Ruslan Rakhmetov, Security Vision
We continue our acquaintance with regulatory requirements and recommendations related to the use of information security systems. Having reviewed in previous articles the legislation and best practices in the context of using IRP/SOAR IT products, in this article we will move on to SGRC class systems in financial organisations.
PCI DSS Standard version 3.2.1 dated May 2018. "Payment Card Industry Data Security Standard. Security Audit Requirements and Procedures"
2.4 Maintain records of system components that are subject to the PCI DSS standard.
6.1 Establish a process for identifying vulnerabilities using authoritative external sources of vulnerability information, and risk ranking (e.g., ‘high,’ ‘medium,’ or ‘low’) of newly discovered vulnerabilities.
6.2 Ensure that all system and software components are protected against known vulnerabilities by installing vendor-issued security patches. Install critical security patches within one month of their release date.
11.2 Perform external and internal network scans for vulnerabilities at least quarterly and after significant changes to the network (e.g., installation of new system components, changes in network topology, changes in firewall rules, product upgrades).
Standard of the Bank of Russia STO BR IBBS-1.0-2014 dated 01.06.2014 ‘Ensuring Information Security of Organisations of the Banking System of the Russian Federation. General Provisions"
5.16. An IS vulnerability creates preconditions for realisation of a threat through it (IS incident). Implementation of the threat of an IS breach leads to a loss of protection of the interests (objectives) of the BS RF organisation in the information sphere, resulting in damage to the BS RF organisation. The severity of the damage together with the probability of the resulting IS incident determines the amount of risk.
5.17. Continuous analysis and examination of the BS RF organisation's infrastructure in order to identify and eliminate IS vulnerabilities is the basis for the effective operation of the ISMS.
5.18. The identification, analysis and assessment of IS breach risks shall be based on the identification of the BS RF organisation's assets, their value for the BS RF organisation's goals and objectives, and the BS RF organisation's IS threat and intruder models.
...
7.4.1 Procedures for identifying, recording and classifying (assigning to one of the types) the BS RF organisation's information assets shall be defined, implemented, recorded and monitored....
...
7.11.5 The result of the assessment of risks of personal data security breaches is the Personal Data Security Threat Model, which contains personal data security threats relevant to the BS RF organisation, on the basis of which requirements are developed that take into account the specifics of personal data processing in a particular BS RF organisation and expand the requirements of sections 7 and 8 of this standard.
...
8.3.1 Procedures for accounting of information assets structured by classes (types) of protected information assets shall be defined, performed, registered and controlled. It is recommended to classify information assets on the basis of assessments of the value of information assets for the interests (objectives) of the BS RF organisation, for example, according to the severity of consequences of the loss of IS properties of information assets.
...
8.12.4 Procedures for IS monitoring and control of protective measures shall be subject to regular, recorded revisions due to changes in the composition and use of protective measures, identification of new IS threats and vulnerabilities, and based on IS incident data.
...
9.8 The assessment of IS compliance in the form of an IS audit or IS self-assessment shall be conducted by the BS RF organisation at least once every two years.
Recommendations in the field of standardisation of the Bank of Russia RS BR IBBS-2.9-2016 dated 01.05.2016 ‘Ensuring information security of organisations of the banking system of the Russian Federation. Prevention of information leaks"
5.1 To protect confidential information from possible leaks, it is recommended that the organisations of the banking system of the Russian Federation should ensure
- identification and formation of a list of categories of information of confidential nature, recommendations for the implementation of which are set out in section 6 of these recommendations;
- identification and accounting of information assets (information resources) containing confidential information and objects of the information asset environment used for processing and (or) storing confidential information, recommendations for implementation of which are set forth in Section 7 of these Recommendations;
...
7.1 It is recommended that BS RF organisations document and ensure that all information assets containing information of a confidential nature and objects of the information asset environment are identified and accounted for. As part of the rules for identification and accounting of information assets and objects of the information asset environment, it is recommended to define:
- A list of types of information assets and objects of the information asset environment (computer equipment and portable data carriers) to be identified and accounted for;
...
- obligation of informatisation units and (or) functional units of the BS RF organisation to carry out identification and accounting of information assets and objects of the information asset environment;
- methods of identification and accounting of information assets and objects of the information assets environment by the informatisation units and (or) functional units of the BS RF organisation, including with the use of means of automation of identification and accounting;
...
- ways for the IS service to control the actual composition of information assets and objects of the information asset environment, including using means of automated identification and control;
...
- rules of identification and accounting of confidential information carriers by the employees of the BS RF organisation;
...
Recommendations in the field of standardisation of the Bank of Russia RS BR IBBS-2.2-2009 dated 01.01.2010 ‘Ensuring information security of organisations of the banking system of the Russian Federation. Methodology of Information Security Violation Risk Assessment"
4.3 The assessment of IS violation risks shall be performed for the types of information assets (types of information) included in the pre-defined assessment area. To assess the risks of an IS breach, the following shall be preliminarily determined and documented:
- a complete list of information asset types included in the assessment area;
- a complete list of the types of environmental objects corresponding to each type of information assets in the assessment area;
- an IS threat model describing IS threats for all types of environment objects identified in the BS RF organisation at all levels of the BS RF organisation's information infrastructure hierarchy.
It is recommended to form the list of threat sources and threat models taking into account the provisions of STO BR IBBS1.0, as well as the list of the main sources of IS threats given in Annex 1.
4.4 The list of information asset types is formed on the basis of the results of the classification of information assets performed in the BS RF organisation. The composition of the list of information asset types (information classification) shall not contradict the norms of the legislation of the Russian Federation, including the regulations of the Bank of Russia.
...
5.1 The initial data for IS violation risk assessment shall be the information defined in clause 4.4 of this Methodology.
5.2 The following procedures shall be performed to assess the risks of IS breach.
Procedure 1. Determination of the list of information asset types for which IS violation risk assessment procedures are performed (hereinafter referred to as the IS violation risk assessment area).
Procedure 2. Determination of the list of types of environment objects corresponding to each type of information assets in the IS breach risk assessment area.
Procedure 3. Identification of threat sources for each of the types of environmental objects identified in Procedure 2.
Procedure 4. Identify the IS threat SVRs for the types of environmental objects identified in Procedure 2.3.
Procedure 5. Determine IS breach STPs for the types of information assets of the IS breach risk assessment area.
Procedure 6. IS breach risk assessment.
...
Standard of the Bank of Russia STO BR IBBS-1.4-2018 dated 01.07.2018 ‘Ensuring information security of organisations of the banking system of the Russian Federation. Information security risk management in outsourcing"
7.1 Outsourcing of essential functions of the BS RF organisation shall be accompanied by assessment, proper management and control of the BS RF organisation in respect of IS breach risk, implemented in accordance with the outsourcing policy.
7.2 The BS RF organisation's implementation of the outsourcing programme shall include the following measures: 7.2.
activities:
- identification of the potential IS breach risk of outsourcing essential functions, including from the types of risk defined in Section 5 of this Standard;
- assessment of the potential risk of IS violation in case of outsourcing of essential functions;
- making a decision on the possibility of outsourcing based on the results of the IS violation risk assessment;
- implementation of subsequent continuous monitoring and control of the IS breach risk level.
The key factor for the implementation of outsourcing programmes is to assess the potential IS breach risk and to ensure the possibility of subsequent monitoring and control of its level.
The identification of IS breach risk should be based on an analysis of the composition of the business functions to be outsourced, as well as on an analysis of the new IS breach risk factors identified in Section 5 of this Standard.
7.3 In order to assess the potential IS breach risk and to ensure the ability to monitor and control its level, the BS RF organisation should determine the composition and evaluate (including periodic) indicators (metrics)....
...
Federal Law No. 161 of 27.06.2011 ‘On the National Payment System’
Article 28. Risk management system in the payment system.
...
3. The risk management system shall provide for the following measures:
...
6) determination of methods of risk analysis in the payment system, including risk profiles, in accordance with the requirements of regulatory acts of the Bank of Russia;
7) determination of the procedure for exchange of information required for risk management;
...
11) determination of the procedure for ensuring protection of information in the payment system.
...
Regulation of the Bank of Russia No. 716-P dated 08.04.2020 ‘On Requirements to the Operational Risk Management System in a Credit Organisation and a Banking Group’
7.1 A credit organisation (head credit organisation of a banking group) shall determine in its internal documents the procedure for information security risk management.
7.2 Information security risk includes:
- the risk of deliberate actions on the part of employees of the credit institution and/or third parties using software and (or) hardware and software aimed at information infrastructure facilities of the credit institution (head credit institution of the banking group) for the purpose of disruption and (or) termination of their functioning and (or) creation of a threat to the security of information prepared, processed and stored by such facilities, as well as for the purpose of unauthorised appropriation, theft, alteration, deletion of data and other information.
- other types of information security risk associated with the processing (storage, destruction) of information without the use of information infrastructure objects.
...
2. The operational risk event type ‘deliberate actions of third parties’ includes:
...
2.2. a breach of information systems security consisting in deliberate actions of third parties with respect to property, information, data, tangible and (or) intangible assets of a credit organisation and customers' funds. This type of operational risk events includes all types of cyber attacks committed by third parties using information infrastructure objects against information and data contained in the internal information systems of a credit institution (implementation of cyber risk events).
...
Regulation of the Bank of Russia No. 672-P of 09.01.2019 ‘On Requirements to Information Protection in the Payment System of the Bank of Russia’
6.1 Documents shall be accepted within the following information protection processes (areas) defined by GOST R 57580.1-2017:
...
Control of integrity and security of information infrastructure;
...
Regulation of the Bank of Russia No. 684-P dated 17.04.2019 ‘On Establishment of mandatory requirements for non-credit financial institutions to ensure information protection when carrying out activities in the sphere of financial markets in order to counteract the implementation of illegal financial transactions’
5.4 Non-credit financial organisations implementing the enhanced level of information protection and non-credit financial organisations implementing the standard level of information protection (hereinafter, when referred to jointly, non-credit financial organisations implementing the enhanced and standard levels of information protection) shall perform testing of information infrastructure objects for penetrations and analysis of information security vulnerabilities of information infrastructure objects.
...
6.2 Assessment of a certain level of information protection shall be carried out in accordance with the requirements of the national standard of the Russian Federation GOST R 57580.2-2018 ‘Security of financial (banking) operations. Protection of information of financial organisations. Methodology of conformity assessment’....
6.3 Assessment of a certain level of information protection shall be carried out by non-credit financial organisations implementing the enhanced level of information protection at least once a year, by non-credit financial organisations implementing the standard level of information protection - at least once in three years.
7. Non-credit financial organisations implementing enhanced and standard levels of information protection shall ensure storage of the report drawn up by the auditing organisation based on the results of assessment of a certain level of information protection for at least five years from the date of its issuance by the auditing organisation.
...
9. Non-credit financial organisations implementing the enhanced and standard levels of information protection shall ensure the use of application software of automated systems and applications distributed by a non-credit financial organisation to its clients for performing actions for the purpose of financial transactions, as well as software processing protected information when accepting electronic messages for execution in automated systems and applications for the purpose of performing financial transactions.
...
By decision of a non-credit financial institution, the analysis of vulnerabilities in the application software of automated systems and applications is carried out independently or with the involvement of an auditing organisation.
...
Regulation of the Bank of Russia No. 683-P of 17.04.2019 ‘On Establishment of mandatory requirements for credit institutions to ensure information protection in banking activities in order to counteract money transfers without the client's consent’
3.2 Credit institutions should ensure annual penetration testing and analysis of information security vulnerabilities of information infrastructure objects.
...
4.1 Credit institutions shall ensure the use of application software of automated systems and applications distributed by a credit institution to its customers to perform actions for the purpose of banking transactions, as well as software that processes protected information at the sites used to receive electronic messages for execution in automated systems and applications using the information and telecommunication network ‘Internet’.
With respect to application software of automated systems and applications not specified in paragraph one of this sub-clause, credit institutions shall independently determine the need for certification or analysis of vulnerabilities and control of absence of undeclared capabilities.
...
9.1 Information protection conformity assessment shall be carried out in accordance with the national standard of the Russian Federation GOST R 57580.2-2018 ‘Security of financial (banking) operations. Protection of information of financial organisations. Methodology of conformity assessment’...
Credit organisations must ensure that a report prepared by an inspection organisation on the results of information protection conformity assessment is kept for at least five years from the date of its issuance by the inspection organisation.
...
Resolution of the Government of the Russian Federation No. 584 of 13.06.2012 ‘On Approval of the Regulation on Protection of Information in the Payment System’
4. Rules of the payment system shall provide for, among other things, the following requirements to information protection:
...
c) implementation of measures aimed at identifying threats to information security and analysing the vulnerability of information systems;
d) analysis of risks of violation of information protection requirements and management of such risks;
...
j) organising and conducting monitoring and evaluation of the implementation of information protection requirements at its own infrastructure facilities at least once every 2 years.
...
Regulation of the Bank of Russia No. 719-P of 04.06.2020 ‘On Requirements to Information Protection in Money Transfers and on the Procedure of Control by the Bank of Russia over Compliance with Requirements to Information Protection in Money Transfers’ shall come into effect from 01 January 2022, replacing Regulation of the Bank of Russia No. 382-P of 09.06.2012.
1.1 Money transfer operators, bank payment agents (subagents), operators of information exchange services, operators of payment infrastructure services in terms of requirements to information protection in the course of money transfers applied to automated systems, software, computer hardware, telecommunication equipment, the operation and use of which is ensured in the course of money transfers by money transfer operators (
...
annual penetration testing and analysis of information security vulnerabilities of information infrastructure objects, taking into account the peculiarities stipulated by Clauses 3.8 and 3.9 of these Regulations;
...
Money transfer operators, bank payment agents (subagents), operators of information exchange services, operators of payment infrastructure services shall ensure storage of the report prepared by the verification organisation based on the results of information protection compliance assessment for at least five years from the date of its issuance by the verification organisation.
...
2.11. ... Money transfer operators when engaging bank payment agents (subagents) shall, based on the risk management system, determine for them the criteria of necessity and frequency of penetration testing and analysis of information security vulnerabilities of information infrastructure objects, information protection conformity assessment, certification or conformity assessment of application software of automated systems and applications.
...
3.5 Bank payment agents (subagents) shall ensure implementation of the minimum level of information protection for information infrastructure objects in accordance with GOST R 57580.1-2017.
Upon decision of the bank payment agents (subagents) the level of information protection for information infrastructure objects in accordance with GOST R 57580.1-2017 may be increased on the basis of risk analysis.
...
3.8 Bank payment agents (subagents), except for bank payment agents performing payment aggregator operations, shall, based on criteria established by money transfer operators, conduct penetration testing and analysis of information security vulnerabilities of information infrastructure objects, information protection conformity assessment, certification or conformity assessment of application software of automated systems and applications.
3.9 Bank payment agents (subagents), carrying out operations of the payment aggregator, shall, based on the criteria established by money transfer operators, conduct penetration testing and analysis of information security vulnerabilities of information infrastructure objects, certification or conformity assessment of application software of automated systems and applications.
...
4.3 Information exchange service providers shall ensure the implementation of a standard level of information security for information infrastructure objects in accordance with GOST R 57580.1-2017.
By decision of the operators of information exchange services, the level of information protection for information infrastructure objects in accordance with GOST R 57580.1-2017 may be increased on the basis of risk analysis.
...
5.1 The payment system operator for the purpose of implementation of paragraph 11 of part 3 of Article 28 of the Federal Law N 161-FZ (Collected Legislation of the Russian Federation, 2011, N 27, article 3872) within the framework of the risk management system in the payment system shall determine in the rules of the payment system and other documents the procedure for ensuring protection of information in the payment system for money transfer operators, which are members of the payment system, operators of payment infrastructure services, taking into account the requirements for ensuring protection of information in the course of money transfers.
The payment system operator shall determine the requirements to information security in the payment system with regard to the following measures:
- management of information security risk in the payment system as one of the types of operational risk in the payment system, the sources of realisation of which are: deficiencies of information protection processes, including deficiencies of applied technological measures of information protection, deficiencies of application software of automated systems and applications, as well as non-compliance with the requirements to the said processes of activity by money transfer operators that are participants of the payment system, operators
- establishment of the composition of indicators of information security risk level in the payment system;
- implementation by money transfer operators that are participants of the payment system and operators of payment infrastructure services of mechanisms aimed at compliance with the requirements to information security in the course of money transfers, and control of compliance by money transfer operators that are participants of the payment system and operators of payment infrastructure services;
- implementation by money transfer operators that are participants of the payment system and operators of payment infrastructure services of processes of detection and identification of information security risk in the payment system in respect of information infrastructure objects of participants of the payment system and operators of payment infrastructure services;
- identification and analysis by money transfer operators that are participants of the payment system and operators of payment infrastructure services of information security risk in the payment system;
...
Regulation of the Bank of Russia No. 382-P of 09.06.2012 (as amended on 07.05.2018) ‘On Requirements to Information Protection in the Process of Money Transfers and on the Procedure of Control by the Bank of Russia over Compliance with Requirements to Information Protection in the Process of Money Transfers’, which is valid until 01 January 2022, when the new Regulation of the Bank of Russia No. 719-P of 04.06.2020 ‘On Requirements to Information Protection in the Process of Money Transfers and on the Procedure of Control by the Bank of Russia over Compliance with Requirements to Information Protection in the Process of Money Transfers’ comes into force.
2.6.1 The money transfer operator, bank payment agent (subagent), payment infrastructure services operator shall ensure accounting of information infrastructure facilities used for processing, storage and (or) transmission of protected information, including ATMs and payment terminals.
...
2.10.1 The money transfer operator, bank payment agent (subagent), operator of payment infrastructure services shall ensure accounting and control of the composition of software installed and (or) used on computer hardware.
...
2.14.2. ... To determine the procedure for ensuring protection of information when effecting funds transfers the operator of the payment system, the operator of funds transfer, the operator of payment infrastructure services within the framework of obligations established by the operator of the payment system may use:
...
the results of risk analysis in ensuring information protection in the course of money transfers on the basis of threat models and information security violators defined in national standards on information protection, standards of organisations, including standards of the Bank of Russia, adopted in accordance with the legislation of the Russian Federation on technical regulation, or on the basis of threat models and information security violators defined by the payment system operator, money transfer operator, operator of payment infrastructure services
...
2.16.2. Information sent by money transfer operators and operators of payment infrastructure services, except for operational centres located outside the Russian Federation, to the payment system operator for the purposes of analysis of information security in the payment system in the course of money transfers shall include the following information:
...
on identified threats and vulnerabilities in information security.
...
2.17.2 The operator on transfer of funds, the operator of payment infrastructure services shall regulate the procedure for taking measures aimed at improving the protection of information in the process of money transfers, in cases:
...
Identification of threats, risks and vulnerabilities in ensuring information protection in the process of money transfers;
...
GOST R 57580.1-2017 ‘Security of financial (banking) operations. Protection of information of financial organisations. Basic composition of organisational and technical measures"
7.4 Process 3 ‘Control of integrity and security of information infrastructure’.
7.4.1 Measures applied by a financial organisation to control the integrity and security of the information infrastructure should ensure:
- control of the absence of known (described) vulnerabilities of information protection of informatisation objects;
- organisation and control of placement, storage and updating of information infrastructure software;
- control over the composition and integrity of the information infrastructure software;
- registration of information protection events related to the results of integrity and security control of information infrastructure.
7.4.2 The basic composition of measures to control the absence of known (described) vulnerabilities of information protection of information objects in relation to information protection levels is given in Table 22.
CPI.1 Control the absence and ensure prompt elimination of known (described) information protection vulnerabilities, the use of which may allow unauthorised (uncontrolled) information interaction between segments of security loops and other internal networks of the financial institution.
CPI.2 Control the absence and ensure prompt elimination of known (described) information security vulnerabilities, the use of which may allow unauthorised (uncontrolled) information interaction between the financial institution's internal computer networks and the Internet.
CPI.3 Control the absence and ensure prompt elimination of known (described) information security vulnerabilities, the use of which may allow unauthorised (uncontrolled) information interaction between segments designed to accommodate public access objects (including ATMs, payment terminals) and the Internet.
CPI.4 Control the absence and ensure prompt elimination of known (described) information security vulnerabilities, the use of which may allow unauthorised logical access to access resources located in the financial institution's computer networks connected to the Internet.
CPI.5 Control the absence and ensure prompt remediation of known (described) information security vulnerabilities, the use of which may allow unauthorised remote access.
CPI.6 Monitor the absence and ensure prompt remediation of known (described) information security vulnerabilities, the use of which may allow unauthorised logical access to access resources located in the financial institution's internal computer networks.
CPI.7 Control the absence and ensure prompt remediation of known (described) vulnerabilities provided for in measures CPI.1 through CPI.6 of this table by scanning and analysing the settings of server and network equipment.
CPI.8 Control the absence and ensure prompt remediation of known (described) vulnerabilities specified in measures CPI.1 to CPI.6 of this table by scanning and analysing the composition, versions and settings of application software, AS software and system software that implements information security functions and (or) affects information security (hereinafter in this section - system software)* installed on server and network equipment.
CPI.9 Control the absence and ensure prompt elimination of known (described) vulnerabilities provided for in measures CPI.1 through CPI.6 of this table by scanning and analysing the composition, versions and settings of application software, AS software and (or) system software installed on user and operating personnel workstations.
CPI.10 Control the absence and ensure prompt elimination of known (described) vulnerabilities provided for in measures CPI.1 through CPI.6 of this table by scanning and analysing the composition, versions and settings of information protection tools and systems.
7.4.3 The basic composition of measures to organise and control software placement, storage and updating with respect to information protection levels is given in Table 23.
CPI.12 Control over the placement and timely updating of information protection software, application software, AS software, system software and signature databases of information protection software on server and network equipment, including for the purpose of eliminating identified information protection vulnerabilities.
ZZI.13 Control over the placement and timely update of information protection software, application software, AC software and system software on user and operating personnel workstations, including for the purpose of eliminating identified information protection vulnerabilities.
...
CPI.15 Control the absence and ensure prompt remediation of known (described) information protection vulnerabilities after performing software updates provided for in measure CPI.12 of this table.
7.4.4 The basic composition of measures to control the composition and integrity of information infrastructure software with respect to information protection levels is given in Table 24.
CPI.20 Control of the composition of software authorised for use by user and operating personnel workstations.
...
CPI.22 Control of the software composition of server equipment.
ZZI.23 Control over the composition of the software of user and operating personnel workstations launched at operating system startup.
7.4.5 The basic composition of measures for registering information protection events related to the results of information infrastructure integrity and security monitoring with respect to information protection levels is given in Table 25.
CPI.27 Registration of information protection vulnerability detection events.
...
