| 1 |
Foreword
To ensure that the information and communication systems provided by a futures commission merchants possess consistent fundamental system security protection capabilities, these Operating Procedures are established to identify information security threats and vulnerabilities through various information and communication security assessment operations. The aim is to implement both technical and managerial control measures to improve and enhance the security protection capabilities of networks and information and communication systems.
|
| 2 |
Scope of Evaluation
- Futures commission merchants shall, in accordance with the "Establishment of an Information and Communications Security Inspection System for Futures Commission Merchants," develop an assessment plan for their overall information and communication systems (including self-developed and outsourced systems) on the basis of these Operating Procedures. To ensure business continuity and protect client rights and interests, futures commission merchants shall classify information assets according to their importance and impact level, conduct information and communication security assessments regularly and by classification, present an "information and communication system information and communication security assessment report," implement corrective and preventive measures, and perform regular follow-up reviews. A foreign futures commission merchants may follow its own information security checkup operating rules if they are better; otherwise, they shall comply with domestic regulations. Futures commission merchants operating on a concurrent basis shall follow the rules applicable to their primary line of business; in the absence of such rules, these regulations shall apply.
- The assessment plan and results shall be submitted to the board of directors or approved by a managerial department authorized by the board, provided in the event of a Taiwan branch of a foreign futures commission merchants, such may be carried out by the responsible person of the branch. The assessment plan shall be reviewed at least once every three years.
|
| 3 |
Classification and Assessment Cycle of Information and Communication Systems
- Information and communication systems are classified into three categories based on their importance:
（Please refer to the attachment）
- Testing may be conducted by sampling where the equipment comprise a multitude of systems and the economic rights of such equipment are owned by the company. The sampling rate shall be at least 10% of all the equipment in the system or a minimum of 100 units each time.
- Where a material information and communication security incident occurs in a single system and is confirmed to constitute a personal data breach or a hacker attack, an information and communication security assessment must be re-conducted and completed within three months.
|
|
Attachment
|
| 4 |
Information and Communication Security Assessment
- Information architecture review
- Review the network architecture configuration, appropriateness of the information equipment security management rules etc., to assess potential risks and take necessary countermeasures.
- Review the maximum impact of single points of failure and risk-bearing capacity.
- Review the adequacy of measures taken in connection with business continuity.
- Timely refer to information security threat intelligence and protection recommendations published by the Financial Information Sharing and Analysis Center (F-ISAC) and implement relevant measures.
- Review whether servers are segmented by network segments according to the classification of information and communication systems, system functions, or service characteristics.
- Review whether boundary protection equipment (including gateways, routers, firewalls, protective devices etc.) and external network connection points have firewalls to control data transmission and resource access between the intranet and the internet, and restrict unnecessary connected parties and connection services.
- Network activity review
- A.Review access logs and account authorizations for network equipment, servers, and IoT equipment to identify anomalies and verify alert mechanisms.
- Review monitoring logs of information security equipment (such as firewalls, intrusion detection or prevention systems, anti-malware, data leakage prevention, spam filtering, phishing detection, web protection etc.) to identify anomalies and verify alert mechanisms.
- Examine the network for abnormal connections or unusual Domain Name System Server (DNS Server) queries, or monitor incoming and outgoing traffic, and cross-check against known malicious IPs, proxy servers, or patterns consistent with malicious network behavior.
- Review whether measures are established for detecting and handling counterfeit websites.
- Inspection of network equipment, servers, endpoint and communication, and IoT equipment etc.
- A.Conduct vulnerability scanning and remediation operations for network equipment, servers, endpoint equipment, and IoT equipment etc.
- Inspect terminals and servers for the presence of malware.
- Inspect the complexity of system account login passwords; review the storage protection mechanisms and access controls for external connection passwords (such as File Transfer Protocol (FTP) connections, database connections etc.).
- When performing IoT equipment inspections, follow the Establishment of an Information and Communications Security Inspection System for Futures Commission Merchants.
- The following shall be carried out in regard to network equipment, servers, and IoT equipment etc. that are accessible directly from the internet:
- A.Conduct penetration testing.
- Perform source code scanning or black-box testing of server application systems.
- Review access authorizations for server directories and web pages.
- Verify whether anti-tampering mechanisms for external websites and web pages are established.
- Inspect the systems for abnormal authorized connections, unusual CPU resource consumption, and anomalous database access activities etc.
- Client-side application testing
Futures commission merchants and client-side applications shall use encrypted connections. The following tests shall be conducted on applications delivered by futures commission merchants to clients:
- Vulnerability scanning where HTTPS or SFTP is provided.
- Source code scanning or penetration testing.
- Sensitive data protection testing (such as memory, storage media).
- Key protection testing.
- Implementation of the principle of least privilege, allowing users only the authorized access and control necessary to perform their assigned tasks and business functions.
- Security configuration review
- Review server settings (such as Active Directory) related to password principles and account lockout principles.
- Examine whether the firewall has security-risk ports or unnecessary ports open, and whether connection settings have security vulnerabilities.
- Review system access restrictions (such as Access Control Lists) and privileged account management.
- Examine update settings and status of operating systems, antivirus software, office software, and application software etc.
- Review security measures for key storage protection mechanisms and access controls etc.
- Verify that user identity is authenticated in the event of connection from the internet to the company's intranet.
- Measures against breaches of the reliability and security of information and communication systems:
- The company shall develop relevant countermeasures to enhance the reliability of its information and communication systems. These measures shall include:
- Enhancing hardware reliability: Including countermeasures to prevent hardware failures and the setup of backup hardware equipment.
- Enhancing software system reliability: Including measures to improve software development quality and software maintenance quality.
- Measures to improve operational reliability.
- Early detection and early recovery measures against failures.
- Disaster response measures.
- A verification plan must be established for system backup media for backups, and the reliability of the backup media and the integrity of information must be validated.
- The company shall develop relevant countermeasures against information and communication security breaches. These measures shall include:
- Data protection: Including measures to prevent leakage, or destruction or tampering, along with corresponding testing measures.
- Prevention of illegal use: Including access authorization verification, restriction of application scope, prevention of illegal forgery, limitation of internet access, and detection and response measures.
- Prevention of illegal applications: Including defense, detection, and recovery measures.
- Review whether the information and communication systems comply with the requirements of the Establishment of an Information and Communications Security Inspection System for Futures Commission Merchants and related directives of competent authorities.
Category I, Category II, and Category III information and communication systems shall all be incorporated into the information security assessment procedure based on the assessment items mentioned in the preceding paragraph, to ensure the effectiveness of the assessment.
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|