Customs Declaration Processing System Detailed User and ...

DETAILED USER & TECHNICAL REQUIREMENTS FOR CDPS
AND USE-CASE MODELS
Ref: PHASE V
Number
SR-0360
SR-0370
SR-0380
SR-0390
SR-0370
SR-0380
SR-0390
SR-0395
Description
CDPS shall support the use of digital certificates for user authentication. CDPS
shall keep a copy of the public keys of such digital certificates in its own
repository.
CDPS shall support the creation and verification of digital signatures based on
the use of digital certificates.
CDPS shall check the validity of digital certificates:
• Check if the certificate is issued by an authorized Certificates Issuing
Authority.
• Check if the certificate has not expired.
• Check if the certificate has not been revoked.
CDPS shall keep a copy of public keys of expired digital certificates. This will
allow for verification of digital signatures calculated in the past when the digital
certificate was still valid.
The system should lock a user account if 3 consecutive unsuccessful
authentication attempts are made (wrong password was submitted for 3
consecutive times). The user should not be able to log in the system when its
account is locked. The account should be locked for a given period (at least 30
minutes) of time and can be unlocked before this period only by user with
special access rights (system administrator). There should be a possibility for
configuring the locking period through a system configuration parameter.
For security reasons user passwords should expire in a given period of time. The
expiration period should be configured through a system configuration
parameter. The user should not be able to log in the system if the password is
expired. The system should prompt the user to change its password if it is
expired. The system should not allow the user to reuse its previous passwords.
User passwords shall satisfy minimum complexity requirements. For example,
user passwords should be at least 6 characters long and should contain at least
one digit or a non-alphanumeric character.
CDPS must support single sign-on technology through LDAP (Lightweight
Directory Access Protocol) communication with the Active Directory already
implemented within MCA.
Table 10: General security requirements
5.2.5.2.1Common Domain Specific Requirements
This chapter provides the additional security requirements for CDPS related to Common Domain.
These requirements will need to be satisfied prior to the accession of Macedonia to EU. Security
requirements should be implemented as recommended in the [A07]
Number
Description
SR-0400 The “Security Policy Document” [A07] principles must be implemented.
SR-0410 If a National Host is connected to a public network, a firewall should be put in
place.
SR-0420 Strong authentication CSI service should be used for the connection between a
National Host and the CCN/CSI Gateway if it occurs through a public network
and no firewall is used.
SR-0430 In compliance with the DDNA (i.e. DDCOM, DDNTA, DDNXA, and DDNIA)
specifications, all Common Domain messages must be acknowledged by their
corresponding answer message or by an acknowledgement message.
SR-0440 The NDI-WS workstation (internet workstation) must be physically
Page 143/276