document, and possibly to ensure that the original content of the message or document that has been sent is unchanged. Digital signatures are: 1. Easily transportable; 2. Cannot be imitated by someone else; and 3. Can be automatically time-stamped. The ability to ensure that the original signed message arrived means that the sender cannot easily repudiate it later. Evaluating Your Enterprise Security Requirements Before evaluating any security technology and solutions, it is a good idea for a company to first assess all existing and forecasted security requirements. The following questions can assist you in your process to decide which technology may be right for your company: > Is there any sensitive information that needs to be protected? If so, what? > Make an inventory. Are they transaction based, forms based, data at rest? > How widely distributed is this sensitive data? Data Center, PCs, thumb drives? > What risks and liabilities are you looking to mitigate? > What are the consequences if this system or process is compromised? > Are these systems and data used internally, externally or a combination of both? > Do you project the number of users and applications to increase over time? > Do you need to allow external users access to data and applications? > How are these processes managed today? > What are the plans now, or in the future, for conducting on-line business? > Is there a current or future need for digitally signing forms, documents, invoices or eails? Is non-repudiation a requirement for any part of your enterprise? > Is there a current or future need for encrypting any data and/or e-mails? > Are there regulatory requirements applicable to your company pertaining to digital security? By answering the above questions, it becomes easier to determine the importance and priority of implementing security, including PKI initiatives, within your organization. General Security Practices in Place Today The following sections examine several methods of securing data and applications currently available today and some of the pros and cons of each for an organization. Passwords: Simple, but easy to foil The most commonly used authentication and access control in place at organizations today is the use of username and password. This is inexpensive to deploy and can be scaled to large numbers of users in an open IT environment. Unfortunately, 4/11 Along on Page 5 » en. 12 | 2007 TC TrustCenter GmbH Sonninstrasse 24-28 | 20097 Hamburg | Telefon +49 40 80 80 26 0 | Fax +49 40 80 80 26 126 | [email protected] | www.trustcenter.de TC ENTERPRISE ID Why PKI? Whitepaper password-based security controls are notoriously weak and susceptible to a range of well known attacks such as dictionary attacks, brute force hacking of central password repositories or even social engineering. One of the more common problems with using username and passwords is that users often cannot remember all of the various passwords required in day to day activities. These range from logging on to corporate networks, gaining remote access, accessing Intranets and portals, and the many other resources that now require username and password logins. This leads to users writing down their passwords on notes that are visible in their work space, as well as users forgetting their passwords and locking themselves out after numerous incorrect attempts at logging in. Password resets are the second most common reason workers call help desks, accounting for about one in four help desk requests3. Password resets alone require staffing and resources to handle 25% of help desk call volume. Given this reality, organizations will rarely, if ever, move valuable business on-line implementing only username/password security. Instead, these companies will opt for the use of secure socket layer (SSL) encryption to secure these transactions, with many now also coupling SSL with enduser client authentication certificates. One Time Password (OTP) Tokens: Two-factor authentication OTP Tokens, such as the RSA’s SecureID, address issues associated with using only username/passwords by implementing a second level of authentication control. This is known as ‘two-factor authentication’, allowing for ‘something you have’ (the OTP token) and ‘something you know’ (username and password) before authentication can be established. Dynamic tokens are generally key ring devices, or USB tokens, displaying a password that dynamically changes every 60 seconds upon entry of a PIN. Users must input both pieces of data to authenticate themselves, thus making this a much more secure authentication that is more difficult to crack. Although the resulting security is much greater, a big drawback is that this technology is expensive to deploy, requires an additional desktop and server component, and can only be effectively used for authentication (no digital signature or encryption capabilities). Some of the things that should be brought to attention before investing in this technology are: > It is expensive to deploy (particularly when a large number of users and/or external users are involved) > It is expensive to maintain (again, if large or external user groups involved) > Often requires proprietary desktop component > Authentication only (limited investment payback) > Limited to what it can support in terms of supporting broader online and enterprise security issues and challenges Biometrics: Promising, but not yet ready Biometrics measure and analyze physical characteristics that can be applied to authentication purposes. Some examples of these physical characteristics include fingerprints, eye retinas and irises, facial patterns and hand measurements. The main advantages of using biometrics are: > Biometric characteristics cannot be lost or forgotten (while passwords can) > Biometric traits are difficult to copy, share and distribute (passwords can be visibly posted or shared with people that shouldn’t have access) > Biometrics require the person being authenticated to be physically present at the time and point of authentication 3 Microsoft Speech Solutions: Password Reset, retrieved October 17, 2007, http://www.microsoft.com/speech/solutions/pword/default.mspx 5/11 Along on Page 6 » en. 12 | 2007 TC TrustCenter GmbH Sonninstrasse 24-28 | 20097 Hamburg | Telefon +49 40 80 80 26 0 | Fax +49 40 80 80 26 126 | [email protected] | www.trustcenter.de TC ENTERPRISE ID Why PKI? Whitepaper Biometric systems can also be used in conjunction with passwords or tokens, thus improving the security of existing systems without replacing them. The biggest concern about using biometrics is the fact that once a fingerprint or other biometric source has been compromised, it is compromised for life since users can never change their fingerprints. Theoretically, a stolen biometric could cause a victim many problems for a very long period of time. There have also been a few recent concerns regarding the systems in use that authenticate biometrics. For example, a recent television episode of “Mythbusters” focused on attempts to break into a commercial security door equipped with biometric authentication. After experimenting with a few different techniques, the crew was able to bypass the security door’s authentication system with a printed scan of a fingerprint after it had been dampened. Bypassing this biometric system so easily suggests that biometrics may not yet be a reliable strong form of authentication. Smart Cards: Powerful authentication in a small card The use of smart cards not only improves security through its two-factor authentication, but it also makes life easier for employees since they no longer have to remember a different password for every application. Contact smart cards have a small gold chip about 1/2 inch in diameter on the front. When inserted into a reader, the chip makes contact with electrical connectors that can read information from the chip and write information back. Contact smart card readers are used as a communications medium between the smart card and a host, e.g. a computer, a point of sale terminal, or a mobile telephone. Smart cards can be used with passwords only (PINs) or used with PKI to contain certificates and keys. Some of the more common uses of PKI enabled smart cards are for single sign on, digital signing, encryption and remote access authentication. The costs for help desk support can be reduced significantly using smart card-based single sign on, eliminating many passwords that do not have to be remembered and therefore reset when forgotten. Some examples of large scale deployments of smart cards in use today include the U.S. Department of Defense’s Common Access Card (CAC), and the use of various smart cards by many world governments as identification cards for their citizens. Microsoft has also recently promoted the use of smart cards as a way to enhance security, and most laptops are now shipping with smart card readers already built in. Smart cards require a smart card management system to manage all possible processes and events – from the loss of a card or password, to renewing, revoking or issuing a recovery card. For this system to work successfully in an enterprise, the management system has to be simple to use and able to fully manage the various workflows of smart card use. One such smart card management system is TC TrustCenter’s TC Enterprise ID Smart Card Manager (EID SCM). EID SCM is a perfected system which enables the cost effective management of smart cards or tokens based on its integrated workflows. EID SCM also integrates fully into existing corporate or Meta directories and ties in with a PKI for efficient delivery of PKI enabled smart cards. PKI and Digital Certificates: Combines ease of use with strong authentication PKI systems are widely acknowledged by enterprise security analysts as the best security available to control strong authentication, secure data and communications, and provide for digital signing to meet data integrity and non-repudiation requirements. Additionally, companies who need a single security technology that can support multiple applications, processes and platforms, choose PKI. A Public Key Infrastructure is a comprehensive system for managing the lifecycle of digital certificates and the corresponding public and private key pairs. A PKI system is generally composed of the following: > A Certificate Authority (CA) to issue end user certificates (trusted or private) > Support of the X.509 framework where a Certificate Authority issues a certificate that binds a public key to a particular distinguished name (e-mail address, DNS address, IP address) 6/11 Along on Page 7 » en. 12 | 2007 TC TrustCenter GmbH Sonninstrasse 24-28 | 20097 Hamburg | Telefon +49 40 80 80 26 0 | Fax +49 40 80 80 26 126 | [email protected] | www.trustcenter.de TC ENTERPRISE ID Why PKI? Whitepaper > End user registration process (face-to-face, pre-authorization) > A certificate repository (such as LDAP) > Certificate revocation process > Current list of revoked certificates available for lookups (CRL, OSCP) > Key backup and recovery At the core of a PKI is a Certificate Authority (CA), which issues unique digital certificates to each individual user. Certificates contain two keys, a public key and a private key, which are used for various authentication, signature, and encryption procedures. Digital certificates can be used for many electronic processes such as authentication to a web resource, signing e-mails or forms, and encryption of e-mail messages. Whenever a certificate is being used, it is validated to confirm the current status of the credential to ensure that it has not been revoked or suspended. Throughout these processes, individual certificates can only be used in accordance with the policy associated with it. Different certificates (and users) will naturally have different rights and entitlements, which are agreed and defined by the organization at the outset. Some of the many benefits of implementing a PKI include: > A single credential (certificate) per user which can be used for multiple processes and applications, in lieu of having multiple usernames and passwords. This is a significant administration benefit as user groups grow. > Use of digital signatures to provide a persistent and auditable record of transactions. > The same PKI investment can also be used to secure site-to-site connections, extranets, server-to-server communications, device authentication, etc. > Digital certificates, either on smart cards, tokens or the desktop, can use a strong passphrase to protect access to the private key/certificate itself. Although using a passphrase, there are still clear differences over the use of standard weaknesses associated with passwords in general. Not only would someone have to guess the password, but the certificate must be present, valid and not revoked. Organizations can also mandate ‘two-factor’ authentication to unlock access to the certificate (e.g. use USB token + passphrase). > Social engineering attacks to find passwords are a major issue for corporations. With PKI, support administrators may suspend your certificate while an issue is resolved, but they will not have the right to revoke/access your passphrase. Certificate revocation is a central PKI function and the authorized security system operators are the only people that can do this. > Another common password attack is through brute force on a central password repository where hackers can compromise a large number of user accounts. These active attacks are often perpetrated by internal parties. With PKI, there is no central password/passphrase repository. Once end users are issued unique passphrases (e.g. through a PIN delivery mechanism such as a mailer, e-mail or SMS text), there is no duplicate store. This prevents any single point of attack and preserves the integrity of the system. Challenges of implementing PKI Valid criticisms of PKI in the past have been: 1. It is often difficult and expensive to implement and manage in-house. 2. The time it takes to build, deploy and begin to see return on the investment. 3. Your staff has to integrate PKI into the portfolio of applications. Until recently, organizations desiring to implement PKI were faced with two choices: they could build it, staff it, and operate it themselves or have somebody else build it, staff it, and operate it for them through a managed service. Both involved physically building infrastructure capital expenditures, perpetual license fees, changes to existing IT infrastructure as well as hardware and software purchases. All involved undertaking projects that could last many months before benefits could begin to be realized. 7/11 Along on Page 8 » en. 12 | 2007 TC TrustCenter GmbH Sonninstrasse 24-28 | 20097 Hamburg | Telefon +49 40 80 80 26 0 | Fax +49 40 80 80 26 126 | [email protected] | www.trustcenter.de TC ENTERPRISE ID Why PKI? Whitepaper TC TrustCenter offers a new alternative – On-Demand PKI. Unlike traditional in-house PKI implementations or traditional managed services, TC TrustCenter is the world’s first PKI platform that can be deployed across multiple clients in a web-based Security as a Service model, enabling any sized enterprise to achieve PKI security in as little as 2 weeks with no capital costs, hardware or network changes. TC TrustCenter’s unique platform enables many organizations to share PKI without the need for additional dedicated hardware, software, personnel and their related costs. TC TrustCenter was also designed to be highly configurable by each customer, so they do not have to tradeoff functionality for cost. Additionally, On-Demand PKI is faster to install. Since all the enabling infrastructure exists, On-Demand PKI is configurable and can be online within a few weeks. While TC TrustCenter has addressed the first two adoption issues, the application vendor community has addressed the 3rd. The vast majority of today’s commercially available applications and infrastructure support PKI natively out-of-the-box, dramatically reducing the need for in-house integration and further reducing the time to realize returns from a PKI investment. The Financial Returns of Using PKI Similar to any infrastructure, a PKI will not, in itself, deliver a return on investment – but the applications that benefit from PKI will. The financial return will therefore be application specific, company-specific and industry-specific. Organizations can improve business performance and achieve significant efficiencies by securing common, everyday office applications (such as Windowsbased applications). The real benefits, however, lie in leveraging PKI technology with business-critical applications; applications that play a core role in your company’s day-to-day business activity. Public Key-enabled applications typically deliver business benefits within four high-level categories: 1. New Revenue Opportunities The central issue to consider is the range of business processes that can be brought on-line with PKI (relative to the more limited range available if ‘lesser’ security technologies are employed). There are many more applications than ever that are now PKI-aware. The ability to exchange information securely over a public network opens up a vast array of digital business opportunities not previously possible. One example is a 50 year old organization in a very staid business that has dramatically expanded revenue opportunities for its members. The National Notary Association (NNA), established in 1957, added an Electronic Notary Seal (ENS™) program to provide a digital certificate that confirms a notary’s commission to speed submission of sensitive documents to financial institutions and help prevent forgeries. The ability to connect with all your stakeholders over a ubiquitous network (the internet) securely and with mutual confidence is the key. 2. Cost Savings Reducing internal costs also represents a key driver for implementing PKI. Cost-based financial returns are typically achieved through some combination of the following: > Cost Savings: The new or improved business process is less expensive. > Cost Avoidance: The new or improved business process scales to higher levels. > Efficiency: The new or improved business process saves time. > Effectiveness: The new or improved business process increases productivity. 3. Compliance Compliance generally refers to one of the following four categories: Regulatory, Partner, Customer, and Competitive. 8/11 weiter auf Seite 9 » en. 12 | 2007 TC TrustCenter GmbH Sonninstrasse 24-28 | 20097 Hamburg | Telefon +49 40 80 80 26 0 | Fax +49 40 80 80 26 126 | [email protected] | www.trustcenter.de TC ENTERPRISE ID Inbetriebnahme Why PKI? Whitepaper der Chipkarte TC QSign > Regulatory Compliance: where failure to implement could mean fines, loss of revenues, jail terms, etc. Examples of regulatory compliance include HIPAA regulations for the U.S. healthcare industry, SAFE for Bio-Pharma industry, and HSPD-12 for the U.S. federal government. > Partner Compliance: where failure to implement could mean losing your ability to participate with a key partner or group of partners. Some examples would be the IdenTrust model for financial companies, and the Federal Bridge cross-certification for the U.S. federal government. > Customer Compliance: where failure to implement could mean the loss of a business relationship with a key account. An example would be that in order to continue to be a supplier with a certain company, all contracts renewed must implement technology, such as digital signatures of all invoices by a certain date. > Competitive Compliance: where failure to implement could mean the loss of competitiveness. 4. Risk Mitigation Risk mitigation investments should be focused on things that are worth protecting, such as highvalue information and high-value, or high-volume, transactions. Some examples would be any information that is related to generating revenue, operational or administrative information, research, new product plans, marketing plans, customer databases, and any information that must be protected by law (such as personnel and financial records). Once the information component itself has been identified, companies must quantify the impact (or risk) of this data being compromised in any way. For example: > Productivity Loss: What would the financial impact be if a security breach caused a sustained disruption of internal processes and communications? > Monetary Loss: What would the financial impact be if there was a security-related corruption of an accounting or financial system? > Indirect Loss: What would the financial impact be if a security breach happened? Examples of this could be the loss of potential sales, competitive advantage, negative publicity, goodwill and trust. Indirect losses are among the most difficult to quantify but also among the most compelling in the risk-mitigation category, especially for those businesses built on the fundamental foundation of “trust.” > Legal Exposure: What would be the financial impact of failure to meet contractual milestones or meet statutory regulations for the privacy of data? Proven Success Unlike other vendors of PKI, TC TrustCenter’s product offerings have been proven in the marketplace with a large range of quality PKI deployments – covering numerous vertical markets and geographical regions. Some of the benefits of working with TC TrustCenter for your On-Demand PKI deployment are: > On-Demand PKI dramatically reduces set-up expenses, operating costs, and deployment time. > Extensive deployment experience in a variety of automotive, financial, utility, service, and healthcare industries. > More than 10+ years experience and 3.500 customers worldwide. > TC TrustCenter has several Trusted Roots embedded in 99% of the world’s web browsers (Internet Explorer, FireFox, Netscape, Opera, etc.). > National and International accreditations: European Signature law, German Digital Signature law, SISAC, and ETSI. > On-Demand PKI that offers a “pay as you grow” pricing model. 9/11 weiter auf Seite 10 » en. 12 | 2007 TC TrustCenter GmbH Sonninstrasse 24-28 | 20097 Hamburg | Telefon +49 40 80 80 26 0 | Fax +49 40 80 80 26 126 | [email protected] | www.trustcenter.de TC ENTERPRISE ID Why PKI? Whitepaper Summary Understanding your current and future business environment is key to making the correct decision with regard to enterprise security. Easy alternatives are plentiful, but an enterprise must balance immediate challenges with broader initiatives and current projects with emerging IT trends. Once this is understood, your security investment can be sustainable, productive, and ultimately deliver a solid return on technology investment. PKI has emerged as the best balance of strong security, commercial availability, and cost effectiveness. Time tested and continuously improved since its commercial introduction in 1994, the introduction of TC TrustCenter’s On-Demand PKI delivery model drives the cost down dramatically without sacrificing protection and guaranteed service levels. Not unlike insurance, digital security has become a required expense in doing digital business. Also like insurance, if the same coverage can be purchased for less with the same or better service, then it is the responsibility of those who control security spending to investigate. If PKI is the path for your organization, then you must ask yourself the best way to implement it. Today you have three choices: 1. Build and manage the PKI in-house 2. Use a traditional Managed Service PKI 3. On-Demand PKI with TC TrustCenter In general, a managed PKI is more cost effective and easier to implement than an in-house solution, with over a 50% difference in cost between in-house PKI and a traditional Managed PKI. The new On-Demand PKI model, however, drives these costs down by an additional 50% for the same PKI functionality. When combined with a faster implementation time, the ROI on PKI is dramatically altered in favor of the using organization. The implications are wide spread. Companies who could not previously afford PKI can now have the same security used by the world’s largest organizations. Customers can get their system up and running more quickly, and “pay as they grow”…rather than “paying up front”. Another important detail to point out is that in-house deployments are most times established using a self-signed Root, which is not trusted outside of their enterprise. So, in addition to the costs associated with establishing an in-house deployment, when any company wants to communicate outside of their own organization these certificates will not be trusted. However, using a trusted Root, such as TC TrustCenter’s, you can ensure securing of your certificates and transactions. As a part of your investment decision, we recommend a similar analysis be conducted using your projected number of users and specific costing for your organization. A TC TrustCenter representative is prepared to assist. Contact Us About TC TrustCenter TC TrustCenter GmbH, a wholly owned subsidiary of ChosenSecurity, Inc., is a leading specialist for certificates and security solutions along the entire value chain of identity verification. The portfolio includes web security services for the protection of e-commerce transactions, managed security services, and complex PKI solutions including comprehensive consulting services. TC TrustCenter has experience in many national, international and global projects in various industries for more than ten years. TC TrustCenter is an accredited certification service provider according to German signature law, European signature law, IdenTrust and SISAC. For more information, please visit www.trustcenter.de. 10/11 weiter auf Seite 11 » en. 12 | 2007 TC TrustCenter GmbH Sonninstrasse 24-28 | 20097 Hamburg | Telefon +49 40 80 80 26 0 | Fax +49 40 80 80 26 126 | [email protected] | www.trustcenter.de All rights reserved. No information or images, fully or partially, in any form or by any means, may be reproduced, copied, duplicated, published or used in electronic systems or translations without the prior written consent of TC TrustCenter. This represents a crime, excluding printing and duplicating for one's own use. All information in this document is compiled with great care. Neither TC TrustCenter nor the author is liable for any damages may occur in connection with the use of this document. All brands, product names and trademarks used in this document, are trademarks or service marks of the respective owners. Copyright © 2007 TC TrustCenter GmbH, Sonninstrasse 24 - 28, 20097 Hamburg, Germany. All rights reserved
© Copyright 2024