Data service owner verification questions¶
Security checklist¶
The following control questions will help you understand the important elements for a secure X-Road interface.
| Control question | What is the danger here? |
|---|---|
| Do you have a hosting agreement with the owner of the security server? | There may be a lack of a common understanding, for example, about guaranteed availability of a security server, responding to incidents during off-hours, and so on. A hosting agreement helps to establish key points between the data service owner and the security server owner. For example, security server availability and SLA, and notification of maintenance work. Hosting agreements may not be necessary if the data service owner and the security server owner are both in the same institution. |
| Does your application communicate with a security server over HTTPS using mTLS? | If mTLS is not used, the security server does not validate that the incoming request was sent by the correct application and not by a malicious attacker. If mTLS is not used, the application will not validate that the response sent to it was sent by the security server you used, and not by a malicious attacker. If HTTPS is not used, the traffic between the application and the security server is unencrypted and insecure. |
| Do you have a data service usage agreement with your data service customers? | If the terms of use of a data service are not fixed between the parties, then sufficient security measures may not have been implemented to ensure the integrity and confidentiality of the data provided. As a result, data in your information system may be leaked or misused. NB! Article 19, Paragraph 2 of the RA Law on Public Information requires the provision and use of data services in accordance with the data service use agreement between members. |
| Do you have contact information for your data service customers stored? | Without contact information for data service customers, it may not be possible to notify them if there is a data service failure or maintenance work is taking place. Contact information is important so that you can quickly contact your customers in times of crisis. |
| Do you have an agreed-upon procedure for storing message logs with the owner of the security server? | In the absence of an agreement, message logs may not be stored for a sufficient period of time. For example, you may need message logs for the last 3 years, but the owner of the security server has configured storage for only 1 year. Message logs can be used to prove the use of a data service and the transmission of information/data shared by the data service. This may be important if a legal dispute arises in connection with the use of the data service. |
| Is your application or information system software regularly updated? | If an information system or application interfaced with X-Road contains security vulnerabilities (e.g. outdated libraries or other software), the information system/application may be compromised. This can lead to data leaks, loss of integrity, and other problems that can have very serious consequences for the data service provider and data service customers. |
| Are your X-Road subsystems and their contacts described in the ADEL environment? | If your X-Road subsystems do not have contact details, your data service customers or ADEL support may not be able to contact you quickly if a serious problem occurs. Describing information about X-Road subsystems helps give yourself and other ADEL members a clear overview of what your subsystem is designed for. |
| Are the data services you offer described in the ADEL environment? | If your data services are not described in the ADEL environment, people interested in data services may contact you with questions that can be prevented by describing them. Additionally, the ADEL environment is a good place to add documents and attachments related to data services. For example, a data service usage agreement document. |