Audit SKZI and crypto keys

From an information security point of view, cryptographic keys are critical data. If earlier, in order to rob a company, attackers had to penetrate into its territory, open premises and safes, now it is enough to steal a token with a cryptographic key and make a transfer through the Internet Client-Bank system. The foundation of security with the help of cryptographic information protection systems (CIPS) is to maintain the confidentiality of cryptographic keys.

And how to ensure the confidentiality of the existence of what you do not guess? To remove the token with the key in the safe, you need to know about the existence of the token and safe. Paradoxically, very few companies have an idea of ​​the exact number of key documents they use. This can occur for a variety of reasons, for example, underestimation of information security threats, lack of established business processes, insufficient staff qualifications in security matters, etc. They usually recall this problem after incidents, such as this one .
')
This article will describe the first step towards improving the protection of information using cryptographic tools, or more specifically, consider one of the approaches to conducting an audit of CPS and crypto keys. The story will be conducted on behalf of an information security specialist, while we assume that the work is carried out from scratch.

Terms and Definitions

At the beginning of the article, in order not to frighten the unprepared reader with complex definitions, we widely used the terms of a cryptographic key or a cryptokey, now it is time to improve our conceptual apparatus and bring it in compliance with current legislation. This is a very important step, as it will effectively structure the information obtained from the audit results.

1. A cryptographic key (cryptographic key) is a set of data that ensures the selection of one specific cryptographic transformation from among all possible in a given cryptographic system (the definition from “Pink Instruction - FAPSI Order No. 152 of June 13, 2001 , hereinafter referred to as FAPSI 152).
2. Key information is a specially organized set of cryptographic keys designed to implement cryptographic protection of information for a certain period of time [FAPSI 152].
   To understand the fundamental difference between a cryptokey and key information, use the following example. When organizing HTTPS, a public and private key pair is generated, and a certificate is obtained from the public key and additional information. So, in this scheme, a set of certificate and private key form key information, and each of them separately is a cryptokey. Here you can follow the following simple rule - end users, when working with the MIPS, use key information, and the crypto keys usually use the MISS inside. At the same time, it is important to understand that key information may consist of a single cryptokey.
3. Key documents - electronic documents on any media, as well as documents on paper media containing key information of limited access for cryptographic transformation of information using the algorithms of cryptographic transformation of information (cryptographic key) in encryption (cryptographic) means. (definition from the Government Decree No. 313 of April 16, 2012 , hereinafter referred to as PP-313)
   In simple language, a key document is key information recorded on a carrier. When analyzing key information and key documents, it should be emphasized that key information is being used (that is, used for cryptographic transformations - encryption, electronic signature, etc.), and key documents containing it are transmitted to employees.
4. Means of cryptographic information protection (SKZI) - encryption tools, imitation protection tools, electronic signature tools, encryption tools, key documents production tools, key documents, hardware encryption tools (cryptographic) tools, software-hardware encryption tools (cryptographic) tools. [PP-313]
   When analyzing this definition, it is possible to detect the presence of the term key documents. The term is given in the Government Decree and we have no right to change it. At the same time, the further description will be carried out on the basis that only means of cryptographic transformations will apply to the CIPF). This approach will simplify the audit, but at the same time will not affect its quality, since the key documents will still be taken into account, but in our section and our own methods.

Audit methodology and expected results

The main features of the audit methodology proposed in this article are the postulates that:

• no company employee can accurately answer the questions asked during the audit;
• existing data sources (lists, registries, etc.) are not precise or poorly structured.

Therefore, the method proposed in the article is a kind of data minning, during which the same data will be extracted from different sources, and then compared, structured and refined.

Here are the main dependencies that will help us in this:

1. If there is SKZI, then there is key information.
2. If there is an electronic document flow (including with contractors and regulators), then most likely it uses an electronic signature and, as a result, the SKPI and key information.
3. Electronic document management in this context should be understood broadly, that is, it will include both the direct exchange of legally relevant electronic documents and the filing of reports, work in payment or trading systems, and so on. The list and forms of electronic document management are determined by the company's business processes, as well as current legislation.
4. If an employee is involved in electronic document circulation, then most likely he has key documents.
5. When organizing an electronic document flow with counterparties, organizational and administrative documents (orders) on the appointment of responsible persons are usually issued.
6. If information is transmitted via the Internet (or other public networks), then most likely it is encrypted. First of all it concerns VPN and various remote access systems.
7. If protocols that transmit traffic in encrypted form are detected in the network traffic, the CRPD and key information are used.
8. If settlements were made with counterparties engaged in: the supply of information protection means, telecommunications devices, the provision of services for the transfer of puffiness, and services of certification centers, then, during this interaction, CIPS or key documents could be acquired.
9. Key documents can be either on removable media (floppy disks, flash drives, tokens, ...) or written inside computers and hardware SKZI.
10. When using virtualization tools, key documents can be stored both inside virtual machines and mounted to virtual machines using the hypervisor.
11. Hardware SKZI can be installed in the server and be unavailable for analysis over the network.
12. Some electronic document management systems may be in an inactive or low-active form, but at the same time contain active key information and SKZI.
13. Internal regulatory and organizational-administrative documentation may contain information about electronic document management systems, SKZI and key documents.

For the extraction of primary information will be:

• interview workers;
• analyze the company's documentation, including internal regulatory and administrative documents, as well as outgoing payment orders;
• carry out a visual analysis of server rooms and communication cabinets;
• to conduct technical analysis of the contents of automated workplaces (AWP), servers and virtualization tools.

We will formulate specific measures later, but for now we will consider the final data that we should receive as a result of the audit:



SKZI list:

For each element of the list, we fix the following data:

1. SKZI model . For example, Crypto CSPP 3.9, or OpenSSL 1.0.1
2. The instance identifier of the SKZI . For example, serial, license (or registration number for PKZ-2005 ) SKZI number
3. Information about the certificate of the Federal Security Service of Russia on SKZI , including the number and dates of commencement and termination of validity periods
4. Information about the place of operation of SKZI . For example, the name of the computer on which the software SKZI is installed, or the name of the hardware or premises where the hardware SKZI are installed.

This information will allow:

1. Manage vulnerabilities in the SKZI, that is, to quickly detect and fix them.
2. Track the validity of certificates on SKZI, and also check whether a certified SKZI is used in accordance with the rules established by the documentation or not.
3. Plan the cost of SKPI, knowing how much is already in operation and how much more consolidated funds there are.
4. Generate regulatory reporting.

List of key information:

For each element of the list, we fix the following data:

1. The name or identifier of the key information . For example, “The key is a qualified ES. The serial number of the certificate is 31: 2D: AF, and the identifier should be selected so that it can be used to find the key. For example, certification authorities, when sending notifications, usually identify keys by certificate numbers.
2. The Key System Management Center (CSC) that released this key information. This may be the organization that issued the key, for example, the certification authority.
3. An individual in whose name key information is issued. This information can be extracted from the CN fields of the X.509 certificates.
4. The format of key information . For example, CryptoPRO SKZI, Verba-OW SKZI, X.509, etc. (or in other words, for which SKFM this key information is intended).
5. Assign key information . For example, “Participation in bidding at the Sberbank AST site”, “Qualified electronic signature for reporting”, etc. From the point of view of technology, in this field, you can record the limitations of the fields extended key usage and other X.509 certificates.
6. Start and end of the validity of key information .
7. The procedure for the re-release of key information . That is, knowledge of what needs to be done and how when reissuing key information. At least it is desirable to record the contacts of officials of the CUKS who issued the key information.
8. The list of information systems, services or business processes in which key information is used . For example, "The system of remote banking services Internet Client-Bank".

This information will allow:

1. Track the expiration of key information.
2. If necessary, quickly reissue key information. This may be necessary for both planned and unscheduled reissuing.
3. Block the use of key information, when dismissing an employee for which she is released.
4. Investigate information security incidents, answering the questions: “Who had the keys to make payments?” And others.

List of key documents:

For each element of the list, we fix the following data:

1. Key information contained in the key document.
2. Key information carrier on which key information is recorded.
3. The person responsible for the security of the key document and the confidentiality of the key information contained therein.

This information will allow:

1. Re-issue key information in cases of: the dismissal of employees with key documents, as well as the compromise of carriers.
2. Ensure the confidentiality of key information by inventorying the media containing it.

Audit plan

It is time to consider the practical features of the audit. We will do this on the example of a credit and financial organization or in other words on the example of a bank. This example was not chosen randomly. Banks use a fairly large number of disparate cryptographic protection systems that are involved in a huge number of business processes, and besides, almost all banks are Licensees of the Federal Security Service of Russia on cryptography. Further, the article will present the audit plan for the CIPF and crypto keys, as applied to the Bank. At the same time, this plan can be taken as a basis for conducting an audit of almost any company. For the convenience of perception, the plan is divided into stages, which in turn are collapsed into spectators.

Conclusion

In this article, we reviewed the theory and practice of conducting audit of CPSS and cryptokeys. As you have seen, this procedure is rather complicated and time consuming, but if you competently approach it, it is quite feasible. Let's hope this article will help you in real life. Thank you for your attention, waiting for your comments.