National INFOSEC Organisations and INFOSEC Management in Hungary.
-
Upload
aubrey-richard-little -
Category
Documents
-
view
233 -
download
0
description
Transcript of National INFOSEC Organisations and INFOSEC Management in Hungary.
National INFOSEC Organisations and
INFOSEC Managementin Hungary
• is the application of security measures to protect information processed, stored or transmitted in communication, information and other electronic systems against loss of confidentiality, integrity or availability, whether accidental or intentional, and to prevent loss of integrity or availability of the systems themselves.
• A set of security measures (physical, personnel, security of information and INFOSEC) shall be implemented to create a secure environment in which to operate a communication, information or other electronic system.
INFOSECINFOSEC
INFOSEC based on law
CONSTITUTION59. § (1) Protection of private confidentiality and data be due to every Hungarian subject.
The Act about protection of private confidentiality and publicity of data of public interest.
Act LXIII. of 1992.
Data SecurityArticle 10 par 1
10. § (1) The holder of information and in the scope of his activity the user of information are obliged to take care of the security of information, to take those technical and organising measures and to elaborate those procedural rules which are necessary in order to enforce this Act and other regulations, relating to the information security and protection of classified information.
Act LXIII. of 1992
Act LXIII. of 1992Data Security
Article 10 par 2
(2) Information – especially personal data, qualified as state secret and service secret, shall be particularly protected against
• illegal access,• modification,• disclosure,• deletion,• damage, and• destruction.
• disclosure,• illegally obtaining and use,• transferring to unauthorised persons• the prevention of the entitled person from
accessing it,
if these occur before the termination of the validity period it can damage or endanger the interests of the Republic of Hungary.
Act LXV. of 1995 (1)Types of secret
(1) State Secret (Top Secret)
if occur:• disclosure,• illegally obtaining and use,• transferring to unauthorised persons
before the termination of the validity period it can damage the working order of the state or public organisation, and hinder the exercise of their tasks and competence without improper effects.
Act LXV. of 1995 (2)Types of secret
(2) Service Secret (Secret)
Protected but not classified data(nowadays these are also classified)
Confidentialis injurious (harmful) if it becomes available to the public or unauthorised persons become acquainted
Restricted
is unfavourable if it becomes available to the public or unauthorised persons become acquaintedto the interested country or organisation concerned with the national agreement.
Act LXV. of 1995 (3)
Governmental Decree 79 of 1995 about
handling order of classified data
Protection of classified data carrier:
• classification• registering• copying• destruction• safekeeping
• take over of data• handing over, passing• taking back• revision
Governmental Decree 79 of 1995about
handling of classified data (2)
Protection of classified data-storage (27. §)
Data, containing state secret (top secret) or service secret (secret), whose reliable protection cannot be provided otherwise can be stored in computer systems in magnetic form or other types of data storage only in coded form.
on the CIS
Governmental Decree 79 of 1995about handling of classified date (3)
• Transfer and forwarding of classified information.
Classified information held in a wired or wireless system of data-transition, if the data leaves the boundary of reliable protection and supervision, especially when it leaves the properly closed or protected area of the organization which is responsible for information security it must only be forwarded in coded form.
Governmental Decree 43 of 1994about Crypto Activity
• Organization of Crypto Activity• Personal Conditions• Crypto equipment• Basic security rules• Tasks of National Communication Security
Authority• Inspection
Main articles of decree:
Governmental Decree 43 of 1994about Crypto Activity
Organisation of crypto activity:6.§ (1)Dependent on character and measure of the
organisation pursuing crypto activity it has an interest in control and supervision to at least:
• Assign a crypto custodian or• Establish a Crypto Authority
Governmental Decree 43 of 1994about Crypto Activity
Organisation of crypto activity:6.§ (2)In the case of assigning more than one crypto
custodian when establishing a Crypto Authority it has to operate Central Crypto Authority in the effected organisation.
MoD Directive about Crypto Activity
Organisation of crypto activity in the MoD:Currently in operation:• a Central Crypto Authority for technical control and
technical supervision of crypto activity in the Hungarian Military Forces
• Crypto Authority in the middle level of military structure
The Central Crypto Authority is working under National Crypto Authority (National Communication Security Authority)
Legal regulationParliament
CONSTITUTION
Act LXIII.of 1992.
Act LXV.of 1995.
Gov. Dec. 79of 1995
Gov. Dec. 43of 1994
MoD Directive
Act IV.of 2000.
Act LXXXV.of 1998.
Gov. Dec. 56of 1999
Gov. Dec. 52of 2002
MoD Directive MoD Directive
Before to join to NATO
(all modified later)
During and after join to
NATO
Act LXXXV. of 1998 decrees about the National Security Authority.
• Control: The Minister Heading thePrime Minister’s Office
• Supervision: National SecurityCommittee of the Parliament
• Information (Coverage): Defence Committee
of the Parliament
National Security Authority
National Security Committee
of the Parliament
Committee of Defence
The Minister Leading the
Prime Minister’s Office
National Security Authority
Responsibilities / Carry out:• prescribe tasks for NSA in NATO and UN security directives• prescribe tasks for National Industrial Security Authority• during its tasks handle personal and special data
National Security Authority(Governmental Decree 180/2003)
The main tasks are:• functions of NSA (co-operative organisations)• procedure of personal security• procedure of physical and document security• procedure of electronic information security• industrial security inspection
Governmental Decree 52 of 2002 about National Security Authority
National SecurityAuthority (NSA)
Department of Information and
Document Security of MoD
National Communication
Security Authority (NCSA)
National Security Office (NSO)
Military Security Office (NSO)
Newest regulations
• Governmental Decree 179/2003 about rules of procedure of protection of classified data received by international contract or made by international commitment.
• Governmental Decree 180/2003 about detailed tasks and rules of activities of National Security Authority, together with detailed rules of industrial security inspection.
Security StructureParliament
National Security Committee
Defence Committee
The Minister Heading the Prime Minister’s
Office
National Security Authority
Department of Information and
Document Security of MoD
National Communication
Security Authority (NCSA)
National Security Office (NSO)
Military Security Office (NSO)
Central Crypto Authority of
HMFNATO
CIS
Security Organizations and Persons on the CIS System
InternationalSecurity
Organizatons(NATO, EU)
NationalCommunication Security
Authority
Central Communication Security Authority of MoD (MoD GS J6)
System/NetworkSecurity Officer(MoD GS J6)
Crypto Custodian
National SecurityAuthority
INFOSEC Authority(MoD DoI&DS)
INFOSEC Operational Authority
(MoD GS J6)Security Officer(MoD GS J6)
Local Security Officer
Person in Charge of Security – (HQSO)
HQ of Communication
centralsystem administrator
Local System Administrator
Users
Joint Logistic and Support
Command
Site Security Officer
Securityelements
Operationalelements
Thank you for your attention