FTAPI Glossary.

BSI stands for the “Federal Office for Information Security” and is a federal agency in Germany responsible for the security of IT systems and infrastructures. It is part of the Federal Ministry of the Interior, Building and Community and is headquartered in Bonn.

The BSI is responsible for the development of IT security standards, guidelines, and recommendations for the public administration as well as for businesses and citizens. It works closely with other national and international organizations to coordinate and analyze IT security issues and develop appropriate protective measures. The goal of the BSI is to increase IT security in Germany and protect information security. Additionally, it serves as a point of contact for IT security incidents.

A brute-force attack is a form of hacking in which an attacker attempts to gain access to a protected system by trying out all possible combinations of passwords, codes, or keys. The attacker uses software that automatically and rapidly tries different password combinations in order to guess the correct password.

Brute-force attacks are often time-consuming methods as hackers have to try a very large number of possibilities. However, it is also a very simple method and does not require deep technical understanding to execute. For this reason, cybercriminals frequently resort to this method. To protect against brute-force attacks, strong passwords should be used, consisting of a combination of letters, numbers, and special characters, and should be changed regularly. Using a password manager can help generate and store strong passwords without the need to remember them. Additionally, introducing delays between multiple login attempts can make it more difficult to try out passwords. It is also advisable to always use the latest versions of software and keep them updated. Two-factor authentication requires a second security factor (e.g. an SMS code or a biometric authentication) in order to access an account. This makes it more challenging to take over an account with a stolen password.

The C5 criteria catalog is a comprehensive guide for information security in the cloud, developed by the “Federal Office for Information Security” (BSI) in Germany. The name “C5” stands for “Cloud Computing Compliance Controls Catalogue” and refers to the five areas covered in the certification: governance, risk management, compliance, technology, and operation.

C5 defines a set of requirements that a cloud provider must meet to obtain certification. These include:

• Establishing an information security management system (ISMS) for cloud services
• Implementing measures to ensure confidentiality, integrity, and availability of data in the cloud
• Compliance with legal and regulatory requirements, such as data protection and IT security
• Monitoring of cloud services and regular review and updating of security measures
• Ensuring clear and transparent communication with customers and authorities regarding the security of cloud services.

The C5 criteria catalog aims to help businesses choose secure cloud services and support cloud providers in implementing high-security standards. Through C5 certification, cloud providers can demonstrate their competence and trustworthiness and provide customers with assurance that their data is safe in the cloud.

A “client” is an application or device that accesses and uses a server resource. Typically, it refers to a software application installed on an end device such as a computer or mobile device that communicates with a server via the internet or a network.

Examples of client applications include web browsers, email clients, FTP clients, instant messaging clients, and remote desktop clients. These programs allow users to access server resources or communicate with other users over a network.

The client is an essential component of the client-server architecture used for many applications and services on the internet. In this model, the client communicates with the server to retrieve data or make requests, while the server receives the client’s request and provides corresponding resources or data.

CVE stands for “Common Vulnerabilities and Exposures” and refers to a publicly accessible list of security vulnerabilities found in various software and hardware products. Each entry in the CVE database contains a unique identifier, a description of the vulnerability, information about which products are affected, and the potential impact of the vulnerability.

Vulnerabilities are discovered, assigned, and disclosed by organizations from around the world that have partnered with the CVE program. The goal is to communicate uniform descriptions of vulnerabilities. Information technology and cybersecurity experts use CVE records to ensure they are discussing the same issue and to coordinate their efforts in prioritizing and remedying vulnerabilities.

CVE entries are managed by an organization called the MITRE Corporation. CVE is utilized by numerous security companies and researchers worldwide to track and report vulnerabilities, as well as to inform and protect their customers.

Cloud computing, in IT, refers to an infrastructure where resources such as computing power, storage space, servers, and application software are provided over the internet.

Instead of operating and maintaining their own data centers, companies can access the services of cloud providers who host and manage the resources in their own data centers. This allows companies to quickly and easily access the resources they need without having to purchase and maintain expensive hardware and software.

Cloud technology also enables applications and data to be accessible from anywhere, as long as an internet connection is available. Cloud-based solutions often offer scalability, flexibility, and cost efficiency, as companies only pay for the resources they actually use and can quickly respond to changing business requirements.

Cybersecurity refers to the protection of computer networks, computer systems, mobile devices, electronic data, and sensitive information from unauthorized access, misuse, theft, or damage. It includes the practices, technologies, and procedures used to ensure the confidentiality, integrity, and availability of digital systems and data.

In today’s interconnected world, cybersecurity is crucial as businesses, organizations, and individuals rely more and more on digital systems and technologies. A successful cyber attack can have severe consequences, such as the loss of important data or information, damage to reputation, financial losses, or even compromising physical security.

Therefore, it is important for companies and organizations to take proactive measures to enhance their cybersecurity. This can be achieved through the implementation of firewalls, antivirus software, encryption technologies, authentication mechanisms, and other security measures. Regular monitoring and updating of these measures are also of great importance to ensure that they are always up to date and able to withstand constantly evolving threats.

Overall, cybersecurity is an essential component of any organization or company operating in the digital space. Through a solid cybersecurity strategy and regular monitoring and updating, businesses and organizations can ensure the confidentiality, integrity, and availability of their digital systems and data, protecting themselves against the growing threats from the cyberspace.

Data exchange refers to the process of transferring data from one computer or system to another. Different types of data can be exchanged, such as text, images, audio or video files, tables, databases, and more.

Data exchange can occur in various ways, such as through local networks, wireless connections like Bluetooth or Wi-Fi, or the Internet. Data exchange can be done manually or automated, for example, through special interfaces, protocols, or APIs.

Data exchange is a fundamental aspect of information and communication technology, enabling the exchange and sharing of data between different systems, applications, and platforms to ensure seamless collaboration and interoperability.

There are various dangers and risks associated with data exchange that can jeopardize the security and confidentiality of data. Here are some of the most common dangers:

• Data loss: Data can be lost during data exchange due to transmission errors, technical disruptions, or hardware failures.
• Data theft: Data theft is one of the biggest risks in data exchange. Unauthorized individuals may attempt to access data to steal or misuse it.
• Malware and viruses: Malware and viruses can be transferred during data exchange, and infected files can execute unwanted activities on the target computer.
• Phishing: Phishing attacks can occur during data exchange through fake emails, websites, or links that can lead users to disclose their personal data or passwords.
  Unencrypted connections: Unencrypted connections can allow data to be intercepted or eavesdropped on during transmission.

To minimize these risks, it is important to use secure connections and protocols, perform regular data backups, and implement strong passwords and security measures.

Virtual data rooms are secure online storage platforms used to exchange and store confidential data and information. They are commonly utilized by businesses, government agencies, healthcare, and the industrial sector to securely share information.

Data rooms provide various security features, such as data encryption and control of access to information through user roles and permissions. This ensures that only authorized users can access and edit the information.

In addition to virtual data rooms, there are also physical data rooms where documents are stored. However, the benefits of virtual data rooms outweigh those of physical data rooms:

• Accessibility: A virtual data room can be accessed anytime and from anywhere in the world as long as there is an internet connection. In contrast, a physical data room requires physical presence to access the documents.
• Security: A virtual data room offers higher security compared to a physical data room. All data is encrypted, and there are multiple layers of security measures restricting access to the data. Conversely, a physical data room is more vulnerable to theft or loss.
• Easy collaboration: In a virtual data room, multiple users can access and collaborate on documents simultaneously without needing to be in the same physical location. A physical data room, on the other hand, requires all involved parties to gather in one place, which can be time-consuming and costly.
• Time and cost savings: A virtual data room can save time and costs as there is no need to create physical copies of the documents or incur travel expenses for participants. Additionally, searching for documents is easier and faster as they are digitally indexed and searchable.
• Environmental friendliness: A virtual data room is more environmentally friendly than a physical data room since there is no need to create paper documents. The use of a virtual data room can also reduce the travel of participants, leading to a reduction in CO2 emissions.

Digital sovereignty refers to the ability of a country, organization, or individual to control and protect their digital affairs and data independently from other countries or organizations.

This includes having control over digital infrastructure, such as cloud services, networks, or data centers, ensuring data security and privacy principles, securing communication networks, and digital identity. The aim of digital sovereignty is to ensure that digital data and services cannot be misused or exploited by other countries or organizations.

In general, digital sovereignty means that a person, organization, or country is capable of controlling and managing their digital affairs without dependency on other parties. This includes independence from other countries and organizations, as well as from specific providers and products.

Digital sovereignty can be achieved on different levels, including:

• Independent digital infrastructure: A country or organization can build its own digital infrastructure that is operated independently from other countries or organizations. This may involve controlling the digital infrastructure, utilizing open-source software, and handling data processing and storage on their own.
• Investments in digital skills: A country or organization can invest in the education and training of professionals to acquire the necessary skills to independently manage digital affairs and security.
• Data protection and cybersecurity: A country or organization can implement strict data protection and cybersecurity measures to ensure the security of digital infrastructure and data. This may also include the use of encryption technologies and authentication methods to verify user identity.
• Legal regulations: A country or organization can enact legal regulations that ensure digital sovereignty and protect digital infrastructure and data. This includes provisions for data protection, cybersecurity, net neutrality, and digital identity.
• International collaboration: To achieve digital sovereignty, countries and organizations can collaborate on an international level to establish common standards and norms for the protection of digital affairs and data.

GDPR stands for General Data Protection Regulation. It is a European data protection regulation that came into effect on May 25, 2018. The GDPR was developed to strengthen data protection and data security for citizens of the European Union and to establish unified standards for handling personal data within the EU.

The GDPR sets out how personal data must be collected, processed, stored, and protected. It applies to companies, organizations, and authorities that process personal data of EU citizens, regardless of whether these companies are located within or outside the EU.

The regulation includes various principles, such as the necessity of data processing, the lawfulness of processing, consent of the data subject, the right to access, the right to rectification, and the right to erasure of personal data. It also establishes measures for data protection and data security, such as pseudonymization and anonymization of data, as well as the implementation of appropriate technical and organizational measures to protect the data.

The GDPR aims to strengthen the protection of personal data and raise awareness of data protection. Violations of the GDPR can result in significant fines.

An electronic medical certificate of incapacity for work (eAU) is a digital version of a doctor’s certificate confirming that a person is unable to work due to illness or injury.

The eAU replaces the previous paper-based medical certificate of incapacity for work and can be transmitted electronically to the employer. Typically, the eAU is sent by the doctor’s practice or the hospital directly to the relevant health insurance company, which then forwards it to the employer. Since January 2023, it has been mandatory for employers to retrieve electronic medical certificates of incapacity for work.

The eAU offers advantages such as faster transmission, as it can be sent digitally, and increased data security, as it is transmitted encrypted and cannot be lost. In addition, patients can usually send the eAU to their employers online themselves if their health insurance company offers this service.

An ISO certification refers to the awarding of a certificate according to the international standards set by the International Organization for Standardization (ISO). ISO is an independent organization that develops and publishes globally recognized norms. The ISO certification confirms that a company, organization, or product meets the requirements of specific ISO standards.

There are various ISO standards that apply to different areas, such as ISO 9001 for quality management, ISO 14001 for environmental management, ISO 27001 for information security management, and many more. Each standard defines specific requirements and best practices for the respective topic.

The ISO certification is typically conducted by an independent certification body that examines the company or organization to determine if they meet the requirements of the relevant ISO standard. If all requirements are met, a certificate is issued, which is valid for a specific period of time.

It is important to note that ISO certification is not a legal requirement but rather a voluntary process that companies or organizations can undergo to document their compliance with internationally recognized standards.

“On-Premises” means that software, applications, or systems are installed and operated on a physical computer or server located on-site. In contrast, cloud-based solutions host their software or applications on servers in a remote data center environment and are accessible over the internet.

On-premises solutions can be attractive to companies that seek greater control and security over their data and systems, as they can manage all aspects of maintenance and security themselves. However, there are also some disadvantages of an on-premises solution compared to cloud-based solutions that should be considered:

• Higher initial investments: On-premises solutions typically require a significant investment in hardware, software, network, and storage infrastructure, as well as IT personnel to implement, configure, and maintain the systems.
• High maintenance costs: Since the company is responsible for operating and maintaining the systems, ongoing costs for the maintenance and updating of hardware and software are incurred. This can be expensive in the long run and requires appropriate budgeting.
• Scalability: Scaling on-premises systems can be difficult and time-consuming, as companies usually need to acquire and install additional hardware and infrastructure to meet capacity requirements.
• Mobility limitations: On-premises solutions can restrict employee mobility, as they usually need to work from a specific location to access the systems. Especially in times of remote work, this is not the ideal solution.
• Security and compliance risks: Companies are responsible for the security and compliance of their on-premises systems, which means they have to rely on their own security measures. This can pose a high risk, as it is challenging to identify and secure all potential attack vectors. Additionally, legal and regulatory requirements, such as the GDPR, may require compliance with specific security standards that can prove difficult and costly.

Cloud-based solutions typically offer greater flexibility and scalability, as well as improved mobility and a higher level of security and compliance. Therefore, companies should consider which type of solution is best suited to their specific requirements and resources.

Ransomware is a type of malicious software (malware) designed to block or restrict access to a computer system or the data stored on it by encrypting or otherwise rendering it inaccessible. The term “ransomware” derives from the English words “ransom” and “software,” as the attackers typically demand a ransom from their victims in order to restore access to the encrypted data.

The primary objective of ransomware is to extort the affected individual or organization by holding their data or systems hostage. Upon infection, ransomware typically displays a warning message or popup window informing the user that their data has been encrypted and a payment must be made to restore the decryption key or access.

Payment is often demanded in the form of cryptocurrencies like Bitcoin, as these transactions are difficult to trace and maintain the attackers’ anonymity. The amount of ransom demanded can vary and can range from a few hundred to several thousand dollars.

Ransomware can spread through various methods, including email attachments, infected websites, drive-by downloads, and exploited system vulnerabilities. To protect against ransomware, it is important to regularly back up important data, use robust antivirus and security software, avoid opening suspicious emails, and keep software and operating systems up to date.

Shadow IT refers to IT resources and systems that are used by employees within an organization without the approval or knowledge of the IT department or management. These resources cannot be controlled or maintained by the IT department, which can lead to security risks, data loss, and poor integration.

Shadow IT can occur for various reasons. One reason may be that employees want to use alternative tools that are not provided by the IT department or are too complex to be managed by the IT department. Another reason may be that employees simply do not know that they are violating IT policies.

To minimize the risks of shadow IT, it is important for companies to have clear IT policies and procedures and to inform employees about them. Companies should also ensure that they provide secure and accessible IT resources that meet the needs of employees to ensure that they do not rely on shadow IT. The IT department should also conduct regular audits to identify and address potential shadow IT risks.

Shadow IT poses various risks to companies, including:

• Security risks: Shadow IT systems are often not approved or managed by the IT department and may therefore have security vulnerabilities that compromise the confidentiality, integrity, and availability of data and systems.
• Compliance risks: Shadow IT systems may violate legal or regulatory requirements, especially when it comes to data privacy and security.
• Administrative burden: Shadow IT systems can be difficult for the IT department to identify, monitor, and manage, resulting in a higher administrative burden and compromising the IT security of the company.
• Data loss and inconsistency: Shadow IT systems may store and process data in different ways, resulting in data inconsistencies. Additionally, there is a risk of data loss or inability to recover data if the shadow IT system is not properly backed up and secured.
• Reduced productivity: Shadow IT systems can hinder teamwork and productivity when different employees use different tools and store data in different systems, leading to collaboration and communication challenges.

It is important for companies to be aware of the risks associated with shadow IT and develop a strategy to minimize and manage these risks.

TLS stands for “Transport Layer Security” and is a protocol used to establish a secure connection between two communicating parties, preventing third parties from intercepting and reading or tampering with the traffic.

TLS 1.2 offers various security features such as data encryption, server authentication, and client authentication. It is supported by most modern web browsers and servers and is often used to ensure secure connections for online transactions, online banking, and data transfer over web applications.

Compared to older versions of TLS, TLS 1.2 provides higher security and improved cryptographic algorithms to ensure data confidentiality and integrity. However, TLS 1.2 is not necessarily immune to attacks and vulnerabilities, which is why it is important to perform regular updates and security measures to ensure the security of the transmitted data.

The latest version of the TLS protocol is TLS 1.3.

The so-called “Whistleblower Law” refers to legal provisions that regulate the protection of individuals who disclose misconduct or illegal activities in organizations or institutions.

In October 2019, the EU Whistleblower Directive was adopted by the European Union with the aim of protecting whistleblowers who report internal misconduct within companies. For Germany, the Bundesrat passed the Whistleblower Protection Act on May 12, 2023.

The Whistleblower Law is aimed at promoting transparency and accountability. Whistleblowers play an important role in uncovering corruption, fraud, mismanagement, and other illegal practices. The law encourages the disclosure of such misconduct and contributes to the creation of more transparent and responsible institutions.
Companies must establish a workflow to protect whistleblowers, enabling them to expose wrongdoing without fearing any adverse consequences.

Two-Factor Authentication (2FA) is a security mechanism designed to enhance access security to digital accounts or systems. With two-factor authentication, users must provide two different types of evidence to confirm their identity and access an account or system.

Traditionally, authentication relied solely on a single factor, namely knowledge of a password. However, this approach proved to be vulnerable, as stolen or weak passwords present a high security risk. 2FA was introduced to address this problem.

In two-factor authentication, users must provide a second factor in addition to their password. This second factor can be one of three types:

• Something the user knows: This could be a personal identification code (PIN), a secret question, or a passphrase.
• Something the user possesses: This may be a physical device, such as a mobile phone, a hardware token, or a smart card.
• Something the user is: This refers to the user’s biometric characteristics, such as fingerprints, voice, iris, or facial recognition.

Typically, 2FA authentication occurs in two steps: The user first enters their username and password (first factor). Then, the second factor is requested, such as a one-time code sent via SMS to the user’s mobile phone. The user enters this code to confirm their identity and gain access.

The use of Two-Factor Authentication significantly enhances security, as even if an attacker knows a user’s password, they still need to overcome the second factor to gain access. This makes it considerably more difficult for attackers to gain unauthorized access to accounts or systems.