On 11 October 2019, ILNAS, in collaboration with the University of Luxembourg (Uni.lu), organized an information session to celebrate the 50th World Standardization Day.This event provided participants with an overview of the normative developments carried out within the framework of the national normative strategy 2010-2020 and the normative perspectives for the next decade.The award ceremony for the “National Standards Delegate” trophy was then held. This year, Dr. Jean-Philippe Humbert had the honor of awarding this prize to Dr. Carlo Harpes, Managing Director at itrust consulting Sàrl for his important contribution to technical standardization in the Grand Duchy of Luxembourg. Among other things, he represented Luxembourg in various plenary meetings of European and international organizations, led the creation of Luxembourg commentaries and was editor of normative documents.
Posts By: Ingo Senft
Open TRICK
OpenTRICK is a web-application supporting risk assessment and treatment. OpenTRICK (formerly called TRICK service) is a full-featured risk management tool, assisting in assessing risk, planning actions, as required by an ISO/IE 27001 compliant information security management system (ISMS). It accompanies you throughout the whole risk management process; starting with the definition of the risk context, covering risk estimation and treatment, and communicating the results. OpenTRICK prepares you to be certified for ISO 27001, to comply with the requirements of the GDPR, to export the RISK information in the json format requested by the LU regulator ILR or in order to respond to CSSF circular 12/544. <br/ > It covers a wide variety of features such as quantitative/qualitative analysis of risk scenarios, estimation of Return on Security Investment (ROSI) based on risk reduction factors (RRF), embedding of custom or pre-defined catalogues for rated security controls (27002, GDPR, 22301, IoT, …), multi-user support and access control, import/export, and versioning. It allows several risk assessment for different customers or contexts to share information such security and risk parameters over a central knowledge Base, thus explaining its name TRICK = Tool for Risk management of an ISMS based on a Central Knowledge base. Note that such information, e.g., ISO/IEC 27002 is copyright protection, i.e. cannot be part of this release, but it can be imported easily, based on formatted documents available at ILNAS.public.lu (e.g.) upon acquisition of the standard’s copyrights (in near future). <br/ > OpenTRICK comes with user access management, activity logs, two-factor authentication, and smart input output feature interacting with Word and Excel.
Thank you, Europe!
At the occasion of Europe’s Day, itrust consulting would like to thank the European Union, pointing out that 70 % of recruited employees since its foundation in 2007, are EU citizens, excluding the Luxembourgish citizens.Over the years itrust consulting has benefited significantly from the European Research & Development programs (FP7, H2020, ESA): itrust’s participation in Liveline, LASP, MICIE, SPARC, CockpitCI, iGoing, TRESsPASS, bIoTope, ATENA was funded with 2 million Euros.Furthermore, a turnover of more than 4 million Euros came from our consulting services towards European institutions.Without the European Union, our growth and quality of service would not have been possible.Happy Europe Day!
Your status on GDPR compliance?
More and more companies, including small organisation and ASBLs, have demonstrated compliance to GDPR . This is far easier to achieve than generally thought.itrust consulting has recently updated its service offer:GDPR templates: € 100 per language version to be filled in by yourself;A tailored ‘privacy statement for ASBL’ for fixed price of € 100:Send us your logo, statutes, website, and contact data. We will call you for a discussion on your current practices such as enrolment process, use of pictures of events… after which we will send a draft privacy declaration to be published on your website after review and addition of specific aspects;An introduction to GDPR: 1-day training at € 500 per participant (incl. licence to use the GDPR templates);Specialized GDPR training: 2 days on ‘Foundations of the GDPR’ (incl. exam) + 3 days on the role of DPO (incl. exam);GDPR support services: pay per day;DPOaaS: typically 2-5 days per year external support as Data Protection Officer.We are prepared and eager to support you!For more details, check our GDPR service offer description
itrust consulting applies ‘nudge’ theory to increase customer security
In 2017, Richard Thaler and Cass Sunstein, the founding fathers of ‘nudge theory’, received the Nobel prize in Economics. The essentials of nudge theory can be summed up in a few bullet points:nudges are tiny hints or changes which suggest that one follow a certain direction, but leave all of one’s options open;a default option is a very powerful nudge, as it requires one to actively object to it to choose a different path;states and other large institutions can use nudges to improve whole societies.The main New Year’s resolution of itrust consulting for 2019 is to incorporate nudging to the benefit of our customers’ security needs.The main issue is that people decide emotionally without rationally considering security. Efforts to improve security take attention and resources away from their core business. Moreover, people have a strong tendency to reject constraints and authorities, as these give them the impression that they have lost the power to decide. Nudging rests on the idea that most decisions are actually taken unconsciously.‘Nudging for security’ means therefore to prepare the environment so that people unconsciously, but freely, choose the right option for themselves and their security. A nice example of this are the privacy-by-default requirements of the GDPR. It is now up to us to come up with – and implement – others for our customers.As a consequence, itrust consulting wishes to employ a social scientist to assist in this approach.Happy nudging for better cybersecurity!