Katakri 2020

Update and patch management

Automatically updating and running malware prevention software

Critical

High

Normal

Low

Instructing and training staff regarding malware

Critical

High

Normal

Low

Malware protection in information systems (CL IV)

Critical

High

Normal

Low

Malware protection in systems isolated from public networks (CL III)

Critical

High

Normal

Low

I-10: DEFENCE IN DEPTH – TRACEABILITY OF SECURITY EVENTS

1. In order to detect unauthorized changes or other unauthorized or inappropriate information handling within the information-processing environment, reliable methods have been taken into use for tracing the security events.
2. The use of information systems and disclosure of their information will be logged in case the use of the information system requires identification or other methods of signing in. The idea to collect log information is to follow the use and disclosure of the information and to find out reasons for technical system failures.
3. The use of Classified Information belonging to national classification levels II and III has to be registered into an electronic log, information system, case register of as a part of information itself (e. g. part of a document).

Related tasks

Data system log review

Critical

High

Normal

Low

Documentation of system logs for self-maintained data systems

Critical

High

Normal

Low

Logging and retention of log data in the processing of classified information (CL III)

Critical

High

Normal

Low

Logging and retention of log data in the processing of classified information (CL I)

Critical

High

Normal

Low

Additional requirements for anomaly detection and recovery (CL IV)

Critical

High

Normal

Low

I-11: DEFENCE-IN-DEPTH - INCIDENT DETECTION AND RECOVERY

Reliable methods are taken into use in the information processing environment in order to detect attacks against the information processing environment, to limit the effect to a minimum amount of the information and to minimum resources of the information processing environment and to prevent other damages, as well as to restore the protected status within the information processing environment.

Related tasks

Network usage log and process for detecting inappropriate network traffic

Critical

High

Normal

Low

Incident management and response

The first level response process to security incidents

Critical

High

Normal

Low

Treatment process and documentation of identified non-conformities

Critical

High

Normal

Low

Risk management

Developing an incident response plan for critical information systems

Critical

High

Normal

Low

Continuity management

Additional requirements for anomaly detection and recovery (CL IV)

Critical

High

Normal

Low

Monitoring the use of the network and information systems to identify anomalies

Critical

High

Normal

Low

Determining the baseline for network and data system usage for monitoring purposes

Critical

High

Normal

Low

I-12: EVALUATION AND APPROVAL OF CRYPTOGRAPHIC PRODUCTS - CRYPTO SOLUTIONS

Competent authority has approved crypto solutions or products in the current environment to the respective classification levels in order to safeguard and protect the information against unauthorized disclosure or loss of integrity.

Related tasks

Use of authority-approved encryption solutions

Critical

High

Normal

Low

Good encryption key management practices

Critical

High

Normal

Low

General, risk-based encryption policy

Critical

High

Normal

Low

I-13: DEFENCE-IN-DEPTH THROUGHOUT THE LIFE CYCLE - PROTECTION OF SOFTWARE AGAINST NETWORK ATTACKS

1. Security of information-processing environment, including their technical and non- technical security measures, shall be subject to security testing during the accreditation process to ensure that the appropriate level of assurance is obtained and to verify that they are correctly implemented, integrated and configured.
2. Protective measures are in place against network attacks. Protective measures and their well-functioning are taken care of throughout the life cycle of the information-processing environment.

Related tasks

Protection of programs in the data processing environment from network attacks

Critical

High

Normal

Low

Equipment maintenance and safety

I-14: DEFENCE-IN-DEPTH – ELECTROMAGNETIC EMANATIONS (TEMPEST) AND ELECTRONIC INTELLIGENCE

1. Security measures shall be implemented to protect information-processing environment handling Classified Information against compromise of such information through unintentional electromagnetic emanations (TEMPEST security measures).
2. When handling information classified to Levels III (CONFIDENTIAL) or II (SECRET) the risks of electronic intelligence have to be mitigated sufficiently.
3. Such security measures shall be commensurate with the risk of exploitation and the level of classification of the information.

Related tasks

Electromagnetic data breach management

Critical

High

Normal

Low

Countermeasures against compromising emanations (TEMPEST) (CL III)

Critical

High

Normal

Low

Countermeasures against compromising emanations (TEMPEST) and verification of adequacy (CL II)

Critical

High

Normal

Low

Countermeasures against compromising emanations (TEMPEST) (CL I)

Critical

High

Normal

Low

I-15: EXCHANGE OF CLASSIFIED INFORMATION BETWEEN PHYSICALLY PROTECTED AREAS - ELECTRONIC TRANSFER OF THE INFORMATION

1. When Classified Information is transferred outside physically protected areas, the information or the traffic is encrypted with a method approved by the competent authority to the respective classification level. In addition to this, the information transfer procedure has to include the identification and authentication of the recipient in a sufficiently secure way before the recipient is getting access to the transferred Classified Information.
2. When transmission of Classified Information is confined within physically protected areas, unencrypted transmission or encryption at a lower level may be used, based on the outcome of a risk management process and subject to the approval of the competent authority.

Related tasks

Electronic transfer of material (CL IV–CL II)

Critical

High

Normal

Low

Equipment maintenance and safety

I-16: SECURITY THROUGHOUT THE INFORMATION PROCESSING ENVIRONMENT LIFE CYCLE - CHANGE MANAGEMENT

1. Ensuring security shall be a requirement throughout the information-processing environment life cycle, from initiation to withdrawal from service.
2. Security assessments, inspections and reviews shall be performed periodically during the operation and maintenance of an information-processing environment and when exceptional circumstances arise.
3. Security documentation for an information-processing environment shall evolve over its life cycle as an integral part of the process of change and configuration management.

Related tasks

Change management procedure for significant changes to data processing services

Critical

High

Normal

Low

Secure development

Evaluation process and documentation of significant security-related changes

Critical

High

Normal

Low

Risk management

Maintenance of security documentation for information processing environments

Critical

High

Normal

Low

Data system management

Change management procedures in information processing environments (CL IV)

Critical

High

Normal

Low

Risk management

Protection of equipment against unauthorized devices (CL II)

Critical

High

Normal

Low

I-17: HANDLING OF CLASSIFIED INFORMATION WITHIN PHYSICALLY PROTECTED AREAS - PHYSICAL SECURITY

Classification level IV (RESTRICTED)
1. Classified Information has to be handled in Security Areas and outside of them in a way, which prevents unauthorized access to Classified Information (see F-04 and I-18).
2. Handling of information is possible inside the perimeter of a Security Area approved by a competent authority (see F-04) and outside Security Areas when procedures approved by competent authority are used (see I-18).
3. Storage of information is possible inside the perimeter of a Security Area approved by a competent authority (see F-04) and outside Security Areas when procedures approved by competent authority are used (see I-18).
4. Data pools containing information belonging to classification level IV (RESTRICTED) and information systems used to process this information have to be placed inside the perimeter of a Security Area approved by a competent authority (see F-04).

Classification levels III (CONFIDENTIAL) and II (SECRET): in addition to points 1 and 2 above:
5. Storage of information is possible inside the perimeter of a Secured Area approved by a competent authority (see F-04). Note exceptions valid only for national information in point 6 and for remote use in I-18.
6. Only for national classification level III information, the storage of information in electronic format is possible outside the perimeter of a Secured Area using a terminal device approved for the respective level and taking into account that a) information has been protected using an encryption solution approved for the respective classification level by a competent authority (see I-12), and b) information security of the terminal device has been taken care of, paying special attention to the sufficient confidentiality and integrity using a method approved by a competent authority (see F-04). Note remote working in I-18.

Related tasks

Handling classified information in physically protected areas

Critical

High

Normal

Low

Equipment maintenance and safety

Safe placement of equipment

Critical

High

Normal

Low

Secure storage of classified information (CL IV)

Critical

High

Normal

Low

Secure storage of classified information (CL III)

Critical

High

Normal

Low

Secure storage of classified information (CL II)

Critical

High

Normal

Low

Continuous monitoring of physical access to critical facilities

Critical

High

Normal

Low

Access control and authentication

I-18: HANDLING AND TRANSFER OF CLASSIFIED INFORMATION BETWEEN PHYSICALLY PROTECTED AREAS - REMOTE USE AND REMOTE MANAGEMENT

Classification level IV (RESTRICTED)
1. Users and terminal devices are identified and authenticated sufficiently reliably. Transferring and handling of Classified Information between Security Areas (see F-04) is possible only by using compensative arrangements approved by competent authorities.
2. Classified Information has to be handled outside Security Areas in a way where unauthorized access to Classified Information is prevented. Personnel has been trained and instructed on secure remote use and management.
3. Unless the classification level IV (RESTRICTED) Classified Information stored on electronic media (hard drives, USB-sticks etc.) has been encrypted using a method approved bycompetent authority, storage media has to stay under constant supervision.
4. Remote use or management requires that the traffic will be encrypted by using a crypto solution approved by a competent authority to the respective classification level.
5. Information stored inside the terminal device has to be protected with an encryption solution, which is secure enough for the respective classification level and approved by a competent authority. Integrity of the terminal device has to be taken care of on an appropriate level.

Classification levels III and II: in addition to the points 1 to 5 above
6. Classified Information may not be decrypted or read while travelling or on public place.
7. Remote use or management of systems is limited to Security Areas approved by competent authorities (see F-04). Note: exception valid only for national information in point 8:
8. Only for national information classified on level III, remote use (handling) and storage is possible outside Security Areas with a terminal device dedicated for the respective level, by taking into account that a) information has been encrypted with a crypto solution approved by a competent authority to the respective level and b) information security aspects concerning the terminal device have been taken care of, bearing especially in mind that the sufficient confidentiality and integrity have been ensured with a method approved by a competent authority.

Related tasks

Defining and documenting accepted authentication methods

Critical

High

Normal

Low

Personnel guidelines for secure remote work

Critical

High

Normal

Low

Processing principles and accountability

Personnel guidelines for safe processing of personal and confidential data

Critical

High

Normal

Low

Remote connection management

Critical

High

Normal

Low

Encryption of classified information and communications in remote access (CL IV)

Critical

High

Normal

Low

Strong user authentication in remote access (CL IV)

Critical

High

Normal

Low

Prohibition of processing classified information in public places (CL III)

Critical

High

Normal

Low

Device identification in remote access (CL III)

Critical

High

Normal

Low

Additional security requirements for remote access (CL III)

Critical

High

Normal

Low

Restriction of remote access to security areas (CL II)

Critical

High

Normal

Low

I-19: SECURITY THROUGHOUT THE INFORMATION PROCESSING ENVIRONMENT LIFECYCLE - MANAGEMENT OF SOFTWARE VULNERABILITIES

Reliable arrangements are established for the entire life cycle of the information processing environment to manage software vulnerabilities.

Related tasks

Regular vulnerability scanning

Critical

High

Normal

Low

Selecting and tracking data sources for vulnerability information

Critical

High

Normal

Low

Using a selected web browser and checking for updates

Critical

High

Normal

Low

Email and web browser

Process for managing technical vulnerabilities

Critical

High

Normal

Low

Regular monitoring of the vulnerability management process

Critical

High

Normal

Low

Regular penetration testing

Critical

High

Normal

Low

Regular testing of the vulnerability management process

Critical

High

Normal

Low

Regular comprehensive vulnerability scanning (CL IV)

Critical

High

Normal

Low

Regular comprehensive vulnerability scanning (CL III)

Critical

High

Normal

Low

I-20: SECURITY THROUGHOUT THE INFORMATION PROCESSING ENVIRONMENT LIFECYCLE - BACKUP COPIES

Backup copies containing Classified Information are kept under protection throughout their life cycle, using protection measures of at least equal level as what is used for safeguarding the original information.

Related tasks

Encryption of backup data

Critical

High

Normal

Low

Regular testing, evaluation, and recovery instructions for backups

Critical

High

Normal

Low

Defining a backup strategy

Critical

High

Normal

Low

Documenting and delegating ownership of own backup processes

Critical

High

Normal

Low

Determining responsibilities for backing up important information assets

Critical

High

Normal

Low

Data segregation procedures in backup systems (CL IV)

Critical

High

Normal

Low

Data system management

Registration and monitoring of backup handling (CL III)

Critical

High

Normal

Low

I-21: SECURITY THROUGHOUT THE INFORMATION PROCESSING ENVIRONMENT LIFECYCLE – DISPOSAL OF CLASSIFIED INFORMATION IN ELECTRONIC FORMAT

Classification level IV (RESTRICTED)
1. Classified material that is in the electronic format is destroyed securely. The destruction is carried out with methods which are secure enough to prevent reconstruction in whole or in part of destroyed information. Concerning non-electronic information, see F-08.4.

Classification level III (CONFIDENTIAL): in addition to point 1
2. When international CONFIDENTIAL information is concerned, a destruction certificate has to be signed by the registrar and stored in the registry. Registry information has to be updated accordingly. The destruction certificates will be stored in the registry for at least five years. (see F-08.3).

Classification level II (SECRET): in addition to points 1 and 2 above
3. In case the originator of the information is another authority, the authority destructing information shall inform the originator about the destruction, unless the information is returned to the originating authority.
4. Information may be only destructed by a person who has been nominated for the task by an authority. Draft documents may be destroyed by the originator.
5. International information belonging to classification level SECRET has to be destroyed in the presence of a witness. The witness has to be security cleared at least to the level the information to be destroyed.

Related tasks

Destruction of international classified electronic information

Critical

High

Normal

Low

Destruction of electronic information (CL IV)

Critical

High

Normal

Low

Person responsible for destroying electronic information (CL II)

Critical

High

Normal

Low

Destruction of electronic information (CL I)

Critical

High

Normal

Low