SISAI STATISTICAL INFORMATION SYSTEMS ARCHITECTURE AND INTEGRATION WORKING GROUP 3rdMEETING 13-14 MAY 2013 ITEM 1.7 ESS Security Survey

ESS Security Survey ESTAT LISO – B0

Objectives Answer to challenges presented to SISAI 12-13/6/2012 Improve statistical production chain efficiency Needs to increase IT security in order to build trust between ESS partners Rationalisation of EU IT Development Implementation of the vision COM 404/2009 and the ESS Joint Strategy Fight against Cyber-criminality

Actions and progress since 2012 Finalise the MS consultation and get feedback on the initiative Initiative well received and supported by all MS Visits to some NSIs to understand their infrastructure Under preparation Present a draft action plan to ITDG ITDG agreed on the creation of a one year WG on Security with scope on Security Frameworks showing clear examples. Organise an « Enterprise Architecture Security Workshop » end of 2012 Done on 13-14/12/2012. All information on CROS portal. Mandate and action plan discussed. Possible pilot project with a few MS to exchange secure messages on CCN (Common Communication Network of DG TAXUD) Under ESS.VIP.ESDEN

Conclusions of the TF Understand the national conditions (infrastructure, security rules) allowing ESS partners to be connected to one or another secure network Be aware of the policies applied in the other ESS members their compatibilties and consistencies: Objective: Speak a common security language first analysis of the different security frameworks (survey) survey analysis until June results circulated to the group end of June submission to ITDG and DIME. recommendations for the creation on the common security language in September. A strategic document on the implementation of the common ESS security framework submitted to ESSC end 2013

Survey content Context Confidential info Any IT published Security Framework Shared infrastructure with other administrations Centralised NSI Network between offices Who is in charge of producing official statistics Confidential info Data centre operation Remote access facilities and used technologies Team dealing with confidentiality Conditions for exchanging confidential information with other NSIs

Data Protection Implementation Rules and needs for confidentiality Security included in the objectives of the organisation Maturity level of the security guidelines When is data protection applied in GSBPM Implementation Risk analysis and methodology Application of information security in project management Technology safeguards used Data Privacy safeguards Information Security Safeguards Network used for connection with EU services Preferred network connection

Governance Audit Ressources Who manages IT security Support from National Offices or Agencies Security Officer in place Audit Responsible body Incident management, nbr and cause of incidents Periodicity and date of last audit Ressources IT security team Person in charge Spending in security

Survey Results (1) 34 answers from 30 countries 24 EU MS (missing AT, EL, IE) 6 EFTA and Candidates Other Security Frameworks Decree on Information Security in Central Goverment 1 DS484:2005 to be replaced by ISO27001 CESG/Security Policy Framework guidance ISO 27000 Customized German BSI Grundschutz-Standard 100-1,100-2,100-3,100-4. (BSI: Federal Office for Information Security; the baseline protection standards are compatible to ISO 27001/2). 4 Spanish National Security Framework correlated with ISO 27002 ISKE is based on a German information security standard – IT Baseline Protection Manual, ISO 27001 and ISO 27002 recommendations.

Survey Results (2)

Data Centre Other types of Data Center Management Commercial Data Centre managed by NSI personnel Data center by IT provider own data centre and partial cooperation with central government data centre Own Data Centre maintained in collaboration a service provider Own Data Centre with NSI own IT-personnel and 10% are non NSI IT-personnel supervised by internal IT-personnel Central IT service provider at ministry level (2)

Conditions for exchanging confidential info with other MS Adoption of a legal framework 17 Agreement on confidential data usage/contract with technical conditions 7 Same conditions as National rules 6 Data Encryption 5 Secure connection like Stesta/Common secure IT infrastructure 3 Not possible due to National Rules Do not know 2 To be discussed Limited list of users/Authentication Anonymisation 1 Compliance with IT Securite principles (CIA)

Team dealing with confidentiality (Rules, Acces) No dedicated team 11 unknown 3 1 People (DPO) 1 2 People 3 People 3.5 People: IT Security 4 People 4 people : 1 (disclosure control) + 3 (IT security) 4.5 People: legal and methodology 6 People 7 People 8 People 8 People: 3 (methodo) + 5 (microdata access) 9 People 2 13 People: Confidential data WG 15 People 15 People half time on confidentiality 17 People: 12 confidentiality + 5 dissemination 20 People: IT (4) Security committee (9) Data Privacy (7)

Data Protection Needs for Confidentiality At which GSBPM stage is data protection applied? At all Stages 14 2 Design 3 2.5 Design of methodology 1 3 Build 4 Collection 9 5 Process 7 6 Analyse 6.4 Disclosure Control 4 7 Disseminate 8 Archive Needs for Confidentiality Constitution 9 Law 20 Act 14 Selfmade rules 22

Security Implementation Involvement of Security in Projects Analysis and design phase 16 As needed basis 9 Implementation phase 8 Inception phase Technology Safeguards Automated account provisioning/deprovisioning 8 Identity management 27 Encryption of laptops/mobile devices 19 Malicious code detection 32 Intrusion detection 26 Malware detection 33 Patch management Log Management 22 Dedicated isolated network for confidential data management 14 Firewall 4

Data Privacy Safeguards Implementation (2) Data Privacy Safeguards Privacy policy revised annually 17 Inventory of location of personal data and jurisdiction 20 Incidence response process 23 Require third parties to comply with privacy policies 21 Malware/virus detection 33 Encryption 25 Confidentiality Commitment for employees Restricted access to statistical database Process Safeguards Information security strategy 24 Security baselines/stds for external partners 22 Identity management BCP/ recovery strategy 23 Employee security awareness training Penetration testing Threat and vulnerability assessment 17

Secure Connections with EU services Implementation (3) Secure Connections with EU services Which kind of access would you prefer? I do not know 1 no opinion 2 Secured access for statistical purposes S-Testa 4 to be discussed VPN

Other IT security management levels Governance Other IT security management levels Separate Office/Other IT department 2 At government level 4

Audit

IT Security Ressources