Module-System Security
Req. ID
SS 1.1
Functionality
Tracking key
system
accesses
Description
Criticality
The system must be capable of generating Essential
log trails, which contain details about any
read / write access to sensitive data. Details
must relate activity to an identifiable person.
They must be configurable, so that filters and
switches can be used to lower
performance overheads and focus on areas of
concern. It is important that the audit trail that
is generated contain enough information to
support after-the- fact investigation of loss or
impropriety.
SS 1.2
Time-stamp
Where equipment uses a real-time clock to
Essential
based auditing timestamp audit and other time related events,
method
the clock should be regularly checked for
synchronization with both connected systems
and reference clock outside of the system, in this
case the Indian Standard time. For daily
reporting, this would ensure that the reports
generated have some sanity given continuous
data input
SS 1.3
Exception
reporting
Where the security audit trail becomes
unavailable for any reason, the system shall
continue to operate but will trigger an alarm.
Action shall be taken as soon as possible to
rectify the situation.
Vital
SS 1.4
Detailed
System and application use and attempted use
Essential
system access will be monitored to ensure that the integrity and
tracking
maintained. The documented process shall
include details of: who will monitor what event
and how, the frequency of monitoring, what to do
when suspicious activity is noted, when to
escalate and the escalation path. All events
logged in the audit data shall be taken into
account when deciding what to audit and the
appropriate actions to take. The log must record
the user or process responsible for the event,
terminal ID where available, and the date and
time of the event The following shall be
monitored :-
SS 1.4 a
Enabling and disabling of the audit process
Essential
SS 1.4 b
Any changes to the type of events logged by the Essential
audit trail
SS 1.4 c
Any changes to the audit trail itself
Essential
SS 1.4 d
Start up parameters and any changes to them
Essential
SS 1.4 e
System or application start-up and shut-down
Essential
SS 1.4 f
Use of selected transactions
Essential
SS 1.4 g
Changes to any of the data base or records
Essential
SS 2.2
Version
consistency
checks
Mechanisms should be in place to ensure that the Essential
currently installed software has remained
consistent with the delivered product.
SS 2.7
Time stamping Software used on systems/ applications shall be Essential
modifications subject to version and change control to ensure
that only the current authorized software is used
at all user location.
SS 5.1
Documentation System developers responsible for customization Essential
of risks and its should consider and document the risks and
mitigation
associated mitigation in the design.
strategy
SS 5.2
Installation and Developers will document instructions on how the Essential
configuration system is to be delivered, installed and
configured in a secure manner. Developers will
document instructions on how the system is to
be delivered, installed and configured in a
secure manner.
SS 5.3
Startup
Developers will document instructions for the Vital
documentation secure start-up, re-start and operation of the
system.
SS 5.5
Scope control
SS 5.6
Software
A mechanism for controlling software changes
Essential
change control during development shall be implemented. This
mechanism shall as a minimum ensure that : a)
The change is reviewed by appropriate groups
prior to authorization, b) Changes are properly
authorized prior to implementation, c) All
change requests are logged. d) All associated
documentation is altered along with the
software change. e) Version control records are
maintained.
Vendor supplied software packages must not be
modified outside of the scope recommended by
the Purchaser.
Essential
SS 5.8
Module and
All new and modified software to be used on
Essential
product testing system/application shall first be tested by expert
personnel to ensure that the software have been
subjected to the rigor of test and thereby - a)
Does not introduce added security risks b)
Functions according to design specifications c)
Does not adversely affect the operation of the
system d) Introduces no unauthorized
system changes.
SS 6.1
XML based
Web security
schemas
As web services have certain limitations with SSL Essential
type of security scheme, the web service
technology shall be used with different XMLbased security schemes. Some of the XMLbased securities include the following: - WSSecurity XML digital signature XKMS
Specifications) SAML Language) ebXML Message
Service The bidder shall ensure content
security, message level security and secure
message delivery, meter data security policy,
trust management and secure public key
infrastructure while implementing web services
using appropriate web security mechanism,
which must be W3C/ OASIS compliant.
m Security
Status
TPIEA-IT Remarks
Utility Remarks
Partially In MDAS meter reading logs are
Available generated however no such audit
trails logs are generated
Partially In MDAS does not has any audit
Available trail logs
Partially IN MDAS audit trails are not
Available generated only meter based logs
are generated which shows failure
if meter is not read and
Functionality of exception
reporting of gis is not
demonstrated
Partially In MDAS access based tracking is
Available not available
Partially
In MDAS, GIS there is no option
Available for enabling and disabling of the
audit trails
Partially In GIS and MDAS no such
Available functionality is demonstrated by
utility
Partially No such records are available in
Available GIS and MDAS
Partially No such functionality is
Available demonstrated by utility in GIS and
MDAS
Partially No such functionality is
Available demonstrated by utility in GIS and
MDAS
Partially No such logs are available in MDAS
Available and GIS
Partially Functionality not demonstrated by
Available utility in MDAS and GIS
Partially MDAS and GIS application is not
Available fully complaint with there versions
Partially No such time stamp modification
Available records are demonstrated in GIS
and MDAS
Partially No risk analysis document
Available provided by utility from GIS
system
Partially No installation document is
Available provided from GIS system
Partially No document is provided from
Available Utility
Partially In MDAS go live is not done till
Available date so there is no version up
gradation
GIS team also not given any
version control records
Partially In MDAS go live is not done till
Available this date so there is no version up
gradation
GIS team also not given any
version control records
Partially Utility has not provided test
Available case /UAT document
Partially Web security is not W3C
Available compliant