Mechanisms for ensuring the security of information systems

In this article we will look at the main mechanisms of information systems security and why companies need them.

Let's learn the theory first.

Information system (hereinafter — IS) is set of software and hardware, as well as operations and methods of information processing within the enterprise. IS is used to collect, analyse, store and transfer data. Well-built IS allow companies to optimise work processes and achieve business goals faster.

Information security (hereinafter — IS) — state of the information system, within the framework of which protection of protected information from unauthorised access for purpose of disclosure, use, modification and destruction is ensured.

Information assets (hereinafter referred to as IA) are any information owned, managed or maintained by an enterprise. Information assets include documentation, diagrams, drawings, images, video and audio files, databases, Internet resources, etc.

Information systems security mechanisms (hereinafter referred to as OBIS mechanisms) — set of hardware, organisational means and software used to maintain the stability and security of the сompany's IS.

Why should information be protected?

Information is any form of knowledge that can be used, stored, transformed and transmitted. Information, whether belonging to individuals or companies, can be valuable because it is not known to third parties who may use it with malicious intent, to enrich themselves or to gain competitive advantage.

Any valuable information owned by a company is its information asset.

An organisation's information can be classified as follows.

Organisation's information can be classified as follows

• Public. Data that does not need to be protected and disclosure of which would not result in consequences for an individual or the organisation.
• Confidential. Information the disclosure of which could cause material, financial, reputational or other damage of the company or endanger the safety of any person or a company. To protect confidential information, trade secret regime should be introduced at the company.
• Legally protected. This includes state, medical, official, family, military secrets and Personal data of citizens.

To prevent important information from becoming available to intruders, it is necessary to take measures to protect it. The following measures for protecting information at an enterprise are distinguished.

Organisational (administrative). Development and implementation of IS policy, work with internal regulations of the company, training of personnel in IS basics.

Physical. Restriction of physical access to storage areas of the company's IA: installation of doors, locks, video surveillance systems, alarm systems. Not only people, but also natural disasters pose the threat to data. To protect sensitive data, it is necessary to use reliable safes and install fire alarms.

Hardware and hardware. Application of electronic and electronic-mechanical devices.

Software. Software that is installed on servers and equipment: DLP-systems, antiviruses, access control systems, firewalls, SIEM-systems and so on.

Government measures regulating the protection of confidential information

Widely known set of standards among IS professionals is ISO/IEC series. It is most often referred to by subject matter experts when implementing OBIS mechanisms in processes inside an enterprise.

• ISO/IEC 27001:2013 is the best known standard in series. It describes key terms and definitions, as well as aspects of IS management, and provides practical guidance on how to build an effective and sustainable IS system.
• ISO/IEC 15408 — list of criteria for assessing the security of IT technologies (software and hardware level), as well as requirements for the functionality of security features. In addition, the document contains threat justifications, basic policies and requirements.
• ISO/IEC 29100 — describes IS maintenance practices and general privacy framework.

The full list of international standards can be found on the official website of the International Organisation for Standardisation.

Besides protection of protected data, as well as state, banking, medical and other secrets, companies must organise the security of collection, storage and transmission of personal data of users — employees, clients, partners, contractors, etc.

The term personal data (hereinafter referred to as "PD") means any sensitive information about a user: actual address, residence address, place of work, income data, telephone number, passport data, bank data, email, and so on. Companies that use personal data must implement set of measures to ensure that user information does not fall into the hands of cybercriminal groups.

In order to protect personal data, businesses are obliged to:

• collect information about a user only with user's consent, either in writing or electronically;
• It is obligatory to notify users about collection of personal data, as well as about purposes of collection and processing;
• not to transfer users' personal data to third parties;
• implement set of hardware, technical and organisational measures aimed at minimising the risks of data leakage.

Compliance with regulatory requirements is monitored during inspections. Regulatory inspections may be planned or initiated as a result of large-scale IS incidents.

To create a stable and reliable enterprise IS, recommended to install specialised software: firewalls, antiviruses, intrusion detection tools, systems preventing data leaks caused by users (DLP-systems), systems for detecting IS incidents (SIEM-systems).

As a side note, every implemented product must undergo mandatory FSTEC certification. In the absence of software certification, protection measures will be recognised by regulators as invalid.

Algorithm of unified mechanism for ensuring IS security

In order to protect sensitive information that is not related to state secrets or personal data, an enterprise can implement the set of measures based on its IS objectives, budget and capabilities. This can be done either in-house or using integrated solutions, such as SIEM and DLP systems. In addition, when selecting a solution, it is worth considering whether the enterprise uses automated process control systems (APCS), CRM systems, various software for document management automation, etc.

In this case, regardless of the chosen strategy, IP protection mechanisms will be unified for all enterprises. The following algorithm is an example:

• audit of current state of the IS system;
• search, detection and registration of vulnerabilities, audit of the network and infrastructure elements;
• development, approval and implementation of the IS policy in company's work;
• implementation of authorisation and authentication mechanisms; 
• implementation of access differentiation mechanism; 
• continuous monitoring of state of the IS, searching for, identifying and recording IS incidents and, in addition, creating a list of rules for responding to them;
• protecting communication channels through which remote users can connect to the company's IS;
• introduction of cryptographic security features into IS operation;
• Continuous monitoring of the IS configuration and compatibility of its components.

Important: when implementing OBIS mechanisms, the principle of reasonableness should be adhered to. This means that cost of implementing data protection should not exceed its value, and measures taken should not affect the efficiency of business processes.

Next, we will look in detail at enterprise IS security measures.

Mechanisms for ensuring the security of information systems

Let's look at the most popular measures aimed at protecting protected IA.

Access Control (also AC)

Access control is mechanism that allows you to manage user access levels to corporate data and resources.

Effective access control can help:

• significantly reduce the risks of exfiltration of IA important for the company;
• comply with regulatory requirements and avoid penalties.

Access control is managed in three phases.

• The first step is user identification and authentication.
• The second stage — after authorisation, the system determines a level of access to particular IA, i.e. what operations a user can perform: downloading, modifying, deleting, reading and so on.
• The third stage — the system grants access. If necessary, you can control the employee's further work with the confidential file.

To minimise the risks of leakage of IA of the enterprise due to human factor, it is recommended to audit access to confidential data at least once every 6 months.

Identification and authentication (also IAF)

Identification defines who a user is, for example, through their account name or personal identifier.

Authentication is a way for a user to prove that he or she is a rightful owner of an account. Authentication establishes identity using passwords, biometrics, or security codes sent to a trusted phone number. Multi-factor authentication is recommended to reduce the risks of unauthorised access.

The identification and authentication process can be centralised for users inside a single enterprise. In this scheme of work, users will be assigned identifiers that they can use to sign in to several accounts at once: services, applications, mail services, and others.

Only after a user has been identified and authenticated can they gain authorised access to the enterprise IS and its resources.

Software Environment Restriction (SER)

Various services, software and its components that are not used by employees to perform their work tasks may have vulnerabilities that can be used by attackers to gain unauthorised access to the IS and its resources. Therefore, it is recommended that enterprises implement measures to restrict the software environment.

Among others, the OPS process includes the following operations:

• regulating the startup of software and its components (including during operating system booting), as well as configuration of startup parameters;
• control of the running software;
• regulating the installation of software and its components;
• temporary file management.

Various scripts, drivers, subsystems, file systems, interfaces, some web servers, etc. may have unnecessary or IS-threatening functionality. Disabling or removing all unused services, systems, services, protocols and functions can significantly reduce the risk of cyberattacks.

Safety Audit

It is an assessment of IS status indicators for compliance with the enterprise's approved security policy. The purpose of audit is to identify vulnerabilities in the IS system, assess existing risks and categorise them, and develop recommendations to reduce likelihood of their realisation.

Based on audit results, a report is written on the current state of the IS system, identified vulnerabilities and recommendations for their elimination. This allows the organisation's management to make informed decisions on risk mitigation and improvement of protection mechanisms.

The audit examines:

• existing security policy;
• procedures implemented and their effectiveness;
• technical means of protection used — anti-virus software, intrusion prevention systems, firewalls, etc.;
• organisational measures implemented — authentication and identification, access control, training of employees in IS basics, etc.;
• potential vulnerabilities and risks caused by them.

Safety Audit can be done either in-organisation or by external auditors. The choice should be based on the size of the company and complexity of tasks that the IS system faces.

Anti-virus protection (AVP)

Antivirus protection in the context of enterprise IS preservation is a set of measures and technologies used to detect, block and destroy malware (viruses, worms, Trojans and others) from personnel devices or inside the corporate network.

Among others, the following components of enterprise antivirus defence stand out.

• Antivirus software.
• Regular updating of signatures, i.e. the virus database, so that anti-viruses can detect and destroy malware in timely manner.
• Regular scanning of IS to look for new threats.
• Continuous monitoring of software activity to detect suspicious behaviour that may be associated with the activity of viruses or other malware.
• Firewall. Required to control incoming and outgoing network traffic.
• Sandbox. An isolated environment for running suspicious software and reading files that allows you to safely investigate their behaviour and impact on the IS.

Important! To keep antivirus protection effective, it is necessary to timely update not only antivirus software, but also any other software installed in the IS. Along with introduction of new software functionalities, developers also eliminate vulnerabilities discovered between updates.

Intrusion Prevention System (also PSB)

The Intrusion Prevention System is a network security tool that monitors network in real time for malicious activity and takes action to prevent it, including alerting, blocking, or removing it if it occurs. An IDS can be a hardware device or software package, or a combination of both.

Typically, PSB works as follows: if an unauthorised user gains access to network, the system identifies the suspicious activity, logs the IP address and responds to threat, taking into account the rules preconfigured by the network administrator.

Integrity assurance (also AI)

Organisations working with personal data and sensitive information are required to:

• to control the integrity of the PD, as well as control the integrity of the information protection software;
• to create conditions for maintaining stability and possibility of software recovery in case of incidents; 
• to regulate the rights of personnel to enter information into the IS;
• to control the integrity, completeness and correctness of information entered into the IS, etc.

Ensuring accessibility (also EA)

Businesses must:

• introduce fault-tolerant technical means into IS operation;
• create backup copies of protected data;
• support the possibility of restoring protected data from backup media, etc.

Protection of technical means and systems (PTS)

Organisations handling protected information must:

• take measures to protect data processed by technical means;
• restrict access to premises where equipment for storing and processing protected data is located;
• reduce the risks of environmental impact on technical means, etc.

For a full list of FSTEC regulations on ensuring data integrity and availability, as well as on measures to protect technical means, please visit the organisation's official portal.

Information (automated) system Protection and its components (ISP)

The ISP recommendations oblige companies to:

develop and implement data protection rules and procedures; protect the enterprise IS perimeter; restrict access to prohibited Internet resources; prohibit unauthorised connections to peripheral devices; use wireless security features, etc.

A full list of regulations can be found on the organisation's website.

Security Management Planning (SMP)

SMP — is the process of developing and implementing strategies and tactics to maintain safety in an organisation.

SMP milestones:

• risk analysis, i.e. identification of potential threats and vulnerabilities that may adversely affect the organisation's IS;
• development, implementation or updating of rules (policies): i.e. creation of a document that defines the objectives, principles and requirements for safeguarding sensitive information;
• selection of methods and means of protection, e.g. installation of video surveillance, organisation of physical security, implementation of access control mechanisms, etc.;
• allocation of responsibilities and resources.

Software Update Management (also SUM)

Software Update Management — is the process of regularly updating software on equipment, servers and other devices in the IS.

The SUM is required to:

• eliminating vulnerabilities to protect against cyber threats;
• improving IC resilience and performance;
• complying with regulatory mandates; 
• correct operation of software and implemented mechanisms and practices in general.

There are several stages in the management of the SUM system: Schedule updates > Download updates to devices > Install > Testing > Monitoring > Rollback updates (if necessary).

To manage upgrades effectively, you need to use specialised tools and facilities.

Security Incident Response (also SIR)

The process consists of 3 steps.

• Localisation. In the localisation stage, it is important to determine where incident occurred and who initiated it. In addition, it is important to take measures to contain the spread of incident.
• Impact assessment and remediation. Any impact of incidents on the company's IS must be analysed and neutralised.
• Incident analysis and registration. Based on data collected, the responsible person should take measures to eliminate the original causes of incident.

Ensuring Actions in Emergency Situations (EAM)

A list of requirements to ensure data security in abnormal situations, it regulates:

• algorithm of response in case of emergency situations;
• rules of developing an emergency action plan;
• methods of training personnel in rules of behaviour in emergency situations, etc.

According to document, companies dealing with personal and confidential data are obliged to:

• create alternative places for storing and processing protected data in case of incidents;
• ensure stability and recoverability of software, technical means, communication channels in case of failures and accidents;
• analyse incidents and take measures to reduce the risks of their occurrence, etc.

Informing and training staff

It is a set of measures aimed at raising employees' awareness of importance of the IS, training them in correct use of the IS resources and mechanisms and incident response. The informing and training staff process is also referred to as "securitisation" of personnel.

Implementation of the informing and training staff mechanism allows to significantly reduce the risks of data exfiltration due to the fault of personnel.

Informing and training staff includes:

• conducting various seminars, trainings, webinars;
• disseminating information on current threats by any method convenient for the company (mailings via email services, messengers);
• conducting drills to practice the acquired skills.

In conclusion

Implementing the general security of information systems mechanisms today is not just a necessity — it is a direct obligation for every organisation dealing with personal information of employees and customers, as well as information representing trade secrets.

Compliance with the prescribed measures will be monitored through regulatory inspections. If the company's IS infrastructure does not comply with regulations, regulators may impose sanctions or fines on the company.