Practical protection of personal data. Evaluate the effectiveness of measures taken to ensure the security of personal data

Ruslan Rakhmetov, Security Vision

Continuing the series of articles on practical protection of personal data, let's consider the question what is the assessment of the effectiveness of measures taken to ensure the security of personal data in accordance with the Federal Law of 27.07.2006 № 152-FZ ‘On Personal Data’.

As we said in the very first article ("Personal data protection through the eyes of practice. How should a company process and protect personal data? Part 2"), the final stage of building an information protection system is to assess the effectiveness of measures taken to ensure the security of personal data.

The Federal Law of 27.07.2006 No. 152-FZ ‘On Personal Data’, namely paragraph 4 of part 2 of Art. 19 stipulates: ‘ensuring the security of personal data. 2 of Article 19 stipulates: ‘ensuring the security of personal data is achieved, in particular ... by assessing the effectiveness of the measures taken to ensure the security of personal data before putting into operation the information system of personal data’.

According to GOST 25866-83 ‘Operation of machinery. Terms and Definitions’, exploitation is ’a stage of the product life cycle at which its quality is realised, maintained and restored.

Note: operation of the product includes, in general, intended use, transport, storage, maintenance and repair’. I.e., in ordinary language, exploitation is when personal data processing takes place. Thus, the performance assessment is made before the processing of personal data takes place.

Sometimes we come across customers who emphasise two performance assessments. This statement is based on a certain discrepancy in the terms used in paragraph 4, para. 2 of the 152-FZ (Evaluation of the effectiveness of measures taken to ensure the security of personal data) and p. 6 of the Order of the FSTEC of Russia No. 21 dated 18.03.2013 ‘On approval of the composition and content of organisational and technical measures to ensure the security of personal data during their processing in the information systems of personal data’ (hereinafter - Order 21) (Evaluation of the effectiveness of measures to ensure the security of personal data implemented within the personal data protection system). However, in our practice we have not encountered cases when the inspectors represented by Roskomnadzor would require exactly two such assessments or would not take into account the fulfilment of the norm 152-FZ on efficiency assessment, which would be called as specified in Order 21. Hereinafter we will use the term as stated in the 152-FZ - assessment of the effectiveness of measures taken to ensure the security of personal data.

According to the established practice, let us start with the background. In the very first version of 152-FZ there was no separate norm stating that it is necessary to assess the measures taken to ensure personal data security in some additional way. The Resolution of the Government of the Russian Federation No. 781 dated 17.11.2007 "On Approval of the Regulation on Ensuring the Security of Personal Data during their Processing in Personal Data Information Systems ’ (hereinafter - PP 781), issued in pursuance of 152-FZ, also did not introduce such a norm.

The norm on the assessment of compliance of the personal data information system with the information security requirements of the created protection system was introduced by the ‘Basic measures for the organisation and technical security of personal data processed in personal data information systems’ (approved by the Deputy Director of the FSTEC of Russia on 15.02.2008, restriction marking ‘For official use’) (hereinafter - Basic measures).

However, as we discussed in the article "Personal data protection through the eyes of practice. How should a company process and protect personal data? Part 2", many companies pointed out that by issuing a document labelled “For Official Use” (hereinafter - FSP), the FSTEC of Russia violates one of the key requirements of the 152-FZ, namely the publicity of the requirements, which is enshrined in part 2 of Article 4 of the 152-FZ: "On the basis of and in pursuance of federal laws, state authorities, within the limits of their powers, may adopt regulatory legal acts on certain issues related to the processing of personal data. Normative legal acts on certain issues related to the processing of personal data may not contain provisions restricting the rights of personal data subjects. These normative legal acts shall be subject to official publication, except for normative legal acts or certain provisions of such normative legal acts containing information, access to which is restricted by federal laws".

Some time later (16.11.2009) the FSTEC of Russia removes from the document the mark of restriction of CPD.

So, what did the Main Measures establish? Let us refer to clause 3.5 of this document: ‘...3.5. The following stages of creating an ISPAA are recommended: ...the stage of putting the ISPAA into operation, including pilot operation and acceptance testing of information protection equipment, as well as assessment of compliance of the ISPAA with information security requirements’.

Subsequent clause. 3.11 stated: ‘...3.11. At the stage of putting an ISPDN (NWPDN) into operation, the following shall be carried out:

...assessment of compliance of an ISPDN with the requirements of personal data security.

The assessment of compliance of an ISPDN with the personal data security requirements shall be carried out in the form of:

for class 1 and 2 ISPDNs - mandatory certification (attestation) of information security requirements;

for class 3 ISPDNs - declaration of compliance with information security requirements.

For class 4 ISPDNs, conformity assessment is carried out by the operator's decision...’.

Deciphering of the abbreviations used:

ISPDN - personal data information system

Personal data - personal data

Personal data protection system - personal data protection system.

The nuances of applying the declaration approach were discussed in the previous article ‘Practical Personal Data Protection. What are the information protection means that have undergone the conformity assessment procedure in accordance with the established procedure’.

Although the document states that the ‘Conformity Assessment’ stage is recommended, in practice the FSTEC of Russia said that the assessment stage in the form of attestation is mandatory. Attestation as a form of assessment for FSTEC Russia is familiar and has been used for a long time. As we described in the article "Personal data protection through the eyes of practice. How should a company process and protect personal data? Part 2", before the 152-FZ was issued, there were requirements for the protection of confidential information, which established requirements for the necessity and procedure of certification of automated systems that process confidential information. This procedure was called attestation of the object of informatisation. The general procedure of attestation was defined in the Regulations on attestation of informatisation objects on information security requirements ( approved by the State Technical Commission of Russia on 25.11.1994) (hereinafter - Regulations on attestation). At that time only companies accredited by the FSTEC of Russia as an attestation body were entitled to carry out attestation.

In brief, the attestation procedure is similar to the procedure of acceptance of automated systems into operation. To conduct attestation, a Programme and Methods of Attestation Testing (hereinafter referred to as PMT) are developed, which specify: what is checked, what is checked, how it is checked, and what it is checked for. Guided by the PMI, the attestation commission of the attestation body (since 2012, just a licensee of the FSTEC of Russia for activities on technical protection of confidential information with the permitted type of activity - attestation testing and attestation for compliance with information protection requirements of information facilities and systems) (hereinafter referred to as the Attestant) conducts tests of the information object and, collecting evidence/results of inspections, forms the Protocol of attestation tests, which reflects the fulfilment of the verified requirements. On the basis of the protocol, the Attestation Commission forms a Conclusion, in which it concisely reflects the overall result of information protection at the informatisation object. On the basis of the formed Conclusion the head of the Attestator makes a decision on issuance or refusal to issue (in the presence of unrecoverable remarks or refusal of the owner of the informatisation object to eliminate non-conformities) the Certificate of Conformity.

However, this approach (attestation) has one very significant disadvantage, and the works on personal data protection have shown it very clearly. This big disadvantage is that the previously attested object of informatisation practically cannot be changed. A number of specialists will correct us, saying that this is not true and normative documents do not prohibit it, but let's consider under what conditions it is possible and what should be done for this.

So, you have carried out certification, fixed in the design, operational and organisational-administrative documentation the object of informatisation and provisions for information protection. One of the main documents that must be submitted for attestation and that the owner of the informatisation object must keep and constantly monitor are:

• Access Matrix
  
• Technical passport
  
• Description of the technological process of information processing.
• 
  

All these documents actually ‘cement’ the object. They reflect the technological process of work on the object of informatisation, the structure and composition of the object of informatisation - on what equipment with serial numbers and locations is the object of informatisation, what system and application software (with indication of versions) is on the means of computing equipment of the object of informatisation, what protection means are used (with indication of licenses, serial numbers and special protective marks), what protected resources are on the object of informatisation and who is allowed access to them). This is not the entire set of data that must be specified for an informatisation object, but we have highlighted the most critical ones.

All this leads to the fact that, changing something in the system and, as a consequence, in the object of informatisation, the company has to address the Attestant on the issue of changing the attestation documents. In our practice we have come across situations when the Attestator refused to change the previously attested object or said that changes in the object will terminate the validity of the Attestation of Conformity and it will be necessary to recertify it again. All these positions were motivated by the provisions specified in the Certificate of Conformity and/or reference to changes in the technological process of information processing.

Typically, the Compliance Attestation states the following (taken from an arbitrary attestation):

"The list of characteristics about changes of which it is required to notify the attestation body obligatorily:

• conditions of placement of technical means and systems;
  
• composition (completeness) of the products used for information protection purposes, the scheme of their installation (installation and configuration parameters), contributing to a decrease in the level of protection of the informatisation object
  
• characteristics of systems (power supply, grounding, signalling) for ensuring the operation of the informatisation object’.
• 
  

This is done not by chance, because in item 9 of Appendix 2 of the Regulations on Attestation, where the form of the Certificate of Conformity is given, it is stated that it is necessary to specify the list of characteristics, changes in which must be notified to the Attestant. In other words, if we analyse all the above-mentioned, we come to the same conclusion as above: the attestation of the personal data information system is not the most successful form of performance assessment.

Additionally, it should be stressed that, according to item 3.8.4 of the Regulation on attestation, ‘... thecertificate of conformity’ is issued to the owner of the attested informatisation object by the attestation authority for a period during which the conditions of functioning of the informatisation object and of the processing technology of the protected information, which may affect the characteristics determining the security of information (composition and structure of technical means, conditions of placement, software used, modes of information processing, media, etc . ) remain unchanged .

In 2010 there are changes in the previously formed requirements in the field of personal data protection:

1) Order of the FSTEC of Russia No. 58 dated 05.02.2010 ‘ On Approval of the Regulation on Methods and Techniques of Information Protection in Personal Data Information Systems ’ (Registered with the Ministry of Justice of Russia on 19.02.2010 No. 16456) (hereinafter referred to as Order 58) is approved.

2) By the Decision of the FSTEC of Russia dated 05.03.2010 the following documents in the field of personal data protection are recognised as invalid:

• Basic measures for organisation and technical security of personal data processed in personal data information systems (approved by the Deputy Director of the FSTEC of Russia on 15.02.2008)
  
• Recommendations on ensuring security of personal data during their processing in personal data information systems (approved by the Deputy Director of the FSTEC of Russia on 15.02.2008).
• 
  

Order 58 no longer specifies that personal data information systems are subject to certification. However, the norm of item 3 of PP 781, which reads as follows. 3 of PP 781, which states: "Methods and ways of information protection in information systems are established by the Federal Service for Technical and Export Control and the Federal Security Service of the Russian Federation within the limits of their authority. The adequacy of measures taken to ensure the security of personal data during their processing in information systems shall be assessed in the course of state control and supervision". At that time, the FSTEC of Russia did not consider and did not apply any other methods of conformity assessment except for attestation and certification.

In 2011 there are changes - clause 16 of the Federal Law dated 25.07.2011 No. 261-FZ ‘ On Amendments to the Federal Law “ On Personal Data ” (hereinafter - 261-FZ) introduces the concept of assessment of the effectiveness of measures taken to ensure the security of personal data. In fact, from this moment on, there is a division of the form of evaluation of the applied protection measures. Conventionally, two directions are distinguished:

• Attestation
  
• Other forms.
• 
  

Let's consider what happens with attestation. Following 261-FZ, a number of documents are issued, changing the previously established procedure of attestation:

• Resolution of the Government of the Russian Federation of 03.02.2012 No. 79 ‘On licensing activities for technical protection of confidential information’
  
• GOST RO 0043-003-2012 Information Protection. Attestation of informatisation objects. General provisions (restriction marking of CPD)
  
• GOST RO 0043-004-2013 Information protection. Attestation of informatisation objects. Programme and methods of attestation tests (DSP restriction marking).
• 
  

The above documents expand the list of companies that can carry out attestation of informatisation objects that process confidential information. As we indicated above, this is now done by the FSTEC of Russia licence holder for activities on technical protection of confidential information with the permitted type of activity - attestation tests and attestation of compliance with information protection requirements of information facilities and systems. The GOSTs also change the procedure and conditions of attestation and the forms of reporting attestation documents.

The previously mentioned problems are only aggravated, because the form of the Attestation of conformity is changed, introducing in it as an annex an analogue of the Technical passport. I.e. if earlier there was some illusion that the change of the object could be overlooked or tried to hide, because its composition is not known anywhere in public documents, now it becomes problematic.

Also in 2012, the Government of the Russian Federation approved Resolution No. 1119 of 01.11.2012 ‘On Approval of Requirements for the Protection of Personal Data in the Processing of Personal Data in Information Systems of Personal Data ’ (hereinafter - PP 1119), which in paragraph 2 indicates the recognition of PP 781 as null and void, followed by Order 21.In fact, Order 21 fixes the situation with the non-mandatory certification as the only way to assess the applied protection measures.

The FSTEC of Russia clarifies this position in paragraph 3 of the FSTEC ‘s information message No. 240/22/2637 dated 15.07.2013. It states that the form of the effectiveness assessment is not established and is determined by the operator independently. As one of the possible forms of assessing the effectiveness of the implemented measures can be carried out as part of the certification of the information system of personal data in accordance with the national standard GOST RO 0043-003-2012 ‘Information Protection. Attestation of informatisation objects. General provisions’.

At the moment the mentioned form of performance evaluation exists and is used by various companies within the framework of works on personal data security. In addition, there are a number of conditions when this form remains the only possible. These include the case when personal data are processed in state information systems. The requirements for the protection of information in state information systems are established by Order No. 17 of the FSTEC of Russia dated 11.02.2013 ‘On Approval of the Requirements for the Protection of Information Not Constituting a State Secret Contained in State Information Systems’ (hereinafter - Order 17). If we examine the said Order, we will see that it mentions measures related to the protection of personal data (p. 5, 21, 27) and the only form of assessment of the adopted protection measures in the form of attestation (p. 13 of Order 17).

Finishing the consideration of attestation, it should be noted that the draft order of the FSTEC of Russia ‘ On Approval of the Procedure for Organising and Conducting Attestation of Informatisation Objects for Compliance with the Requirements for Protection of Information Not Constituting a State Secret “ (hereinafter referred to as the ”Procedure for Attestation of Information Objects ’) has now passed the stage of public discussion. It strengthens the previously introduced requirements. Thus, in particular, the Procedure establishes new forms of documents for the attested object and introduces the obligation to submit attestation documents and basic documents for the information object to the FSTEC of Russia.

Clause 27 of the OM Procedure states the following:

"27. The attestation body shall, within 5 working days after completion of attestation of the informatisation object, submit to the FSTEC of Russia (territorial body of the FSTEC of Russia) in electronic form copies of the following documents:

a) certificate of conformity of the informatisation object;

b) technical passport for the informatisation object;

c) act of system (network) classification, act of categorisation of a significant object;

d) programme and methods of attestation tests of the informatisation object;

e) conclusions and protocols.

Copies of documents for informatisation objects of federal government bodies and state corporations shall be submitted to the central office of the FSTEC of Russia, copies of documents for informatisation objects of other owners shall be submitted to the territorial body of the FSTEC of Russia.

Copies of the documents specified in subparagraphs ‘b’ and ‘c’ of this paragraph shall be transmitted electronically to the certification authority by the owner of the informatisation object’.

The new approved documents of the FSTEC of Russia eliminate the previously existing discrepancy into two entities - the attestation body and the licensee. Now it is a licensee, which is established by clause 5 of the OM Procedure: "To conduct attestation tests, the owner of an information object engages an organisation licensed to carry out activities for the technical protection of confidential information (with the right to carry out works and provide services for attestation tests and attestation for compliance with information protection requirements), issued by the FSTEC of Russia in accordance with the Regulation on licensing activities for the technical protection of confidential information, approved by the Resolution of the Board of Directors of the FSTEC of Russia.

Additionally, the following requirement is also established, which must also be taken into account when conducting attestation - ’...8. When appointing experts of the certification body, their independence from the owner of the informatisation object shall be ensured in order to exclude the possibility of influence of the owner of the informatisation object being certified on the results of certification tests conducted by the experts of the certification body.

It is not allowed to appoint experts of the certification body from among the employees involved in the development and (or) implementation of the information protection system of the informatisation object.

Experts of the attestation body are obliged to ensure the quality and objectivity of the results of attestation tests of the object of informatisation...’.

The above requirement came from the work on the creation of state information systems (in particular, it is given as part of paragraph 17 of Order 17), which also imposes certain restrictions on its implementation.

Let us now consider other forms of assessing the effectiveness of measures taken to ensure the security of personal data. Since the forms are established by the company itself, we are free to apply any variants. In the course of our work we had to face the following forms of assessment:

• Instrumental analysis of information system security
  
• Tests according to GOST 34.603 Information technology. Types of tests of automated systems (hereinafter - GOST 34.603)
  
• Pseudo-attestation.
• 
  

Let's consider each variant.

Instrumental analysis

Instrumental analysis of information system security is performed using some scanning tool. We will not name the products themselves, there are enough of them on the market. The point of the work is to check the presence of vulnerabilities in the components used in the system, their inventory and control of changes in the information system. This solution allows us to significantly reduce the cost of performance assessment work, actually automating it. However, this approach has, in our opinion, a significant disadvantage - it does not take into account organisational and process aspects of personal data processing and security. Thus, in particular, it is not possible to assess and correct determination of personal data security threats during their processing in personal data information systems, determination of the necessary/required level of security, control of subjects and access to personal data, etc. I.e. this approach will not allow the assessment of many aspects that are enshrined in 152-FZ, PP 1119 and Order 21, which means that the effectiveness of this solution is highly doubtful.

Tests according to GOST 34.603 (hereinafter - Tests)

Tests are similar to certification tests in their structure, both in terms of the nomenclature of the documentation to be developed in the course of its conduct, and in the nature of the organisation of work (Test Programme and Methods, Test Protocol, Conclusion). When organising the Tests, a commission is also created, which on the basis of the test programme and methods evaluates the created system and on the basis of the obtained results/evidence makes a conclusion on the conformity of the system or on the necessity of its improvement.

The structure of the documents is disclosed in:

• GOST 34.201-89 Information technology. Complex of standards for automated systems. Types, completeness and designation of documents when creating automated systems
  
• GOST 34.603-92
  
• RD 50-34.698-90. Methodical instructions. Information technology. Automated systems. Requirements to the content of documents.
• 
  

Let you not be confused by the fact that RD 50-34.698-90 has been cancelled (Order of Rosstandart from 12.02.2019 № 216 ‘ On the recognition as invalid in the territory of the Russian Federation acts issued by state bodies, the successor of which is the Federal Agency for Technical Regulation and Metrology’). Unfortunately, at the moment there is no adequate replacement of RD 50-34.698-90 (letter of Rosstandart from 16.04.2019 №6620-IK/03 ‘On the issue of application of documents to replace RD 50-34.698-90 and R 50-34.119-90’).

The pluses of these works include the fact that they allow both verification of the initially set requirements to the protection system and security processes, and documentary ‘bundling’. However, this approach has a significant disadvantage - it requires significant human resources, is quite lengthy and requires a detailed approach to the development of documentation for the system, in particular, the Terms of Reference for the information protection system. Conducting it is often problematic.

Pseudo-attestation

Pseudo-attestation is carried out on the basis of documents regulating the attestation process (GOST RO 0043) but with a number of assumptions:

1) It does not require the presence in the FSTEC of Russia's licence for technical information protection activities of an open type of activity such as attestation testing and attestation for compliance with information protection requirements of information facilities and systems.

2) The company determines the scope and composition of inspections itself

3) The resulting document is not an Attestation of Conformity

4) It does not require the mandatory use of control means certified by the FSTEC of Russia.

The advantages of pseudo-attestation include the advantages mentioned above for Tests, and flexibility in the approach of control works (i.e. it is not necessary to carry out at once checks of all initially laid down requirements or control of compliance of the system with the Technical Assignment, which may not exist). The works can be separated in time. However, this approach has a certain disadvantage - if an audit does not cover all the established requirements at once, its results may be questioned due to possible changes in the system or requirements of regulatory documents between audits and in the absence of audits on certain issues/areas.

We do not insist that the above options are exhaustive. The company is free to determine the option and method of conducting the audit that is convenient for it. Set the criteria for the system's effectiveness and monitor their fulfilment. To lay in the methodological basis the provisions of GOST, international standards or to follow its own way. Everything is in your hands. Our advice in this matter - when choosing an option, first of all, pay attention to what the state authorities authorised in the field of personal data processing and protection check in the course of inspections of the implementation of the 152-FZ and other normative legal acts issued pursuant to it.