Kibernetinio saugumo reikalavimų aprašas (KSRA)
Security of the Acquisition, Development and Maintenance of Network and Information Systems, Including Vulnerability Management and Disclosure
40. The head of the cybersecurity entity or a person authorised by them must establish a procedure for ensuring the security of the acquisition, development and maintenance of network and information systems, which covers:
- 40.1. requirements for the acquisition and deployment of network and information systems
- 40.2. provisions on the use and updating requirements of security systems intended to protect networks and information systems against malicious software (viruses, spyware, unsolicited email and the like)
- 40.3. the main provisions on the use of computer network filtering equipment (firewalls, content control systems, proxy servers and other)
- 40.4. measures to ensure the security of the data transmission network
- 40.5. provisions on the secure use of email
- 40.6. provisions on approving the list of permitted software, on reviewing it regularly at least once a year, and on updating it
- 40.7. other measures used to ensure cybersecurity.
41. Software is deployed only by persons authorised by the cybersecurity entity. System users may not be authorised to install software themselves.
42. The cybersecurity entity must establish a procedure for managing changes to network and information systems (hereinafter — changes), covering planning, identification of changes, categorisation by type of change, impact assessment and prioritisation of changes.
43. All changes that could disrupt or halt the operations of the cybersecurity entity must be agreed with the head of the entity or a person authorised by them and must be tested in a test environment.
44. The cybersecurity entity must establish a patch management procedure. Security patches must be tested before being deployed in the production environment. Security patches from official manufacturers must be deployed, and their integrity must be verified before deployment. Security patches are not deployed if vulnerabilities are found in them that could cause greater harm than the benefit of deploying them.
45. The head of the cybersecurity entity or a person authorised by them must approve provisions on vulnerability management and disclosure, which must set out:
- 45.1. the identification and assessment of vulnerabilities that may affect cybersecurity
- 45.2. the rights and duties of the persons responsible for identifying vulnerabilities
- 45.3. preparation of a vulnerability identification plan
- 45.4. use of vulnerability identification software
- 45.5. classification of the results of vulnerability identification
- 45.6. preparation of vulnerability identification reports and remediation of the shortcomings identified
- 45.7. the requirement to remedy without delay a vulnerability assessed as highly significant for the operation of the network and information systems
- 45.8. the requirement to assess vulnerabilities regularly and to carry out a full vulnerability scan of the network and information system at least every 6 months
- 45.9. investigation of, and provision of information on, vulnerabilities about which information has been received under Article 25 of the Cybersecurity Law.
46. Vulnerability handling must be aligned with the cybersecurity entity's change and incident management provisions.
47. The technical requirements applicable to cybersecurity entities are set out in Table 3.
All cybersecurity entities
21. The cybersecurity entity must have an up-to-date logical diagram of the network and information systems infrastructure and diagrams of all network and information systems (updated when they change).
<...>
23. Firewalls that control all inbound and outbound traffic must be enabled and configured on servers (including virtual machines) and workstations.
24. Emails received from outside must be filtered in order to detect and block malicious content.
25. The configuration rules of the hardware and software intended to detect cyber incidents must be stored in electronic form separately from the network and information systems hardware (together with the relevant dates, responsible persons and periods of application).
26. When connecting to a wireless network (where connecting to the internal network of the network and information system), the EAP (Extensible Authentication Protocol) / TLS (Transport Layer Security) protocol, or a newer protocol generally recognised as secure, must be used to authenticate users of the network and information systems.
27. Secure network protocols must be used to manage the network.
28. All unnecessary protocols and open ports must be prohibited / disabled.
<...>
30. The updates recommended by the manufacturers of the software used and by the operating systems must be deployed.
31. Network and information systems that, for objective reasons, use unsupported versions of operating systems and other software must operate in a separate network segment, isolated from the main business functions of the cybersecurity entity.
32. The internal computer network of the cybersecurity entity should be segmented, separating at least:
- 32.1. the subnet for managing and administering network and information systems;
- 32.2. a separate subnet for each third party, or otherwise ensuring third-party access only to the resources that party needs, applying multi-factor authentication where possible. The connection must be made using a secure virtual private network (VPN). The connection is recorded in the event logs;
- 32.3. the subnet for networked multifunction devices, printers and scanners;
- 32.4. the IP telephony subnet;
- 32.5. the workstation subnet;
- 32.6. the testing subnet.
33. Executable code control measures must be used on mobile devices and computer workstations that restrict the use of unauthorised executable code or inform the administrator about the use of unauthorised executable code.
34. Operating system images and/or other measures with integrated security settings must be prepared and deployed for computer workstations (including portable devices). The image must contain only the operating system components necessary for operations (administration accounts, services, applications, network ports, updates, system tools). Images must be reviewed and updated regularly, and updated immediately when new vulnerabilities or attacks are identified. The operating system with security settings must be deployed on computer workstations (including portable devices) in accordance with the prepared images.
35. It is prohibited to store session data (identifiers) on website servers for login purposes after the connection session has ended.
36. A Web Application Firewall must be used for websites and network and information systems accessible over the internet.
37. Protection against the main attacks carried out over the network must be used for websites and network and information systems accessible over the internet, based on the OWASP (The Open Web Application Security Project) Top 10 best practices (www.owasp.org).
38. Input validation of the data entered by website users must be used in web forms.
39. Network and information systems accessible over the internet must not display to the user error messages about the network and information system, the program code or the server.
40. The security measures of network and information systems accessible over the internet using the HTTPS (HyperText Transfer Protocol Secure) protocol must permit only those protocol methods that are necessary to ensure their functionality.
41. Measures for detecting malicious software and monitoring it in real time must be used on the cybersecurity entity's servers and computer workstations, managed and updated centrally where possible.
42. Only legal and permitted software (according to the list approved by the cybersecurity entity) is used.
43. The amount of free memory or disk space of the network and information systems equipment must be monitored continuously, as must the load and the use of resources. When the established threshold values are reached, the responsible persons must be informed.
Additionally, only for Essential cybersecurity entities
22. Attack signatures must be updated using reliable sources providing up-to-date information. The latest attack signatures must be deployed no later than within 24 hours of the date on which the manufacturer announced the latest attack signatures, or no later than within 72 hours of that date where, by decision of the cybersecurity entity, an assessment (testing) is carried out of the deployment of the attack signatures and of their possible impact on the entity's operations.
29. Peer-to-peer functionality must be disabled on computers and mobile devices where it is not necessary for performing work functions.