10 - Security

Summary

Background

Fear of the unknown

NFC, like many areas of information technology (IT), is beset with concerns about security. These are often expressed in two ways: as demands by policymakers and requirements-setters for bomb-proof security, particularly in matters relating to consumers, and as headline-grabbing demonstrations of a successful attack, often in a laboratory environment and subject to highly esoteric conditions.

The demands for security are often overstated and represent more of a reaction to the unknown than a real requirement; nevertheless the industry must respond to these with more than bland reassurances if it is to establish trust in any new technology. Likewise each demonstration of a successful attack must be analyzed to see if it could be the basis of a real-life attack with significant implications for users, or if there is a gap in the overall security architecture. In general industry players must act responsibly to show both that the NFC infrastructure is fit for purpose and that each application takes appropriate security measures.

This chapter seeks to bridge the gap between users and suppliers by being specific about the classes and levels of security that may be required in an NFC system, and the tools and structures that can be used to provide that security. Users and system specifiers then need to ensure that their needs are accurately defined and that the appropriate tools are being used.