Ruslan Rakhmetov, Security Vision
We continue the series of publications dedicated to regulatory requirements related to the use of SGRC systems. In this article, we will consider the legislation in the context of ensuring information security of enterprises - critical information infrastructure (CII) facilities.
Federal Law No. 187 of 26.07.2017 ‘On the security of critical information infrastructure of the Russian Federation’
Article 8: Register of significant objects of critical information infrastructure.
1. In order to account for significant critical information infrastructure objects, the federal executive body authorised in the field of ensuring the security of the critical information infrastructure of the Russian Federation shall maintain a register of significant critical information infrastructure objects in accordance with the procedure established by it. The following information shall be entered in this register:
...
6) information on software and hardware-software means used at a significant critical information infrastructure object;
7) measures used to ensure the security of a significant critical information infrastructure object.
...
Article 9: Rights and obligations of critical information infrastructure entities
1. Critical information infrastructure subjects shall have the right to:
1) to receive from the federal executive authority authorised in the field of ensuring the security of critical information infrastructure of the Russian Federation information necessary to ensure the security of significant critical information infrastructure objects belonging to them by right of ownership, lease or other legal basis, including information about security threats to the information processed by such objects and the vulnerability of software, equipment and technologies used at such objects;
...
Order of the FSTEC of Russia No. 31 of 14.03.2014 ‘On Approval of Requirements for Information Protection in Automated Control Systems for Production and Technological Processes at Critically Important Facilities, Potentially Hazardous Facilities, as well as Facilities Presenting an Increased Risk to Human Life and Health and the Environment’ (as amended by Order of the FSTEC of Russia No. 138).
13.3 Identification of information security threats shall be carried out at each level of the automated control system and shall include:
a) identification of sources of information security threats and assessment of capabilities (potential) of external and internal intruders;
b) analysis of possible vulnerabilities of the automated system and its software and hardware components;
c) identification of possible ways (scenarios) of realisation (occurrence) of information security threats;
d) assessment of possible consequences from the implementation (occurrence) of information security threats, violation of individual properties of information security (integrity, availability, confidentiality) and the automated control system as a whole.
The information security threat database maintained by the FSTEC of Russia is used as the initial data in determining information security threats.....
...
The information security threat model shall contain a description of the automated control system and information security threats for each level of the automated control system, including a description of the capabilities of intruders (intruder model), possible vulnerabilities of the automated control system, methods (scenarios) of realisation of information security threats and consequences from violation of information security properties (availability, integrity, confidentiality) and the normal mode of operation of the automated control system....
...
15.7 The analysis of vulnerabilities of the automated control system shall be carried out in order to assess the possibility of overcoming by an intruder of the automated control system protection system and violation of the secure functioning of the automated control system due to the implementation of information security threats.
Analysis of vulnerabilities of the automated control system shall include analysis of vulnerabilities of information protection means, technical means and software of the automated control system.
When analysing vulnerabilities of the automated control system, the absence of vulnerabilities of information protection means, technical means and software is checked, including taking into account the information available to developers and obtained from other publicly available sources, the correctness of installation and configuration of information protection means, technical means and software, as well as the correctness of operation of information protection means, technical means and software of the automated control system when they interact with each other.
At the customer's decision, penetration testing of the automated control system may be carried out to confirm the identified vulnerabilities. This testing is usually conducted on a mock-up (test zone) of the automated control system.
If vulnerabilities in the automated control system that lead to additional threats to information security are identified, the information security threat model is refined and, if necessary, additional information protection measures are taken to eliminate the identified vulnerabilities or exclude the possibility of exploitation of the identified vulnerabilities by an intruder.
...
16. Information protection during the operation of the automated control system shall be ensured by the operator in accordance with the operational documentation for the protection system and organisational and administrative documents on information protection and shall include the following procedures:
...
periodic analysis of information security threats in the automated control system and risks from their realisation;
management (administration) of the protection system of the automated control system;
...
configuration management of the automated control system and its protection system;
...
16.4 During the analysis of information security threats in the automated control system and possible risks from their realisation, the following shall be performed:
periodic analysis of vulnerabilities of the automated control system arising in the course of its operation;
periodic analysis of changes in information security threats in the automated control system arising in the course of its operation;
periodic assessment of the consequences of realisation of information security threats in the automated control system (risk analysis).
16.5 In the course of management (administration) of the protection system of the automated control system, the following shall be carried out:
...
management of information protection means in the automated control system, including software configuration parameters, including restoration of information protection means operability, generation, change and restoration of passwords;
management of software updates, including the software of information protection means, taking into account the peculiarities of functioning of the automated control system;
centralised management of the protection system of the automated control system (if necessary);
...
16.7 In the course of configuration management of the automated control system and its protection system, the following shall be carried out:
Maintenance of the configuration of the automated control system and its protection system (structure of the automated control system protection system, composition, installation locations and configuration parameters of information protection means, software and technical means) in accordance with the operational documentation for the protection system (maintenance of the basic configuration of the automated control system and its protection system);
..
managing changes to the basic configuration of the automated control system and its protection system, including determining the types of possible changes to the basic configuration of the automated control system and its protection system, authorising changes to the basic configuration of the automated control system and its protection system, documenting actions to make changes to the basic configuration of the automated control system and its protection system, and saving data on changes to the basic configuration of the automated control system and its protection system.
analysing the potential impact of planned changes to the basic configuration of the automated control system and its protection system on its security, the emergence of additional threats to information security and the operability of the automated control system;
determination of software configuration parameters, including information protection software, composition and configuration of hardware and software prior to making changes to the basic configuration of the automated control system and its protection system;
...
Appendix No. 2 to Order No. 31 of the FSTEC of Russia.
IV. Protection of machine data carriers (MNI):
ZNI.1 - Accounting of machine data carriers
V. Security Audit (AUD):
AUD.1 - Inventory of information resources
AUD.2 - Vulnerability Analysis and Remediation.
XIII. Configuration Management (CCM):
UCF.0 - Development of configuration management policy of the information (automated) system
UCF.1 - Identification of configuration management objects
UKF.2 - Change management
UKF.4 - Control of change actions
XIV. Software Update Management (SOM):
OPO.0 - Develop a policy for managing software updates
OPO.1 - Searching, receiving software updates from a trusted source.
Order of the FSTEC of Russia No. 235 dated 21.12.2017 ‘On Approval of Requirements for the Creation of Security Systems for Significant Objects of Critical Information Infrastructure of the Russian Federation and Ensuring Their Operation’ as amended by Order of the FSTEC of Russia No. 64
10. The head of a critical information infrastructure entity shall create or determine a structural unit responsible for ensuring the security of significant critical information infrastructure objects (hereinafter referred to as the security structural unit) or appoint individual employees responsible for ensuring the security of significant critical information infrastructure objects (hereinafter referred to as security specialists).
The structural security division, security specialists shall perform the following functions:
...
analyse information security threats to significant critical information infrastructure facilities and identify vulnerabilities therein;
...
32. Control over the implementation of the action plan shall be carried out by the structural security division, security specialists. The structural security division, security specialists shall annually prepare a report on the implementation of the action plan, which shall be submitted to the head of the critical information infrastructure entity.
...
Order of the FSTEC of Russia No. 239 of 25.12.2017 ‘On Approval of Requirements for Ensuring Security of Significant Objects of the Critical Information Infrastructure of the Russian Federation’ as amended by Orders of the FSTEC of Russia No. 138, No. 60, No. 35
11.1 The purpose of information security threat analysis is to determine the possible ways of implementation (occurrence) of information security threats and the consequences of their implementation (occurrence), taking into account the composition of users and their authorities, software and hardware, interconnection of components of the significant object, interaction with other critical information infrastructure objects, information systems, automated control systems, information and telecommunications networks (hereinafter - architecture of the significant object).
The analysis of information security threats shall include:
a) identification of sources of information security threats and assessment of capabilities (potential) of external and internal intruders;
b) analysis of possible vulnerabilities of the significant object and its software, hardware and software means;
c) identification of possible ways (scenarios) of realisation (occurrence) of information security threats;
d) assessment of possible consequences of realisation (occurrence) of information security threats.
As initial data for the analysis of information security threats the information security threats database maintained by the FSTEC of Russia is used....
...
12. Implementation of organisational and technical measures to ensure security of a significant object shall be organised by a critical information infrastructure entity in accordance with the design and working (operational) documentation for the significant object, standards of organisations and shall include:
...
f) analysing vulnerabilities of the significant object and taking measures to eliminate them;
...
12.6 The analysis of vulnerabilities of the significant object shall be carried out in order to identify deficiencies (weaknesses) in the security subsystem of the significant object and assess the possibility of their use for realisation of information security threats. The vulnerabilities of the code, configuration and architecture of the significant object shall be analysed.
Vulnerability analysis is performed for all software and hardware-software means, including information protection means, of the significant object.
When conducting vulnerability analysis, the following methods of vulnerability identification are used:
...
b) analysis of settings of software and hardware-software means, including information protection means, of the significant object;
c) identification of known vulnerabilities of software and hardware-software means, including information protection means, by analysing the composition of installed software and security updates with the use of security control (analysis) tools and (or) other information protection means;
d) identification of known vulnerabilities of software and hardware-software, including information protection tools, network services available for network interaction, using security control (analysis) tools;
...
13. Ensuring security during the operation of a significant facility shall be carried out by a critical information infrastructure entity in accordance with the operational documentation and organisational and administrative documents on the security of the significant facility and shall include the implementation of the following measures:
...
b) analysis of information security threats in the significant object and consequences of their realisation;
c) management (administration) of the security subsystem of the significant object;
d) configuration management of the significant object and its security subsystem;
...
13.2 In the course of analysis of threats to information security in the significant object and possible consequences of their realisation, the following shall be performed
a) analysing the vulnerabilities of the significant object arising in the course of its operation;
b) analysis of changes in threats to information security in the significant object arising in the course of its operation;
c) assessment of possible consequences of realisation of information security threats in the significant object.
...
13.3 In the course of management (administration) of the security subsystem of the significant object the following shall be performed:
...
c) management of information protection means of the significant object;
d) management of updates of software and hardware-software means, including information protection means, taking into account the peculiarities of functioning of the significant object;
e) centralised management of the security subsystem of the significant object (if necessary);
...
13.4 In the course of configuration management of the significant object and its security subsystem for the purposes of ensuring its security, the following shall be carried out:
...
b) determination of the components of the significant object and its security subsystem subject to change within the framework of configuration management (identification of configuration management objects): hardware, software, including information protection means, their settings and programme code, operational documentation, interfaces, files and other components subject to change and control;
c) management of changes to the significant object and its security subsystem: development of configuration parameters ensuring security of the significant object, analysis of potential impact of planned changes on ensuring security of the significant object, authorisation of changes to the significant object and its security subsystem, documentation of actions on making changes to the significant object and saving of data on configuration changes;
...
13.8. In the course of control over ensuring security of the significant object the following shall be carried out:
a) control (analysis) of the security of the significant object taking into account the peculiarities of its functioning;
b) analysis and assessment of the functioning of the significant object and its security subsystem, including analysis and elimination of vulnerabilities and other deficiencies in the functioning of the security subsystem of the significant object;
...
Appendix to Order No. 239 of the FSTEC of Russia.
V. Security Audit (AUD):
AUD.1 - Inventory of information resources
AUD.2 - Analysis of vulnerabilities and their elimination
AUD.10 - Conducting internal audits
AUD.11 - Conduct external audits.
XIV. Software Update Management (SOM):
OPO.0 - Regulate rules and procedures for managing software updates
SGO.1 - Search for, obtain software updates from a trusted source.
XIII. Configuration Management (UCF):
UCF.0 - Regulation of rules and procedures for configuration management of the information (automated) system
UCF.1 - Identification of configuration management objects
UCF.2 - Change management
УКФ.4 - Control of actions on changes introduction
Order of the Federal Security Service of the Russian Federation No. 196 dated 06.05.2019 ‘On Approval of the Requirements for Means Designed to Detect, Prevent and Eliminate the Consequences of Computer Attacks and Respond to Computer Incidents’
IV. Requirements for prevention means
8. Prevention tools shall have the following functions:
collection and processing of data on the infrastructure of the monitored information resources and background information;
collection and processing of information on vulnerabilities and flaws in the configuration of software (hereinafter referred to as software) used in controlled information resources;
generation of recommendations on minimising information security threats;
accounting of information security threats.
9. When collecting and processing information on the infrastructure of controlled information resources and reference information, the warning means shall ensure:
9.1 Collection and processing of data on the infrastructure of controlled information resources, including information on:
on the architecture and objects of the monitored information resources (network addresses and names, names and versions of the software used);
network services running on the controlled information resource objects;
sources of IS events.
9.2 Collection and processing of reference information:
on the trust indicator (reputation) of network addresses, domain names, e-mail servers, domain name servers;
owners of network addresses, domain names, e-mail servers, domain name servers;
the location and geographical affiliation of network addresses;
known vulnerabilities of the software in use;
computer networks consisting of malware-controlled computer hardware, including information about their control servers.
9.3 The ability to add, view, and modify information on the infrastructure of controlled information resources and reference information.
10. When collecting and processing information on vulnerabilities and configuration flaws in the software used in the controlled information resources, the warning tools shall provide:
collection of data on the date and time of investigation of controlled information resources;
generation of a list of identified vulnerabilities and flaws in the configuration of the software used (for each object of the monitored information resource);
possibility of statistical and analytical processing of the obtained information.
11. Formed recommendations on minimising threats to information security shall contain a list of measures aimed at eliminating vulnerabilities and deficiencies in the configuration of software used in controlled information resources.
...
22. Detection tools, warning tools and mitigation tools shall be subject to requirements in terms of implementing visualisation, building summary reports and storing information.
Detection tools, warning tools and consequence management tools shall provide:
22.1 Visualisation in the form of tables (lists, schemes, charts, graphs, diagrams) of information on:
on IS events;
on detected computer incidents;
vulnerabilities and flaws in the configuration of the software used in the monitored information resources;
about the infrastructure of the monitored information resources;
stored in the database;
containing reference and other necessary information.
22.2 Build consolidated reports by realising the following functions
creation of tables (lists, schemes, charts, graphs, diagrams), as well as their visualisation on the basis of the obtained data;
selection of parameters, by which tables (lists, schemes, charts, graphs, diagrams) are built in reports;
export of reports;
automatic generation of reports according to the schedule, as well as their automatic sending to the assigned addressees.
22.3 Storage of downloaded information for a specified period of time and permanent access to it, as well as the ability to export stored information, including in its original form.
Order of the Federal Security Service of the Russian Federation No. 282 dd. 19.06.2019 ‘On Approval of the Procedure for informing the Federal Security Service of Russia about computer incidents, response to them, taking measures to eliminate the consequences of computer attacks conducted against significant objects of the critical information infrastructure of the Russian Federation’
Annex to the Order of the Federal Security Service of the Russian Federation No. 282.
6. To prepare for responding to computer incidents and taking measures to eliminate the consequences of computer attacks, a critical information infrastructure entity that owns, leases or otherwise legally owns a significant critical information infrastructure facility shall develop a plan for responding to computer incidents and taking measures to eliminate the consequences of computer attacks within 90 calendar days from the date of inclusion of such facility in the register of significant critical information infrastructure facilities of the Russian Federation.
technical characteristics and composition of significant critical information infrastructure facilities;
events (conditions) upon the occurrence of which the implementation of the measures envisaged in the plan begins;
activities to be carried out in the course of responding to computer incidents and taking measures to eliminate the consequences of computer attacks, as well as the time allocated for their implementation;
a description of the composition of the critical information infrastructure entity's departments and officials responsible for carrying out measures to respond to computer incidents and taking measures to eliminate the consequences of computer attacks.
