NIS Directive

Goals of the NIS Directive and current outlook

The NIS Directive provides legal measures to boost the overall level of cybersecurity in the EU by ensuring member states’ preparedness. It requires them to be appropriately equipped in several ways, including Computer Security Incident Response Teams (CSIRT) and a competent national NIS authority.

Businesses in these sectors that are identified by the member states as Operators of Essential Services (OES) will have to take appropriate security measures and to notify serious incidents to the relevant national authority. Key digital service providers including search engines, cloud computing services and online marketplaces must also comply with the security and notification requirements under the new directive.

OES’s are public or private sector organizations that are dependent upon network and information systems to provide an essential service to society, which could be significantly disrupted by a cyber incident.

Although NIS is a relatively new regulatory requirement, many of its concepts have already been codified in existing compliance and best practice for industries including financial services and telecoms. In these industries, PKI has already been successfully deployed and widely supported, which has led to a high degree of interoperability. In telecoms for example, PKI is used to build chains of custody from the supplier of a network element where a device is ‘born’ to adoption into a network where the unit is used. For other sectors like cloud services, NIS has put cybersecurity and accountability in the limelight.

Investing in a competent PKI and code signing solution such as PrimeKey’s EJBCA and SignServer reduces the information security risks involved around NIS and related compliance regimes such as GDPR. This enterprise-wide capability reduces operation and maintenance costs compared to other point solutions, secures valuable business models and future-proofs organizations in all industries.

How PKI & code signing help meet NIS compliance

To meet the fundamental requirement under NIS for “appropriately authenticated and authorized” access, organizations need a method of defining and enacting controls that is both secure and can be deployed across disparate infrastructure and processes.

Public Key Infrastructure (PKI) is the most widely adopted form of technology for establishing the identity of people, devices, and services – enabling controlled access to systems and resources, protection of data, and accountability in transactions. PKI includes a set of hardware, software, policies, processes, and procedures required to create, manage, distribute, use, store, and revoke digital certificates and public keys.

Certificates are issued to entities such as users, devices, web servers, passports, smartcards and IoT devices. The provisioning of certificates to either devices or tokens enables two benefits. Firstly, it gives a device or a token an identity, and secondly, it provides the means to setup a secure encrypted communication channel. PKI and certificates deliver a method as required by the NIS directive to identify, trust and securely communicate with any entity throughout an entire organization, partners, and customers.

PKI also underpins technologies, such as digital signatures and encryption for use cases as diverse as e-commerce and the growing Internet of Things (IoT). Digital signatures can secure additional activities, such as signing PDFs, code or other information assets, to ensure the origin of the document/code or to ensure that a transaction was in place at a certain time. Digital Signatures can allow an organization to track who exactly performed the signature and at what time.

Critical controls

To meet these core criteria, every NIS compliant organization understands, documents, and controls access to systems and functions supporting the delivery of essential services. Users (or automated functions) that can access data or services should be appropriately verified, authenticated, and authorized.

In addition, users, devices, and systems should be appropriately authenticated and authorized before access to data or services is granted. For highly privileged access, NIS indicates that it might be appropriate to include approaches such as two-factor or hardware authentication. Unauthorized individuals should be prevented from accessing data or services at all points within the system. This includes system users without the appropriate permissions, unauthorized individuals attempting to interact with any online service presentation, or individuals with unauthorized access to user devices.

Administrative and technical solutions

For organizations to meet the obligations of NIS, the task can be separated into administrative and technical measures. Administrative measures are implemented through the accordance of security standards like ISO/IEC 27001 Information Security Management System (ISMS). These are supported by administrative actions and risk management measures including ongoing user training, security audits and ethical hacking to ensure security competency and to improve organization’s level of cyber readiness from both business and regulatory perspectives.

Technical solutions include the implementation and continuous development of cyber situational awareness solutions such as SIEM (Security Incident and Event Management), secure identity confirmation tools, and data communications security solutions. Only a combination of administrative and technical measures is enough to comply with the NIS authoritative requirements.