spanish government it security policy: the national security framework of spain

1

Bilbao, 20 de abril de 2016Miguel A. Amutio Gómez

Subdirector Adjunto de Coordinación de Unidades TICDirección de Tecnologías de la Información y las Comunicaciones

Madrid, 24 May 2016Miguel A. Amutio

Deputy Head of Unit Coordination of ICT UnitsDirectorate for Information Technologies and Communications

5th Meeting of IT SECURITY NETWORK FOR EU - IP OFFICES& EUROPEAN UNION INTELLECTUAL PROPERTY OFFICE (EUIPO)

Spanish Government IT Security Policy: The NationalSecurity Framework of Spain

https://www.ccn-cert.cni.es/ens.html

2



Digital transformation

Why the National Security FrameworkWhat is the NSF (ENS)How, audit, reporting and complianceChallenges and conclusions

Contents

3



1. Digital transformation

4



Trends in the EU

Source: Vision European Public Services (Soirce: European Commission).

Services (by default):

Digital

Cross border

Inclusive

Open

Transparent

Data protection

No legacy

5



Digital public services

The new administrative laws (Law 39/2015 and Law 40/2015) foreseea paperless Administration on the basis of working fullywith electronic means.

Digital transformation plan for the General State Administration.

Digital public services are provided in a complexscenario in Spain.

http://administracionelectronica.gob.es/pae_Home/pae_Estrategias/Estrategia-TIC-AGE.html

6



Digital Economy and Society Index (DESI). 5 indicators: conectivity, human capital, use of internet, integration of digital technology and digital public services

DESI 2016 -> data of 2015

Spain : 5 in Digital Public Services and 15º considering all 5 indicators for 28 M.S.

Source: DESI 2016

Digital public services

http://administracionelectronica.gob.es/pae_Home/pae_Actualidad/pae_Noticias/Anio2016/Marzo/Noticia-2016-03-07-Espa-a-avanza-dos-puestos-en-el--ndice-de-Econom-a-y-Sociedad-Digital--DESI-.html

7



International contextOECD

Digital Security Risk Management for Economic and Social Prosperity. Recommendation and Companion Doc.

European UnionDigital Agenda for Europe.Cibersecurity Strategy.Regulation 910/2014(eIDAS) on electronic identification and trust servicesRegulation (EU) 2016/679 General Data Protection RegulationOther initiatives: Directive NIS concerning measures for a high common level of security of network and information systems across the Union

Other countries:EE.UU.: Federal Information Security Management Act (FISMA). United Kingdom, Germany, France, …

http://www.oecd.org/sti/ieconomy/Digital-Security-Risk-Management.htm

8



2. Why the National Security Framework

9



Citizens expect that digital public services are provided under conditionsof trust and security comparable to those they encounter when they go personally to the officesof the Administration.

There is a growing proportion of electronic versus paper documents, and, increasingly, there is no paper.

Information on electronic means has potential risks from the threat of malicious orillegal actions, errors or failures and accidents or disasters.

Why security is important in eGovernment services

Digital Agenda for Europe

10



Why the National Security Framework

Create the necessary conditions of trust, through measures to ensure IT security for the exercise of rights and the fulfillment of duties through the electronic access to public services.

Promote the continuous management of security, regardless of the

impulses of the moment or lack thereof.

Promote prevention, detection and correction.

Promote a common approach to security which enables cooperation todeliver eGoverment services. The NSF complements the National Interoperability Framework.

Provide common languange and elements of security• to guide Public Administrations in the implementation of ICT security.• to facilitate interaction between Public Administrations and • to communicate security requirements to the Industry.

11



3. What is the NSF


12



The National Security Framework

It is a legal text (Royal Decree 3/2010).

It establishes the security policy for the use of ICT by Government.•It consists of the basic principles and minimum requirements to enable adequate protection of information.

To be followed by all Public administrations in Spain.

It is a key element of the Spanish Security Strategy.


13



14



The Basic principles to be taken intoaccount in decision about security.

The minimum requirements which allow an adequate protection of information.

Categorization of systems for the adoptionof proportionate security measuresaccording to information and services to beprotected and to the risks to which they are exposed.

Security audit to verify compliance with the NSF.

Response to security incidents(CERT).

Use of security certified products, tobe considered in procurement.

Awareness and training.

National Security Framework

7 Main elements

15



Security policy

All Public Administrations will have a securitypolicy on the basis of the basic principles and minimumrequirements.

Security measures will be adopted taking into account:

Assets (information and services to be protected).

System category (basic, medium, high) depending on the assessment of security dimensions (confidentiality, integrity, availability, authenticity, traceability).

Regulations on personal data protection.

Decisions to manage identified risks.

16



operational– planning– access control– operation– external services– continuity– monitoring

asset protection– facilities– personnel– equipment– communications– media– software– information– services

organizational– security policy– security

regulations– security

procedures– authorization

process

Security measures

+ use of common infrastructures and services and security guidelines provided by CCN.

17



8 main actions Adopt a security policy.Define roles and allocatepersons. Security officer.Categorize systems.Risk assessment.Select measures, prepare applicability statemet and implement securitymeasures.Security audit.Publish compliance.Report about securitystatus.

18



Information Security ManagementRelationship with ISO 27000

Requires the protection of information and services, withmeasures according the principle of proportionality.

Includes aspects of interest for the Administration.Requires information security management.

Provides the requirements for the implementation of an informationsecurity management system.

The guide CCN-STIC 825 explains how to use the ISO 27001 certification to comply with the NSF.

This guide helps to determine:• which controls of ISO 27001 Annex A are necessary

to comply with the security measures indentified in the annex of the NSF

• And , if needed , which additional aspects would berequires

https://www.ccn-cert.cni.es/series-ccn-stic/800-guia-esquema-nacional-de-seguridad/543-ccn-stic-825-ens-iso27001/file.html

19



4. How, Audit, reporting and compliance

20



Audit, reporting & compliance

Certification entities: Acreditation by ENAC for ISO/IEC 17065:2012, for the certification of compliance of systems according tothe National Security Framework.

21



Reporting on the security status

NSF, article 35. Systems security status report

AGE: General StateAdministrationCCAA: Regions(AutonomousCommunities)EELL: Local EntitiesUNI: Public Universities

22



5. Challenges and Conclusions

Fuente: NASA

23



The digital transformation requires the protection of information and services. The National Segurity Framework:

Promotes security protection of information and services.

Promotes a uniform treatment of security.

Is adapted to the requirements of the Administration, providing adequate legal support.

Challenges:Progress in cibersecurity of public administrations.Improve the implementation of the security measures.Extend the implementation of the NSF to all kind of information systems of public administrations.Improve the compliance with the NSF.

Conclusions

24



Guidelines and tools

https://www.ccn-cert.cni.es/ens/instrumentos-para-la-adecuacion.html

25



More information

https://oc.ccn.cni.es/index.php?lang=en

https://www.ccn-cert.cni.es/en/ens.html

26



Questions

27



E-mail addresses– [email protected] – [email protected]– [email protected] – [email protected] – [email protected] – [email protected]

Web pages: – administracionelectronica.gob.es– www.ccn-cert.cni.es– www.ccn.cni.es – www.oc.ccn.cni.es

Many thanks


spanish government it security policy: the national security framework of spain

Technology