Introduction

The following subsections list the selection of security measures of a technological nature that are resolved by the Onesait Platform architecture design with a default security approach. Measures relating to the implementation and operation of the platform are also included.

Before continuing with this document, we recommend reading The National Security Scheme (ENS) and the Onesait Platform

Operational Framework

It is made up of the measures to be taken to protect the operation of the system as an integral set of components for a purpose.

Planning

Risk analysis

In the implementation of the platform, a risk analysis will be carried out, using a specific language, with a basic catalog of threats and defined semantics - That is to say, a presentation with tables that describe the following aspects:

• Identify and qualitatively assess the most valuable assets of the system.

• Identify and quantify the most likely threats.

• Identify and assess the safeguards that protect against such threats.

• Identify and assess residual risk.

For this purpose, the catalog of threats foreseen in the Magerit methodology, provided by the ENS, will be used as a basis.

The following table represents a risk analysis with the most common threats in this type of systems.

Access control

[op.acc.1] Identification

Each user has a unique identifier through an account. If a user must have different roles, she will receive different identifiers so that privileges and activity records are always delimited.

Each user account is associated with a role and specific permissions that can be assigned and revoked. Likewise, all the actions carried out by a user leave a trace in an audit trail, so that it is possible to know who has done what and what they have done.

User accounts are manageable from users with specific roles so that they can be disabled. Disabled accounts and their activity records are retained in the system for a configurable period of time so that the retention periods applicable to each implementation can be met.

[op.acc.2] Access requirements

Access to all system resources is protected by authentication, and its use is restricted to the user who created it and to users and groups specifically granted access by authorized roles.

There is the possibility of marking resources for public access. This option is never the default option and must be carried out by a user with special permissions on that resource.

Access to Onesait Platform configuration parameters and modules/components is restricted only to administrator users and system operators.

[op.acc.3] Segregation of duties and tasks

The access control system is designed with specific roles with different functions within the system.

At the platform user level, the roles that a user must know are these:

• USER (ROLE_USER): This role has access to the platform in query mode, that is to say, it can consume platform information generated by others, but not upload information; it can therefore consume dashboards, APIs, query ontologies, ...

• DEVELOPER (ROLE_DEVELOPER): This role can use all the DaM and IoT capabilities of the platform without restrictions - it can create ontologies, APIs, rules, ... It is the typical user of the platform, and the one created by default. It has limited access to the AI ​​capabilities of the platform, to control the resource consumption of the installation.

• ANALYTICS (ROLE_DATASCIENTIST): This role extends the capabilities of the Developer role, allowing access to analytical and AI tools - therefore, it has access to DataFlow, Notebooks, Models, ...

• ADMINISTRATOR (ROLE_ADMINISTRATOR): This role has administrative access to the Platform Control Panel. From there, the administrator can manage all the concepts of a platform instance created by other users, including user management, ontologies, permissions, ...

Internally, the platform manages a set of roles that allow the operation and management of a platform installation:

• DEVOPS (ROLE_DEVOPS): This role is responsible for managing the CI/CD process of the platform. It has access to Jenkins that is managed from the platform, from where it can launch the compilation and version generation pipelines, both for the platform and for verticals and microservices deployed on the platform.

• OPERATIONS (ROLE_OPERATIONS): This role only has access to the platform's monitoring tools, being able to know the status of each module and to generate alerts from these.

• SYS_ADMIN (ROLE_SYS_ADMIN): This role has system administration access, allowing access to the underlying infrastructure of the platform.

In addition to these main roles, there are two more roles with special features:

• VIEWER (ROLE_DATAVIEWER): This role is a subrole of the USER role, and it only allows access to Dashboards and Marketplace.

• PARTNER (ROLE_PARTNER): This role contributes to the platform ecosystem by being able to create solutions that are marketed together with the platform and therefore has all the permissions of the ANALYTICS Role, plus access to a part of the platform's Operation Console to be able to deploy and operate its vertical.

[op.acc.4] Access rights management process

As a consequence of the segregation of functions and tasks materialized in the roles exposed in the previous measure, [op.acc.4], the Onesait Platform complies with the following principles in the management of access rights:

• Least privilege: The privileges of each user are reduced to the minimum strictly necessary to fulfill their obligations.

• Need to know: Privileges are limited so that users only access the information required to fulfill their obligations.

• Capacity to authorize: Exclusively the personnel with the competence to do so can grant, alter or cancel the authorization of access to resources, in accordance with the criteria established by their manager.

[op.acc.5] Authentication mechanisms

Onesait Platform can be configured with various authentication mechanisms depending on the security requirements:

• User and password.

• Digital certificates: Such as the electronic DNI or others, signed and issued by competent authorities.

• Double authentication factor: Authentication accompanied by SMS or email with verification code.

[op.acc.6] Local access and [op.acc.7] Remote access

Failed login attempts do not reveal sensitive information to the user. The number of access attempts is limited in a configurable way, also temporarily blocking the access attempt after each failure to prevent brute force attacks.

As it is a platform in service mode, all accesses are remote. The selected infrastructure service provider allows the creation of VPNs in the cloud so that it is possible to protect access to the desired services through private networks.

Exploitation

[op.exp.1] Asset inventory

An updated inventory of all system elements will be kept, detailing their nature and identifying their manager; that is to say, the person who is responsible for the decisions related to it.

[op.exp.2] Security configuration

The equipment will be configured prior to its entry into operation, so that:

• Standard accounts and passwords are retired.

• The rule of "minimum functionality" is applied, so that only those functionalities required to fulfill the requirements will remain active.

• Those functions that are not of interest, are not necessary, and even those that are inappropriate for the purpose pursued, will be eliminated or deactivated by controlling the configuration.

• The "security by default" rule will be applied. That is to say, all resources protected by default and the permissions on them must be granted by the responsible users.

[op.exp.3] Configuration management

The configuration of the system components will be managed continuously so that:

• The "minimum functionality" rule ([op.exp.2]) is maintained at all times.

• The "default security" rule ([op.exp.2]) is maintained at all times.

• The system adapts to the new, previously authorized needs ([op.acc.4]).

• The system reacts to reported vulnerabilities ([op.exp.4]).

• The system reacts to incidents (see [op.exp.7]).

[op.exp.4] Maintenance

To maintain the physical and logical equipment that constitutes the system, the following will apply:

• Manufacturers' specifications regarding installation and maintenance of the systems will be followed.

• Defect announcements will be continuously tracked.

• There will be a procedure to analyze, prioritize and determine when to apply security updates, patches, improvements and new versions. The prioritization will take into account the variation of the risk depending on the application or not of the update.

[op.exp.5] Change management

Continuous control of changes made to the system will be maintained, so that:

• Onesait Platform updates will be analyzed to determine whether or not they should be incorporated.

• Before putting a new version or a patched version into production, the team must check on a computer not in production, that the new installation works correctly and does not reduce the effectiveness of the functions necessary for daily work. The test team will be equivalent to the production team in the aspects that are checked.

• Changes will be planned to reduce the impact on the provision of affected services.

• Through risk analysis, the team will determine whether the changes are relevant to the security of the system or not. Those changes that imply a high-level risk situation will be explicitly approved prior to their implementation.

[op.exp.8] User activity log

The activities of users in the system will be logged, so that:

• The log will indicate who performs the activity, when it is performed and on what information.

• The activity of the users will be included and, especially, that of the operators and administrators as soon as they can access the configuration and act in the maintenance of the system.

• Successful activities and unsuccessful attempts must be logged.

Onesait Platform implements the following functionality:

• The platform has an audit system that allows each operation that occurs on the platform to be audited. These operations include Control Panel logins and logouts, communications between devices and systems, etc.

• The information associated with the audit is stored in a particular ontology for each user so that each user can access this information in a simple way (and, for example, create a monitoring panel).

• For this, when a user registers on the platform, an ontology with identification Audit_ <userName> is created.

• Admin users can access audit information for any user.

[op.exp.9] Incident management log

All actions related to incident management will be logged, so that:

• The initial report, the emergency actions and the system modifications derived from the incident will be logged.

• Any evidence that may subsequently support a lawsuit, or deal with it, will be logged when the incident may lead to disciplinary actions against internal personnel, external suppliers or the prosecution of crimes. In determining the composition and detail of this evidence, specialized legal advice will be used.

• As a consequence of the analysis of the incidents, the determination of the auditable events will be reviewed.

[op.exp.11] Protection of cryptographic keys

The cryptographic keys will be protected throughout their life cycle according to the protocols defined during the implementation of the platform:

• Generation.

• Transportation to the point of exploitation.

• Custody during exploitation.

• File after its withdrawal from active exploitation.

• Final destruction.

System monitoring

[op.mon.1] Intrusion detection

System intrusion detection is ensured by the capabilities of the infrastructure provider, which, through active monitoring of the contracted systems, monitors any installed element that is part of the Cloud infrastructure, collecting data in the form of logs, metrics and events, offering a unified and correlated view of them. Besides, this service incorporates an alarm system that can be used to automatically detect anomalous behavior in the data, as well as to solve problems automatically to keep the systems running.

[op.mon.2] System of metrics

In addition to the monitoring of the Cloud provider, at the Monitoring level, we are offered tools that allow us to consult the security status and monitor all the hardware and software components, and the platform includes the CaaS Console, the Monitoring UI and the platform audit module.

Protection measures

Focused on protecting specific assets, according to their nature, with the level required in each security dimension.

Communications Protection

[mp.com.1] Secure Perimeter

There will be a firewall system to separate the internal network from the outside. All traffic must pass through said firewall, which will only allow previously authorized flows to pass through.

The firewall contemplates, among others, the following rules:

• Non-secure protocols and ports should be disabled by default (port 80, http protocol, tcp without certificate).

• Block invalid packets.

• Block new non-SYN packets.

• Block unfrequent MSS values.

• Block packets from private subnets (Spoofing).

• Block connection attacks.

• Limit new connections per second.

• Block fragmented packets.

• Limit incoming TCP RST packets to mitigate TCP RST floods.

During the implementation of the Platform, and based on a risk analysis, the set of rules to be implemented in the firewall will be determined.

[mp.com.2] Confidentiality protection

Virtual private networks will be used when communication runs through networks outside the security domain itself where possible. Algorithms accredited by the National Cryptologic Center will be used.

[mp.com.3] Authenticity and integrity protection

All communications are protected by SSL certificates or electronic certificates such as DNI.

Information protection

[mp.info.1] Personal data

In accordance with this EU regulation 2016/679 for data protection (GDPR), the platform adopts the necessary requirements in the design and development of software to guarantee the privacy and protection of personal data for the user in any possible scenario. Users will have their personal data secured and protected. They will be able to define the restrictions and use the assignments of the information, guaranteeing at all times the rights established in the GDPR.

• Accountability principle

Onesait Platform implements the mechanisms by adopting the necessary measures for the processing of personal data as required by the standard, complying with:

• Responsibility.

• Accountability.

• Protection principles

From the beginning of Onesait Platform, the design focused on full compliance with the standard, adopting the necessary measures in all processes that involve data processing, as a rule and from the source. The platform provides authentication, authorization (by roles) and encryption (encrypted information) mechanisms, both in the transfer of information from systems and devices to the platform, and in the consumption of stored information. This guarantees the confidentiality and integrity of the stored information, complying at all times with:

• Data protection by design and by default.

• Anonymization.

• Transparency principle

Onesait Platform is completely transparent, both in terms of architecture and data management. The platform is an open-source solution, which has the Onesait Platform Community version on GitHub. Onesait Platform contemplates at all times:

• Right of access.

• Right of erasure.

• Records of processing activities.

• Allows the existence of a data protection officer.

The user will have the possibility of managing both her profile and all her information, from the Control Panel, maintaining a principle of complete transparency and privacy for the user.

• Registration and privacy options

To register an account in the system, users must accept the terms and conditions for using the platform.

Users are informed about the use of data and rights in accordance with the GDPR and how to exercise them (contact information). After that, using only the credentials (user/password), a user can access her personal platform account.

Once the user has deleted her account, all user information is also deleted if the user marked it as "private". If the information (ontologies) was verified as "public", that information will remain.

The user can define the privacy options in accordance with the GDPR:

• Forget my data: The user can delete any information contained in the ontologies that he has.

• Revoke consent: The user can revoke any previously granted consent.

• View my data: The user can query the data stored in the ontologies of which she is the owner.

• Forget me: The user can delete her profile, deleting all the information.

[mp.info.9] Backup

The facilities and tools provided by the Cloud will be used, specifically the snapshot concept that allows a backup of the data, allowing snapshots to be taken at a given time and working incrementally, saving storage costs. These snapshots contain the information necessary to restore the data on a final volume, producing an exact replica of the original volume. Mirrored volumes load data in the background, allowing you to start using it immediately.

Protection of services

[mp.s.2] Protection of services and web applications

Onesait Platform implements by default the following measures for the protection of its services and applications:

• Protection against automation. Possibility to enable CAPTCHA.

• Protection against code injection.

• Protection against cross-site scripting.

• Restriction of permissions and access by default.

• Protection against Cross-Site Request Forgery.

• Secure session cookies.

• Policies against weak passwords.

• Insecure SSL protocol and HTTPS on all exposed services.

• Unnecessary resources.

• Throttle control.

• Periodic updating of libraries and tools used in each release, so that known vulnerabilities are eliminated.

[mp.s.8] Protection against denial of service

• Application-level protection provided by Onesait Platform

  • Limitation of number of erroneous log-ins.

  • Throttle control in the exposed APIs.

  • Update to the latest stable versions of software in each release.

• Protection provided by the infrastructure service provider

Explained in the security measure [mp.com.1]. Secure perimeter.

• System sizing and scaling

The sizing of the planned system has enough capacity to support increases in demand. In addition, the scalability and robustness capabilities provide the flexibility to support these increases in demand.