More often than we might think, we work with documents known as international standards or with documents directly based on those standards. In fact, a considerable percentage of the research carried out in national and international universities, companies and research centres, is founded on the existence of such standards. Far from being simply documents ‘discovered’ by chance and signed by an anonymous author whose identity will never be known, they are actually produced under the auspices of officially recognised standardization bodies.

The increasingly multi-sectoral nature of voluntary standards is evidenced by the fact that an ever growing number of sectors are seeing standardization as a basis for providing users and customers with higher quality services and products.

With regard to the international framework concerned with Information Technologies (IT) related aspects, there is a joint committee formed by two standardization bodies; ISO (International Organization for Standardization) and IEC (International Electrotechnical Commission, focusing on the electrical areas of each field). The joint technical committee is known as JTC1 (Joint Technical Committee 1).

Standardization and Certification (S&C) activities in the field of Information Technologies are increasingly more relevant to organizations and the general public. This is particularly true of everything related to information security, and not only concerning product manufacturing and marketing requirements but also information management standardization carried out by organizations in order to protect the information they are handling.

This monograph takes a look at the world of regularization and standardization from the viewpoint of security. If for many years the field of security has been a kind of ‘dark’ space in comparison with other areas of Information Technology, this is even truer in the case of standards regulating the security techniques which are nowadays embedded in so many applications and ICT systems. This monograph aims to bring this aspect of ICT security out of the shadows and into the spotlight. It is made up of nine articles which cover the aspects of ICT standardization that we consider to be of most interest to our readers.

2 The Contents of This Monograph

Next up are a series of articles of a more general nature which take a look at the keys to the future of standards and the requirements of the various interested groups which need to be met in order to enable the development, advance, and penetration of our oft-mentioned Information Society.

In this group of articles, Miguel Bañón, in “Common Criteria International Standards”, introduces readers to the “Common Criteria for Information Technology Security Evaluation” and the “Common Methodology for Information Technology Security Evaluation”, which are internationally accepted standards used to evaluate and certify security products. Meanwhile, in his article “Security Metrics and Measurements for IT”, José A. Mañas-Argemí looks into the need to measure the level of security that we have implemented in an organization, from the point of view of both that organization’s technical requirements and its management measures. The author argues that metrics are essential for knowing an organization’s current security status, improving it, and managing expenditure and investment on security.

In the same vein, in “IT Security Audits from A Standardization Viewpoint”, Marina Touriño shows how information security auditing and the regulatory framework are converging worlds, ones which are mutually beneficial in the quest for the heightened security levels that our Information Society requires.

The following article, “Legislation, Standards and Recommendations Regarding Electronic Signature”, by Josep-Lluís Ferrer-Gomila and Apol·lònia Martínez-Nadal, shows how European Union legislation and technical recommendations are convergent, although they also point to an occasional lack of alignment with prevailing law.

In the final group of articles, David Chadwick, in “The X.509 Privilege Management Standard” provides an overview of Privilege Management Infrastructures (PMIs) and how the X.509 standard has evolved since its publication in 2001 until the latest 2005 edition which is soon to be published. Finally, the monograph closes with an article by Spyros Kokolakis and Costas Lambrinoudakis entitled “ICT Security Standards for Healthcare Applications” who make an interesting contribution concerning security standards applied to telemedicine or e-Health, which is currently an emerging field at the intersection between medical IT, public health, and business. This field involves health services and information delivered or enhanced by the Internet and related technologies, and the article describes how the Public Health system has always been a pioneer in the use of security regulations and standards specifically developed and adapted to this controversial area of IT application.

Let us remark that the customary “Useful References” for readers who wish to understand in greater detail the matter being covered, have not been included this time because the papers above contain a lot of them (see, for instance, the glossary of accronyms in the paper by Luc Van den Berghe).

In closing we would like to thank the authors, all of them recognised specialists in the field of ICT standardization, for all their interesting contributions and the editors of Novática and UPGRADE for the confidence they have placed in us by asking us to edit this monograph.