Customs Declaration Processing System Detailed User and ...

DETAILED USER & TECHNICAL REQUIREMENTS FOR CDPS
AND USE-CASE MODELS
Ref: PHASE V
5.2.5.1.3Authentication and Digital Certificates
As explained above, user authentication can be done with (i) username and password, and (ii)
digital certificates.
For the external domain it is strongly recommended that digital certificates are used for user
authentication.
Users from the external domain can use the same digital certificates for digital signatures too.
Digital signatures prove the origin and integrity of data, and also provide non-repudiation security
service. According to the Macedonian law [R18], digital signatures have the same validity as handwritten
signatures. Digital certificates need to be issued by a certified Certificates Issuing Authority,
such as Komercijalna Banka AD Skopje, KIBS AD Skopje, AD Makedonski Telekomunikacii,
GlobalSign, Verisign.
Each user must sign a document which contains the public key from his/her digital certificate. Prior
to any data exchange between CDPS and any application from the External Domain it is necessary
that MCA and the partners from the External Domain exchange the public key from their digital
certificates.
The digital certificate must be stored on a tamper-proof security device from which it cannot be
copied.
5.2.5.2 Requirements
This section highlights the security requirements for CDPS..
Number
SR-0010
SR-0020
SR-0030
Description
MCA must provide and guarantee the security of each CDSP module, e.g. by
deploying firewalls.
CDPS has to take the following security policies into account:
• The IT and non-IT CDPS resources and assets must be protected from
unauthorised access.
• Precautions must be taken to ensure that confidential information is erased
from CDPS applications and tools as soon as it is no longer required.
• Controls should be implemented to ensure that information supplied to
CDSP systems and tools is accurate and consistent with other information
stored elsewhere in CDPS;
• Data that is passed between two processing stages, does so without
alteration, loss, or addition;
• The CDPS architecture must be designed and managed so as to ensure
continuity of service;
• Controls must exist to limit the impact of a Denial of Service attack mounted
against any CDPS resources;
• Transit information should be exchanged only between entities that have
been mutually authenticated;
• Information that is exchanged should be protected from unauthorised
disclosure, loss, or alteration.
The requirements of particular importance concern (a) maintaining the
confidentiality of confidential information regarding Trader and Guarantor
relationships, (b) user identification and authentication information, and (c)
information which may facilitate fraud.
The following security policies, deduced from the [A07], are relevant:
• All IT users must be uniquely identifiable;
Page 140/276