Separation of critical environments

Organization carries out threat intelligence by gathering information about information security threats related to its operations and how to protect against them. The goal is to increase awareness of the threat environment, so that own security level can be better evaluated and adequate control measures implemented.

When collecting threat intelligence, all three levels must be taken into account:

• strategic threat intelligence (e.g. information on the growing types of attackers and attacks)
• tactical threat intelligence (e.g. information about tools and technologies used in attacks)
• operational threat intelligence (e.g. details of specific attacks)

Principles related to threat intelligence should include:

• setting targets for threat intelligence
• identification, verification and selection of information sources used in threat intelligence
• gathering threat intelligence 
• data processing for analysis (e.g. translation, formatting, compression)

The organization has defined a process for addressing identified technical vulnerabilities.

Some vulnerabilities can be fixed directly, but vulnerabilities that have a significant impact should also be documented as security incidents. Once a vulnerability with significant impacts has been identified:

• risks related to the vulnerability and the necessary actions are identified (e.g. patching the system or other management tasks)
• necessary actions are scheduled
• all actions taken are documented

The organization monitors information about technical vulnerabilities of the information systems in use. When relevant technical vulnerabilities are detected, the organization takes action according to the planned operating model.

Organization carries out threat intelligence by analyzing and utilizing collected information about relevant cyber security threats related and corresponding protections.

When analyzing and utilizing the collected threat intelligence information, the following points must be taken into account:

• analyzing how the threat intelligence information relates to to our own operations
• analyzing how relevant threat intelligence information is to our operations
• communicating and sharing information in an understandable form to relevant persons
• utilizing the findings of threat intelligence to determine the adequacy of technical protections, technologies used and information security testing methods for analysis

The validity and effectiveness of used hardening is maintained throughout the whole life cycle of the data system.

Tietojenkäsittely-ympäristön laitteet tarkastetaan kattavasti ohjelmistohaavoittuvuuksien varalta vähintään puolivuosittain ja merkittävien muutosten yhteydessä. Prosessissa on huomioitu seuraavat seikat:

• Verkko ja sen palvelut, palvelimet sekä verkkoon kytketyt työasemat, kannettavat tietokoneet, tulostimet, mobiililaitteet ja vastaavat tarkastetaan kattavasti vähintään (haavoittuvuusskannaus, CMDB jne.) vuosittain ja aina merkittävien muutosten jälkeen päivitysmenettelyjen korjauskohteiden löytämiseksi.
• Laitteisto- ja ohjelmistokirjanpidon (ml. CMDB) sekä skannausohjelmiston ajantasaisuudesta ja tietoturvallisuudesta on huolehdittu.

"Merkittäviin muutoksiin" voidaan laskea esim. verkkotopologian muutokset, uusien järjestelmien käyttöönotot ja/tai vanhojen service pack -tason päivitykset sekä palomuurien ja vastaavien suodatussääntöjen merkittävät muutokset.

Tietojenkäsittely-ympäristön laitteet tarkastetaan kattavasti ohjelmistohaavoittuvuuksien varalta vähintään vuosittain ja merkittävien muutosten yhteydessä. Prosessissa on huomioitu seuraavat seikat:

• Verkko ja sen palvelut, palvelimet sekä verkkoon kytketyt työasemat, kannettavat tietokoneet, tulostimet, mobiililaitteet ja vastaavat tarkastetaan kattavasti vähintään (haavoittuvuusskannaus, CMDB jne.) vuosittain ja aina merkittävien muutosten jälkeen päivitysmenettelyjen korjauskohteiden löytämiseksi.
• Laitteisto- ja ohjelmistokirjanpidon (ml. CMDB) sekä skannausohjelmiston ajantasaisuudesta ja tietoturvallisuudesta on huolehdittu.

"Merkittäviin muutoksiin" voidaan laskea esim. verkkotopologian muutokset, uusien järjestelmien käyttöönotot ja/tai vanhojen service pack -tason päivitykset sekä palomuurien ja vastaavien suodatussääntöjen merkittävät muutokset.

The vulnerability management process is regularly tested at intervals specified by the organization to ensure that it is up-to-date, functional, and effective.

Hardening is the practice of reducing system vulnerability by reducing its attack surface.

When configuring virtual machines the organization has to make sure the machines are hardened by, for example, only using ports, protocols and services that are needed. There must also be technical security measures like anti-malware and logging enabled for all virtual machines.

The organization needs to define Monitored Metrics for identifying and correcting vulnerabilities. Meters must be monitored at specified intervals.

The organization must have a clear model for prioritizing identified technical vulnerabilities. The operating model should not be entirely new invention, but should be based on generally accepted practices.

Vulnerabilities should be prioritized based on the risk they pose, the importance of the assets involved, the potential organizational impact, and the urgency (taking into account the CVSS value).

The organization must develop a process to automate the treatment of technical vulnerabilities.

Static scans on code are the first step in detecting risky vulnerabilities. However, once a service has been deployed, it is vulnerable to new types of attacks (e.g., cross-site scripting or authentication issues). These can be identified by penetration testing.

Ohjelmistohaavoittuvuuksien hallitsemiseksi suojaustasoilla III-II toteutetaan seuraavat toimenpiteet:

• Verkko ja sen palvelut, palvelimet sekä verkkoon kytketyt työasemat, kannettavat tietokoneet ja vastaavat tarkastetaan vähintään (haavoittuvuusskannaus, CMDB, jne.) puolivuosittain ja aina merkittävien muutosten jälkeen päivitysmenettelyjen korjauskohteiden löytämiseksi.
• Säännöllisesti (esim. kuukausittain) tarkastellaan keskitetyistä päivityksenjakopalveluista päivitysten asentumisen onnistumista.

Merkittäviä muutoksia ovat mm. verkkotopologian muutokset, uusien järjestelmien käyttöönotot, vanhojen järjestelmien merkittävät päivitykset sekä palomuurien ja vastaavien suodatussääntöjen merkittävät muutokset.

Ohjelmistohaavoittuvuuksien hallitsemiseksi suojaustasolla IV toteutetaan seuraavat toimenpiteet:

• Verkko ja sen palvelut, palvelimet sekä verkkoon kytketyt työasemat, kannettavat tietokoneet ja vastaavat tarkastetaan vähintään (haavoittuvuusskannaus, CMDB, jne.) vuosittain ja aina merkittävien muutosten jälkeen päivitysmenettelyjen korjauskohteiden löytämiseksi.
• Säännöllisesti (esim. kuukausittain) tarkastellaan keskitetyistä päivityksenjakopalveluista päivitysten asentumisen onnistumista.

Merkittäviä muutoksia ovat mm. verkkotopologian muutokset, uusien järjestelmien käyttöönotot, vanhojen järjestelmien merkittävät päivitykset sekä palomuurien ja vastaavien suodatussääntöjen merkittävät muutokset.

Information sources for software and other technologies have been consciously identified to identify and maintain information about technical vulnerabilities that are relevant to us (e.g. authorities or hardware and software manufacturers). Data sources are evaluated and updated as new useful sources are found.

Vulnerabilities can be found directly in the vendor systems we exploit or in the open source components exploited by many of our systems. It’s important to keep track of multiple sources to get the essential information obtained.

We have defined the rules for responding to identified vulnerabilities. The rules may include e.g. the following things:

• who are part of a quick-response team that is ready to respond to vulnerabilities
• the person locating the vulnerability immediately informs the entire team down the agreed channel
• the team determines the severity of the vulnerability (low, medium, high) based on predefined criteria
• the team decides whether to continue processing as a security breach (more urgently) or under general change management
• the necessary individuals are selected to continue addressing the vulnerability

Vulnerabilities related to high-risk data systems are always of high severity and are addressed first.

The organization regularly conducts a vulnerability scan, which searches for vulnerabilities found on computers, workstations, mobile devices, networks or applications. It is important to scan even after significant changes.

It should be noted that vulnerable source code can be from operating system software, server applications, user applications, as well as from the firmware application as well as from drivers, BIOS and separate management interfaces (e.g. iLo , iDrac). In addition to software errors, vulnerabilities occur from configuration errors and old practices, such as the use of outdated encryption algorithms.

The operation of information systems may depend on certain key resources, such as server capacity, file storage capacity, data processing capacity, monitoring capacity or certain key persons.

In particular, some of these resources may have long delivery times or high costs in certain situations, in which case special attention must be paid to future capacity problems with them.

We monitor the use of key system resources and identify trends, potential security bottlenecks and dependencies on important people.

Unmanaged installations of software on computers can lead to vulnerabilities and security breaches.

The organization should determine what types of software or updates each user can install. The instructions may include e.g. the following guidelines:

• only specially designated persons may install new software on the devices
• programs previously designated as secure may be installed by anyone
• use of certain software may be impossible for everyone
• existing software updates and security patches are allowed to be installed by anyone

Isolate technical environments where the consequences can be very damaging.

The operation of information systems may depend on certain key resources, such as server capacity, storage space, data processing capacity, monitoring capacity or certain < em>key people.

The organization has defined key resources and methods for monitoring the use of these key resources. A normal level is also determined for the resources, which is used when assessing the risk of jeopardizing availability due to capacity problems.

Organization should share threat intelligence information actively with other organizations to improve its own threat awareness.

Organization must consider the threat intelligence process findings in the information security risk management process. Threat intelligence can detect, for example, the proliferation of certain types of attacks or the development of new technologies, based on which assessments of certain information security risks must be updated, which may lead to the need to reduce risks through treatment plans.

The technical vulnerability management process is regularly monitored and evaluated to ensure its effectiveness and efficiency.

Software updates should have a management process in place to ensure that the latest approved patches and application updates are installed on all approved software. Earlier versions of software should be retained as a precaution.

Once a vulnerability is identified, suppliers often have significant pressure to release patches as soon as possible. Therefore, the patch may not adequately address the issue and may have harmful side effects.

In evaluating patches, e.g. the following things should be taken into account:

• whether the patch can be pre-tested properly?
• whether it is wise to expect experience from other repairers?
• whether the patch is available from a trusted source?
• what are the risks of installing the patch and delaying the installation?
• whether other actions are needed, such as disabling vulnerability features, increasing monitoring, or reporting about the vulnerability