Flowmon Helps to Comply Various Cybersecurity Regulations

What is the Kingdom of Saudi Arabia’s Cyber Security Regulation?

The National Cybersecurity Authority (NCA) established as part of the Kingdom of Saudi Arabia’s 2030 Vision is the central authority responsible for overseeing cybersecurity in Saudi Arabia. It plays a crucial role in formulating policies, guidelines, and regulations to protect critical infrastructure and mitigate cyber threats. Its mandate was approved as per the Royal Decree number 6801, dated 11/2/1439H making it the national and specialized reference for matters related to cybersecurity in the Kingdom.

NCA Developed 3 Main Cybersecurity Controls within Years 2018 – 2020:

NCA developed 3 main cybersecurity controls within years 2018 – 2020:

1. ECC (1:2018): Essential Cybersecurity Controls are a set of guidelines and requirements issued by the NCA. These controls provide a framework for organizations to enhance their cybersecurity posture and protect critical information infrastructure. They cover various aspects of cybersecurity, including governance, risk management, access controls, incident response, and security monitoring. It contains:
   1. 5 Cybersecurity Main Domains
   2. 29 Cybersecurity Subdomains
   3. 114 Cybersecurity Controls

   Subject Regulated Entities (SREs) are the entities that are subject to the Essential Cybersecurity Controls in Saudi Arabia. SREs include:

   1. Critical Infrastructure Operators: These are entities that operate and maintain critical infrastructure sectors such as energy, water, transportation, healthcare, finance, and telecommunications. Examples of critical infrastructure operators include power plants, airports, hospitals, banks, and telecommunications providers.
   2. Government Agencies: Government entities at the federal and local levels are also considered subject regulated entities. This includes ministries, agencies, and other government organizations that handle sensitive information or provide critical services.
   3. Digital Service Providers: Certain entities that provide digital services are subject to the Essential Cybersecurity Controls. These include cloud service providers, managed security service providers, domain registrars, and other entities involved in the provision of digital services.
2. CSCC (1:2019): Critical Systems Cybersecurity Controls as an extension of ECC specifically tailored to safeguard critical systems and infrastructure. These controls aim to protect critical infrastructure sectors such as energy, water, transportation, healthcare, finance, and telecommunications against cyber threats. CCC consists of the following:
   1. 4 Main Domains
   2. 21 Subdomains
   3. 32 Main Controls
   4. 73 Sub-Controls

   Subject Regulated Entities (SREs) in the context of Critical Systems Cybersecurity Controls typically include organizations and entities that own, operate, or are responsible for critical systems and infrastructure. The specific entities can vary, but commonly regulated entities can include:

   1. Critical Infrastructure Operators: Entities operating critical infrastructure sectors such as energy, water, transportation, healthcare, finance, and telecommunications are subject regulated entities. Examples of critical infrastructure operators include power plants, oil refineries, water treatment facilities, transportation networks, and healthcare providers.
   2. Government Agencies: Government entities at the federal and local levels that are responsible for critical systems and infrastructure are subject to the Critical Systems Cybersecurity Controls. This includes ministries, agencies, and other government organizations that handle critical systems, such as defense systems or emergency services.
   3. Industrial Control Systems (ICS) Operators: Organizations that own or operate industrial control systems used in critical infrastructure or industrial processes are subject regulated entities. These systems include supervisory control and data acquisition (SCADA) systems, distributed control systems (DCS), and other operational technology (OT) systems.
3. CCC (1:2020): Cloud Cybersecurity Controls as an extension of ECC contains specific guidelines and controls for ensuring the secure adoption and usage of cloud services in Saudi Arabia. These controls focus on protecting sensitive data and mitigating the risks associated with cloud computing. It consists of the following:
   1. 4 Main Domains
   2. 24 Subdomains
   3. 37 Main Controls for CSPs and 18 Main Controls for CSTs
   4. 96 Sub-Controls for CSPs and 26 Sub-Controls for CSTs

   Subject Regulated Entities (SREs) in the context of Cloud Cybersecurity Controls typically include organizations and entities that utilize cloud services. The specific entities can vary, but commonly regulated entities can include:

   1. Cloud Service Providers (CSPs): Cloud service providers that offer services in Saudi Arabia are also subject regulated entities. These are the entities that provide cloud infrastructure, platforms, or software services to customers. They are required to comply with the Cloud Cybersecurity Controls to ensure the security of their cloud offerings.
   2. Cloud Service Tenants (CSTs): Any government organization in the Kingdom of Saudi Arabia inside or outside the Kingdom (including ministries, authorities, establishments and others) and its companies and entities, as well as private sector organizations owning, operating or hosting Critical National Infrastructures (CNIs) that currently use or planning to use any cloud service.

Structure of Cybersecurity Controls?

Cybersecurity controls defines key objectives must be focused on in order to protect the organization’s information and technology assets – Confidentiality, Integrity and Availability. These controls take into consideration the following four main cybersecurity pillars – Strategy, People, Processes and Technology.

Structure definition of all Domains, Subdomains, Controls and Sub-Controls contains these fundamental measures need to be implemented and be following NCA regulations:

1. Cybersecurity Governance
2. Cybersecurity Defense
3. Cybersecurity Resilience
4. Third-Party (and Cloud Computing) Cybersecurity
5. ICS Cybersecurity

I Am SRE. What Does these Regulations Mean for Me?

As an SRE means that you are subject to specific cybersecurity requirements designed to protect your infrastructure from cyber threats. The regulation requires you to implement appropriate security measures to prevent cybersecurity incidents and to report significant incidents that occur to the NCA and The ECC requires the appointment of a “Competent Person” to ensure the organization’s cybersecurity strategy is full in compliance with these regulations.

1. Cybersecurity measures – Although the measures within the framework of ECC and their extension CSCC and CCC are similar, they differ in structure and designation, and in some cases, they also differ in individual measures.
   1. Essential Cybersecurity Controls (ECC):
      1. Risk Assessment and Management: Organizations are obliged to conduct risk assessments to identify potential cybersecurity risks and vulnerabilities. They must develop risk management processes and implement appropriate controls to mitigate these risks effectively.
      2. Incident Response and Reporting: Organizations are required to establish incident response plans and procedures to detect, respond to, and recover from cybersecurity incidents. They may be obligated to report significant incidents to the National Cybersecurity Authority (NCA) or other regulatory bodies.
      3. Access Controls and Authentication: Organizations must implement robust access controls and authentication mechanisms to ensure that only authorized individuals can access systems and sensitive data.
      4. Security Monitoring and Logging: Organizations should have mechanisms in place to continuously monitor and log security events and incidents. This helps in detecting and responding to potential threats in a timely manner.
      5. Employee Awareness and Training: Organizations are encouraged to provide cybersecurity awareness and training programs to their employees to enhance their understanding of cybersecurity risks and best practices.
   2. Critical Systems Cybersecurity Controls (CSCC) as an extension to ECC based on Critical Systems Identification Criteria:
      1. System Segmentation and Access Controls: Organizations operating critical systems are obligated to implement network segmentation and access controls to protect these systems from unauthorized access and potential exploitation.
      2. Identity and Access Management: Robust identity and access management measures must be in place to ensure that only authorized individuals can access critical systems.
      3. Physical Security Measures: Organizations should implement physical security measures to protect critical systems and infrastructure from physical threats and unauthorized access.
      4. Threat Intelligence Sharing: Organizations operating critical systems are encouraged to collaborate and share threat intelligence to enhance their cybersecurity readiness and response capabilities.
   3. Cloud Cybersecurity Controls (CCC) as an extension to ECC:
      1. Data Protection and Privacy: Organizations utilizing cloud services must ensure the protection and privacy of sensitive data stored or processed in the cloud. Measures such as encryption and access controls should be implemented.
      2. Secure Configuration of Cloud Services: Organizations are obliged to configure cloud services securely to minimize vulnerabilities and risks.
      3. Incident Response and Recovery in Cloud Environments: Organizations must have specific incident response and recovery plans for cloud-based incidents, ensuring effective handling and recovery from security breaches or disruptions.
      4. Continuous Monitoring of Cloud Environments: Organizations should establish mechanisms to continuously monitor the security of their cloud environments to detect and respond to potential threats promptly.
2. Audit – NCA evaluates organizations’ compliance with the ECC through multiple means such as self-as- sessments by the organizations, periodic reports of the compliance tool or on-site audits.

How Can Flowmon Help You Ce ECC (CSCC, CCC) Compliant

How can Flowmon help you be ECC (CSCC, CCC) compliant
Flowmon is a comprehensive intelligent network security monitoring solution that provides real-time visibility into network traffic and helps organizations detect cyber threats and respond to cyber incidents. All these regulations require (2) Cybersecurity Defense as an important domain to leverage overall SREs (3) Cybersecurity Resilience, (4) Third-Party and Cloud Computing Cybersecurity and (5) Industrial Control Systems (ICS) Protection.

Here's how Flowmon can help you achieve (2) Cybersecurity Defense Domain compliance trough main approaches like Threat Detection and Threat Hunting, Incident Response and Digital Forensics, Hybrid Cloud Monitoring and Encrypted Traffic Analysis and Root Cause Analysis and Performance Monitoring in single pane of glass for:

1. Subdomain Networks Security Management ensures the protection of organization’s network from cyber risks. Flowmon provides continuous monitoring and compliance audit if all controls are implemented in proper way, detection of behavioral anomalies, attacks, suspicious and malicious traffic communication and security policies violation within Controls 2-5-3 (ECC), 2-4-1 (CSCC) and 2-4-P-1 (CCC).
2. Subdomain Information System and Information Processing Facilities Protection within CSCC and Sub-Controls 2-3-1-4 requires allocating specific workstations in an isolated network (Management Network), that is isolated from other networks or services (e.g., email service or internet), 2-3-1-5 requires encrypting the network traffic of non-console administrative access for all technical components of critical systems and 2-3-1-8 requires protecting systems' logs and critical files from unauthorized access, tampering, illegitimate modification and/or deletion.
   
   Flowmon continuously monitor critical assets and services, their network communications to ensure network segmentation is deployed properly. Moreover trough Encrypted Traffic Analysis (ETA) capabilities monitor ciphers suites, certificates or types of key algorithms. If any lateral movement of attacker inside critical infrastructure is happening, Flowmon detects unexpected behavior in real time, analyzes in autonomous way and responds immediately.
3. Subdomain Cryptography ensures the proper and efficient use of cryptography to protect information assets as per organizational policies and procedures regarding these regulations. Flowmon is able to monitor, check and audit if requested cryptography is used per organization, network segment, critical assets or services within Control 2-8-2 (ECC) and Sub-Controls 2-7-1-1 (CSCC), 2-7-P-1-1 and 2-7-T-1-1 (CCC).
4. Subdomain Cybersecurity Event Logs and Monitoring Management ensures timely collection, analysis and monitoring of cybersecurity events for early detection of potential cyber-attacks in order to prevent or minimize the negative impacts. As Flowmon is using mainly for network monitoring of cybersecurity events (attacks, misconfigurations, user or network suspicious behavior, vulnerabilities, outages etc.) which forward within aggregated form directly to SIEM for advanced correlation. That helps to comply with Sub-Controls 2-12-3-3, 2-12-3-4 (ECC), 2-11-1-3, 2-11-1-4 (CSCC) and 2-11-P-1-5 (CCC). Moreover, Flowmon provides the most powerful IPFIX Collectors for long term data retention period which require Sub-Control 2-12—3-5 for 12 months (ECC) and Control 2-11-2 for 18 months (CSCC).
5. Subdomain Cybersecurity Incident and Threat Management ensures timely identification, detection, effective management and handling of cybersecurity incidents and threats to prevent or minimize negative impacts. This is all about incident handling and response procedures where Flowmon plays crucial role in many phases related standards like NIST. It helps to be compliant with Sub-Controls 2-13-3-3, 2-13-3-4, 2-13-3-5 (ECC) and 2-12-P-1-4, 2-12-P-1-5, 2-12-P-1-6 (CCC). Developing incident response plans is part of Sub-Control 3-1-3-2 (ECC).

USE OUR SLIDE NIST INCIDENT REPONSE CYCLE

Although there are no penalties set out in the ECC all SREs must report all significant incidents to NCA (as a cybersecurity competent authority within Kingdom of Saudi Arabia) responsible also for education, training, and raising awareness about cybersecurity through establishing affiliated centers.

Download a Compliance & Regulatory for Saudi Arabia Datasheet