Tietojärjestelmien tietoturvallisuus

Organisation must maintain a listing of used data systems and their owners. Owner is responsible for completing the related documentation and possible other security actions directly related to the data system.

Data system documentation must include at least:

• System purpose and linked responsibilities
• System's data location (covered in a separate task)
• System's maintenance and development responsibilities and linked partners (covered in a separate task)
• When necessary system's access roles and authentication methods (covered in a separate task)
• When necessary systems interfaces to other systems (covered in a separate task)

The organization has defined a process for addressing identified technical vulnerabilities.

Some vulnerabilities can be fixed directly, but vulnerabilities that have a significant impact should also be documented as security incidents. Once a vulnerability with significant impacts has been identified:

• risks related to the vulnerability and the necessary actions are identified (e.g. patching the system or other management tasks)
• necessary actions are scheduled
• all actions taken are documented

Organization carries out threat intelligence by gathering information about information security threats related to its operations and how to protect against them. The goal is to increase awareness of the threat environment, so that own security level can be better evaluated and adequate control measures implemented.

When collecting threat intelligence, all three levels must be taken into account:

• strategic threat intelligence (e.g. information on the growing types of attackers and attacks)
• tactical threat intelligence (e.g. information about tools and technologies used in attacks)
• operational threat intelligence (e.g. details of specific attacks)

Principles related to threat intelligence should include:

• setting targets for threat intelligence
• identification, verification and selection of information sources used in threat intelligence
• gathering threat intelligence
• data processing for analysis (e.g. translation, formatting, compression)

To ensure the reliability of the systems, the following measures should be taken:

• Duplication of the systems
• Planned temporary solutions in case of problem situations
• Spare parts available
• Using special components
• Active monitoring
• Active maintenance activities

Maintenance, updating and possible renewal of information systems, devices and networks should be planned with the necessary component and software updates to be implemented before possible failures. When examining the criticality of components, the perspective of customer and patient safety should be taken into account.

The organisation regularly evaluates the level of cyber security and the effectiveness of the information security management system.

Organisation has defined:

• monitored metrics to provide comparable results on the development of cyber security level
• persons responsible for the metering
• methods, timetable and responsible persons for metrics reviewing and evaluation
• methods to document metric-related evaluations and results

Effective metrics should be usable for identifying weaknesses, targeting resources better and assessing organisation's success / failure related to cyber security.

The organization must make sure that data systems are maintained and updated according to the manufacturer guidelines

The organization shall regularly review the technical compliance of the data systems with the organization's requirements.

The reviews may use manual implementation by experienced professionals or automated tools (including intrusion testing).

Technical reviews shall always be planned and carried out by competent and pre-approved staff.

The organization must have a clear model for prioritizing identified technical vulnerabilities. The operating model should not be entirely new invention, but should be based on generally accepted practices.

Vulnerabilities should be prioritized based on the risk they pose, the importance of the assets involved, the potential organizational impact, and the urgency (taking into account the CVSS value).

Olennaisilla tietojärjestelmillä tarkoitetaan sellaisia tietojärjestelmiä, jotka ovat kriittisiä viranomaisen lakisääteisten tehtäviä toteuttamisen kannalta erityisesti hallinnon asiakkaille palveluja tuotettaessa.

Toiminnallisella käytettävyydellä tarkoitetaan tietojärjestelmän käyttäjän kannalta sen varmistamista, että tietojärjestelmä on helposti opittava ja käytössä sen toimintalogiikka on helposti muistettava, sen toiminta tukee niitä työtehtäviä, joita käyttäjän pitää tehdä tietojärjestelmällä ja tietojärjestelmä edistää sen käytön virheettömyyttä.

• Organisaatio tunnistaa ja luetteloi tehtävien hoitamisen kannalta olennaiset tietojärjestelmät esimerkiksi osana suojattavien kohteiden luettelointia ja tiedon luokittelua.
• Organisaatio määrittelee olennaisten tietojärjestelmien saatavuuskriteerit, joita vasten vikasietoisuus voidaan testata. Järjestelmäkohtaisten saatavuuskriteerien määrittelyssä voidaan hyödyntää tietojärjestelmien saatavuusluokittelua.
• Organisaatio määrittelee toiminnallisen käytettävyyden kriteerit.
• Organisaation hankintaprosesseissa ja hankintaohjeissa on huomioitu toiminnalliseen käytettävyyteen ja vikasietoisuuteen liittyvät vaatimukset.
• Organisaatio dokumentoi vikasietoisuuden testaukset.

Orgaisaation on myös varmistettava digitaalisten palveluiden saavutettavuus lainsäädännön edellyttämässä laajuudessa:

Saavutettavuus tarkoittaa sitä, että mahdollisimman moni erilainen ihminen voi käyttää verkkosivuja ja mobiilisovelluksia mahdollisimman helposti. Saavutettavuus on ihmisten erilaisuuden ja moninaisuuden huomiointia verkkosivujen ja mobiilisovelluksien suunnittelussa ja toteutuksessa. Saavutettavan digipalvelun suunnittelussa ja toteutuksessa pitää huomioida kolme osa-aluetta: tekninen toteutus, helppokäyttöisyys ja sisältöjen selkeys ja ymmärrettävyys.

The organization must ensure the availability of information systems throughout their entire lifecycle. For this reason, the availability requirements of different information systems (especially the maximum time a system can be out of service, recovery time objective, and recovery point objective) must be met.

The implementation of availability requirements must take into account the load endurance, fault tolerance, and recovery time required from the information system.

Additionally, the need for procedures that protect availability has been identified, and procedures have been implemented with customized protections for critical systems. These protections may include, for example, redundancy of key network connections, hardware, and application execution environments.

The organization must ensure that information systems are installed, maintained and updated only by personnel who have the necessary skills and expertise. In addition, the role and responsibilities of the person who installs, maintains and updates information systems must be described in relation to the organization and the producer of the information system.

The operation of information systems may depend on certain key resources, such as server capacity,storage space, data processing capacity,monitoring capacity or certain< em>key people.

The organization has defined key resources and methods for monitoring the use of these key resources. A normal level is also determined for the resources, which is used when assessing the risk of jeopardizing availability due to capacity problems.