Review of the publication NIST SP 800-47 Rev. 1 "Managing the Security of Information Exchanges"

Ruslan Rakhmetov, Security Vision

In today's world of comprehensive digitalisation and digitalisation of most business processes, information exchange plays a key role, be it sending files via email, providing online services to customers, sharing cloud infrastructure or transferring information via VPN tunnel between partner companies. In all cases, it is typically a matter of agreeing on a common format for sharing and protecting information, making legally enforceable agreements on sharing rules and confidentiality, maintaining the chosen method of sharing, and correctly terminating the interaction when the goal is achieved.

NIST document SP 800-47 Rev. 1, Managing the Security of Information Exchanges, provides guidance for building information exchange processes without reference to specific technologies and data transfer formats, focusing on aligning information exchange processes and ensuring their protection, as well as fulfilling agreements between exchange participants. The goals of secure exchange are to manage relevant cyber risks and to ensure that information is no less secure than that of the originating organisation through the application of IS measures and the signing of legally binding agreements.

NIST SP 800-47 addresses secure access and data exchange between information systems that are managed by different organisations/units or that cross system authorisation boundaries (a term from the NIST SP 800-37 Cyber Risk Management publication that refers to the formal area of responsibility for IT systems).

To manage and secure information exchange, NIST SP 800-47 proposes a structured approach consisting of 4 phases:

- Information Exchange Planning (establishing agreements, agreeing on methods, assessing systems and IT infrastructure);

- Establishing the secure exchange (implementation and configuration of protection systems, signing of agreements);

- Supporting the exchange and the relevant agreements (maintaining the state of security of the established information exchange, verifying compliance with the requirements of the agreements and updating them if necessary);

- Completion of the information exchange (planned, with preservation of operability of the systems not involved in the exchange, or unplanned, for example, as a result of an IS incident).

The paper emphasises that despite the obvious benefits of information exchange (savings, functionality, efficiency), companies are exposed to certain cyber risks, such as the threat of interception/modification/forgery of information exchanged or the use of the data exchange channel for cyber-attacks. The situation is further complicated by the fact that an exchange participant company cannot fully control the security of other participants and the information they transmit, and may have different levels of risk-tolerance for the data being exchanged. However, knowing in advance the types of data to be exchanged, the privacy levels of the exchanged information, and how it will be used will help to correctly handle the associated cyber risks and meet cybersecurity requirements, including protecting the information as it is transmitted within the exchange and further processed/stored.

Following NIST SP 800-47, a secure information exchange should be structured according to the following steps:

1. Planning the information exchange:

1.1 Establish a joint planning working group that includes representatives of the organisations participating in the planned information exchange (system owners, business process owners, system and network administrators, and information security administrators). This working group is responsible for coordinating the actions of the participants, assigning responsibilities and allocating resources, subsequently also acting as a platform for resolving issues.

1.2 Define a business case for the use of information exchange with a clear understanding of the purpose of the exchange, potential benefits, costs and risks. In addition, legal restrictions on sharing certain information (e.g., personal data, trade or banking secrets) should be considered.

1.3 Apply the provisions of the NIST SP 800-37 Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy, discussed earlier, to the systems used in the information exchange.

1.4 Determine the information protection requirements of the exchange, considering the following factors:

1.4.1. Applicable legislation, standards, policies, recommendations.

1.4.2 Assess cyber risks of breach of confidentiality, integrity, availability of exchanged information in order to select adequate measures for its protection and allocate appropriate resources. In this case, the information source organisation formulates its data protection requirements in the agreements concluded between the parties to the exchange.

1.4.3 The need to minimise the volume of exchanged information (no more than is necessary to meet the business objective), assess the reliability and availability of infrastructure for information exchange, analyse the interrelationships of organisations' information systems to identify factors that increase the risks of information exchange.

1.4.4 Assessment of damage from violation of confidentiality, integrity, availability of exchanged information for selection of adequate protection measures.

1.4.5 Method of information exchange (e.g. file exchange via e-mail, shared access to cloud storage, setting up a VPN tunnel between the networks of the companies participating in the exchange).

1.4.6 The impact of the information exchange on existing IT infrastructure and IT operational processes: determine whether current IT system component resources and capabilities are sufficient to support the selected information exchange method or whether new hardware/software components are purchased and installed. The potential impact of new information exchange components planned to be installed in the IT infrastructure should also be considered: the need for their further support, protection, administration.

1.4.7 Dependence of IT systems involved in information exchange on information received through exchange channels or on the exchange channel itself, with possible development of contingency plans, redundancy of exchange channels, redundancy of IT systems.

1.4.8 Detailed hardware requirements with assessment of sufficiency of current resources and taking into account equipment compatibility issues. 1.4.9.

1.4.9. Detailed software requirements with assessment of current resource adequacy and taking into account software compatibility issues.

1.4.10. Information exchange users: definition of requirements to users (form of admission, result of security check), formation and updating of access lists, account management.

1.4.11. Services and applications provided and used by Participating Organisations for information exchange (e.g. e-mail, secure file sharing, user authentication).

1.4.12. Identify roles and responsibilities for creating, maintaining and managing the information exchange, taking into account the professional competences of staff members.

1.4.13. Establish a schedule for planning, creating and maintaining information exchanges, including the conditions for revising or terminating the exchange (e.g., annual review of the information exchange agreement to verify that it is up to date and that the security measures used are sufficient).

1.4.14. Costs and budgeting, taking into account the costs of planning, establishing and maintaining the information exchange, software/hardware, security features, personnel, communication channels, physical security, training and testing. In addition, cost allocation to all participants in the information exchange should be planned.

1.4.15. Naming of items in databases to use a uniform compatible format.

1.4.16. Designation of information owners and custodians in information exchanges: whether the organisation receiving the information becomes the owner of the information, or whether it becomes only the custodian and the source organisation remains the owner.

1.4.17. Cybersecurity measures to protect the confidentiality, integrity, availability of exchanged information and the IT systems that process, store or transmit it. Information security requirements depend on an assessment of the potential damage of a breach of the security properties of the information exchanged and IT systems, as well as the risk tolerance of the organisation and the results of a cyber risk assessment. Measures may include: segregation of duties (between users and organisations participating in the information exchange), response to cyber incidents and suspicious IS events (types of incidents, ways of notifying responsible persons of participating organisations, cause of the incident, data or applications affected by the incident, predicted damage), contingency planning in case of failures or disasters, creation of backup copies of information (specifying the types of information to be backed up, frequency of backups, responsible persons), management of the information exchange (including the types of information to be backed up, frequency of backups, and the frequency of backups).

1.5 Signing of information exchange agreements, the level and significance of which depend on the importance of the information (i.e. potential damage from a breach of its security) and the method of information exchange. The agreements should spell out how and how the information and exchange system will be used, the roles and responsibilities, and the binding terms and conditions for working together. NIST SP 800-47 lists the possible types of agreements: Interconnection Security Agreement,ISA, Memoranda of Understanding (MOU), Memoranda of Agreement (MOA), Information Exchange Agreement (IEA), Service-Level Agreement, SLA, User Agreement, Access Agreement, Acceptable Use Agreement, Non-Disclosure Agreement (NDA), intercompany agreement formats, as well as control and accounting systems, including SGRC systems.

1.6 Approval (or rejection) of an information exchange by an authorised person - a manager with the right to make a documented decision on the acceptability of the relevant cyber risk based on the data transmitted by the joint working group for information exchange planning.

1.7 Urgent information exchange is allowed in case of emergency situations, in which the owners of the information or IT systems must, at a minimum, document the urgent transfer of information, a description of the emergency situation, and the participants and their roles in the urgent exchange. After the emergency situation is over, the urgent information transfer performed shall be analysed post facto for possible adjustments to the information exchange process or to verify the security of the urgently transferred information.

2. Establishing a secure exchange:

2.1 Develop an information exchange implementation plan that includes a description of the IT systems used, an assessment of the level of impact on the information exchanged, identification of roles and responsibilities for information exchange, specification of implementation tasks and procedures, description of measures to protect the confidentiality, integrity, availability of the information exchanged, as well as specifying criteria for evaluating the protection measures put in place, describing the requirements for appropriate training of employees and attaching all related applicable documentation.

2.2 Execution of the implementation plan (once agreed):

2.2.1 Install and/or configure software and hardware.

2.2.2 Implement and/or configure information security features.

2.2.3 Integration of applications/services for information exchange.

2.2.4 Conducting operational and security testing to assess the correctness of the information exchange system and its fulfilment of all information security requirements.

2.2.5 Conduct training for employees involved in information exchange.

2.2.6 Updating information exchange security plans to comply with changes in IT infrastructure and business processes.

2.2.7 Conduct cybersecurity audits and coordinate changes in IT systems involved in information exchange.

2.3 Launch information exchange with monitoring and documenting the correctness of exchange processes, exchange system users' requests, and security events in the involved IT systems.

3. Support of information exchange:

3.1 Support a clear order of communications between participating organisations for prompt resolution of information exchange issues.

3.2 Support the systems and their components used for information exchange.

3.3 Manage user accounts for the information exchange system. 3.4.

3.4 Conduct information security audits at agreed intervals, when significant changes are made or in accordance with internal continuous monitoring policy.

3.5 Analysing security logs to identify suspicious or unusual activity.

3.6 Respond to cyber incidents in the information sharing system in accordance with developed response plans, involving competent personnel from member organisations as necessary.

3.7 Coordinate the emergency plans of the participating organisations in the information exchange.

3.8 Manage the introduction of changes, assessing the impact of changes on information exchange and notifying member organisations in a timely manner.

3.9 Review and update agreements (between member organisations) and cybersecurity plans for the information exchange system.

3.10. Review the business need for information exchange at an agreed frequency to identify the current need for the information exchange system.

4. Completion of information exchange:

4.1 Scheduled termination as a result of achieving the business objective, when the overhead of the exchange system increases to unacceptable levels, when participants fail to comply with agreements or security requirements, when systems or equipment conditions change, and when associated cyber risks increase to unacceptable levels. In case of planned termination of information exchange, timely notification should be given to the participating organisations to coordinate the change/deletion of exchange system components, deletion of received data, notification of exchange system users.

4.2 Emergency termination of information exchange may be required as a result of a cyberattack, intrusion of hackers or other emergency situations. In this case, it may be necessary to forcibly and without prior agreement to shut down the information exchange. Once response procedures have been implemented and an internal investigation into the causes of the incident has been completed, the incident should be reported to the participating organisations and the terms and conditions for resuming information exchange should be agreed.

4.3 Information exchange may be resumed after a short-term interruption (e.g. as a result of an attack) after response procedures have been completed and the necessary changes have been made to ensure that the incident does not recur. In the case of a long-term interruption (several months or longer), all participating organisations will need to conduct a new cyber risk assessment, re-examine all previous difficulties and errors, and develop new agreements.