Ruslan Rakhmetov, Security Vision
We continue the series of publications dedicated to regulatory requirements related to the use of SGRC systems. In this article we will review the legislation in relation to the protection of information contained in state information systems, as well as the protection of personal data. And in conclusion we will study the Draft National Standard GOST R ‘Information Protection. Information security monitoring. General Provisions".
Order of the FSTEC of Russia No. 17 of 11.02.2013 ‘On Approval of Requirements for the Protection of Information Not Constituting a State Secret Contained in State Information Systems’ (as amended by Orders of the FSTEC of Russia No. 27, No. 106).
14. Formation of requirements for protection of information contained in the information system shall be carried out by the owner of information (customer).
Formation of requirements to protection of information contained in the information system is carried out taking into account GOST R 51583 ‘Information Protection. Procedure for creation of automated systems in a protected version. General Provisions’ (hereinafter - GOST R 51583) and GOST R 51624 ’Information Protection. Automated systems in secure design. General requirements’ (hereinafter - GOST R 51624) and including:
making a decision on the need to protect information contained in the information system;
classification of the information system according to information protection requirements (hereinafter - classification of the information system);
determination of information security threats, the realisation of which may lead to a breach of information security in the information system, and development of an information security threat model on their basis;
determination of requirements to the information protection system of the information system.
...
14.3. ... The information security threat model shall contain a description of the information system and its structural and functional characteristics, as well as a description of information security threats, including a description of the capabilities of intruders (intruder model), possible vulnerabilities of the information system, methods of realisation of information security threats and consequences of violation of information security properties.
...
16.6 An information system vulnerability analysis shall be conducted in order to assess the possibility of an intruder overcoming the information protection system of the information system and preventing the implementation of information security threats.
The information system vulnerability analysis shall include the analysis of vulnerabilities of information protection means, technical means and software of the information system.
When analysing vulnerabilities of the information system, the absence of known vulnerabilities of information protection means, technical means and software shall be checked, including taking into account information available to developers and obtained from other publicly available sources, correct installation and configuration of information protection means, technical means and software, as well as correct operation of information protection means in their interaction with technical means and software.
In case of identification of information system vulnerabilities leading to additional information security threats, the information security threat model shall be updated and, if necessary, additional information protection measures shall be taken aimed at eliminating the identified vulnerabilities or excluding the possibility of using the identified vulnerabilities by an intruder.
Based on the results of the vulnerability analysis, it must be confirmed that the information system does not have any vulnerabilities contained in the information security threat database of the FSTEC of Russia or other sources, or their use (exploitation) by an intruder is impossible.
...
17.1 The information security threat model, information system classification act, technical task for the creation of an information system and (or) technical task (private technical task) for the creation of an information system information protection system, design and operational documentation for the information system information protection system, organisational and administrative documents on information protection, results of vulnerability analysis of the information system information system shall be used as initial data required for information system certification.
...
18.2 During the analysis of threats to information security in the information system during its operation, the following shall be carried out:
identification, analysis and elimination of information system vulnerabilities;
Analysis of changes in information security threats in the information system;
assessment of possible consequences of realisation of information security threats in the information system.
...
18.3 In the course of management (administration) of the information security system of the information system, the following shall be carried out:
...
management of information protection means of the information system;
management of updates of software and hardware-software means, including information protection means, taking into account the peculiarities of information system operation;
centralised management of the information protection system of the information system (if necessary);
...
18.4 In the course of configuration management of the information system and its information protection system shall be carried out:
Determination of persons who are allowed to act to make changes to the configuration of the information system and its information protection system and their authorisations;
identification of the components of the information system and its information protection system subject to change within the framework of configuration management (identification of configuration management objects): hardware, software, including information protection tools, their settings and programme code, operational documentation, interfaces, files and other components subject to change and control;
management of changes to the information system and its information protection system: development of configuration parameters to ensure information protection, analysis of the potential impact of planned changes on information protection, authorisation of changes to the information system and its information protection system, documentation of actions to make changes to the information system and preservation of data on configuration changes;
control of actions to make changes to the information system and its information protection system.
...
18.7 In the course of control over ensuring the level of protection of information contained in the information system, the following shall be carried out:
control (analysis) of information security, taking into account the peculiarities of the functioning of the information system;
Analysis and evaluation of the functioning of the information system and its information protection system, including analysis and elimination of vulnerabilities and other deficiencies in the functioning of the information system's information protection system;
...
Appendix No. 2 to Order No. 17 of the FSTEC of Russia.
IV. Protection of machine data carriers (MNI):
ZNI.1 - Accounting of machine data carriers
VIII. Control (analysis) of information security (ANZ):
ANZ.1 - Identification, analysis of information system vulnerabilities and prompt elimination of newly identified vulnerabilities
ANZ.2 - Control over installation of software updates, including software updates for information protection equipment.
ANZ.3 - Control of operability, configuration parameters and correct functioning of software and information protection means
ANZ.4 - Control over the composition of technical means, software and information protection means.
Order of the FSTEC of Russia No. 21 of 18.02.2013 ‘On Approval of the Composition and Content of Organisational and Technical Measures to Ensure the Security of Personal Data when Processing in Personal Data Information Systems’ (as amended by Order of the FSTEC of Russia No. 49).
8. The composition of measures to ensure the security of personal data, implemented as part of the personal data protection system, taking into account current threats to the security of personal data and information technologies used, includes:
...
protection of machine data carriers on which personal data are stored and (or) processed (hereinafter - machine carriers of personal data);
...
control (analysis) of personal data protection;
...
configuration management of the information system and personal data protection system.
...
8.4 Measures for protection of machine carriers of personal data (means of processing (storage) of personal data, removable machine carriers of personal data) shall exclude the possibility of unauthorised access to machine carriers and personal data stored on them, as well as unauthorised use of removable machine carriers of personal data.
...
8.8 Measures to control (analyse) the security of personal data shall ensure control of the level of security of personal data processed in the information system by means of systematic measures to analyse the security of the information system and testing the performance of the personal data protection system.
...
8.15. Measures for configuration management of the information system and personal data protection system shall ensure the management of changes in the configuration of the information system and personal data protection system, analysis of the potential impact of the planned changes on personal data security, as well as documentation of these changes.
...
Annex to the Order of the FSTEC of Russia No. 21.
IV. Protection of machine-readable personal data carriers (MND):
ZNI.1 - Accounting of machine-readable personal data carriers
VIII. Control (analysis) of information security (ANZ):
ANZ.1 - Identification, analysis of information system vulnerabilities and prompt elimination of newly identified vulnerabilities
ANZ.2 - Control over installation of software updates, including software updates for information protection equipment.
ANZ.3 - Control of operability, configuration parameters and correct functioning of software and information protection means
ANZ.4 - Control of the composition of technical means, software and information protection means.
XV. Configuration management of the information system and personal data protection system (UKF):
UKF.2 - Management of changes in the configuration of the information system and personal data protection system
RBM.3 - Analysis of the potential impact of the planned changes in the configuration of the information system and personal data protection system on personal data protection and coordination of the changes in the configuration of the information system with the official (employee) responsible for ensuring personal data security.
UKF.4 - Documentation of information (data) on changes in the configuration of the information system and personal data protection system
General Data Protection Regulation (GDPR)
The General Data Protection Regulation (GDPR) has been in force in the European Union since 25.05.2018, its rules on the protection of personal data of EU citizens apply to any organisation working with personal data of EU residents, i.e. any Russian company working with data of European citizens will be obliged to comply with the provisions of the GDPR.
Paragraph 83: In order to maintain an adequate level of information security and compliance with the GDPR, the controller or processor of personal data must assess the risks of processing personal data and implement measures to mitigate those risks, such as encryption. These measures must ensure an acceptable level of information security, including privacy, taking into account the state of the art technology and the cost of implementation compared to the risks and properties of the personal data being processed. ...
Article 28, paragraph 3, item ‘h’: The personal data processor shall provide the controller with all necessary information to demonstrate compliance with the legal requirements set out in this Article and shall assist in audits, including inspections, carried out by the controller or an auditor authorised by the controller.
Article 32, paragraph 1: Taking into account the state of the art of modern technology, the cost of implementation and the nature, scope, context and purposes of the processing of personal data, as well as the risks of variable probability and seriousness of harm to the rights and freedoms of personal data subjects, the controller and processor shall implement appropriate technical and organisational measures to ensure a level of security commensurate with the risk, including in particular:
...
(b) the ability to ensure the continued confidentiality, integrity, availability and cyber resilience of personal data processing systems and services;
...
(d) the process of regular testing, evaluation and measurement of the effectiveness of technical and organisational measures ensuring the security of personal data processing.
Article 47, paragraph 2, item ‘j’: Corporate rules shall include verification mechanisms that include data protection audits and methods for verifying the implementation of corrective actions to protect the rights of the personal data subject.
Article 47, paragraph 2, item ‘k’: Corporate rules shall include mechanisms for reporting and recording changes made to the corporate rules, as well as a report on these changes to the supervisory authority.
Draft national standard GOST R ‘Information Protection. Information security monitoring. General Provisions’
Draft national standard GOST R ‘Information Protection. Information security monitoring. General Provisions’ was published by FSTEC of Russia on 11.08.2020, registered in Rosstandart on 27.07.2021, expected to be put into effect from 01.04.2022.
4.2 As part of information security monitoring activities, the following tasks shall be accomplished:
b) in terms of measures to control (analyse) information security:
1) identification (search) of vulnerabilities;
2) development of descriptions of the identified vulnerabilities;
3) control over installation of software updates, including software of information protection means;
4) control over the composition of software and hardware, virtual hardware, software and information protection means (inventory);
5) control over compliance of software settings and information protection means with the established security requirements (security policies);
6) informing responsible persons about the results of vulnerability search, control over installation of software updates, control over the composition of software and hardware, software and information protection means.
...
5.1.2 When forming the list of data sources, the following information should be taken into account:
...
b) data on the results of vulnerability identification (search), including:
1) vulnerabilities in system-wide (general) software;
2) vulnerabilities in application software;
3) vulnerabilities in special software;
4) vulnerabilities in software and hardware;
5) vulnerabilities in portable hardware and software;
6) vulnerabilities in network (communication, telecommunication) equipment;
7) vulnerabilities in information protection means.
c) data on the results of control of software updates, including:
1) updates of databases necessary for the implementation of security functions of the information protection means (updates of databases of signs of malicious computer programmes (viruses) of anti-virus protection means, databases of vulnerability signatures of security control (analysis) means, databases of solving rules of intrusion detection systems and others);
2) updates aimed at eliminating vulnerabilities of information protection means (means);
3) updates aimed at adding security function(s) to the information protection tool(s), at improving the implementation of security function(s) of the information protection tool(s), at expanding the number of supported software and hardware platforms (if the need for such updates was determined based on the results of analysis of changes in information security threats in information (automated) systems arising in the course of their operation);
4) updates aimed at eliminating vulnerabilities of system-wide, application and other software.
d) data on the results of control of the composition of software and hardware, software and information protection equipment (inventory data), including:
1) architecture of information (automated) systems (network addresses and names);
2) location of nodes of information (automated) systems;
3) purpose of nodes of information (automated) systems;
4) functioning network services;
5) information on sources of security events;
6) characteristics of software and hardware, software and information protection means;
7) belonging of software and hardware means to subdivisions of the operator of information (automated) systems (information on owners);
8) belonging of software and hardware means to the relevant information (automated) systems;
9) configuration of nodes of information (automated) systems.
e) data on the results of control of compliance of software settings and information protection means with the established security requirements (security policies);
...
5.2.12 Data collection tools include:
- tools for managing information on information security threats;
...
- means (systems) of security control (analysis);
- means of inventory of software and hardware, software and information protection means.
