⊙ MIC Notification No. 2002-48
  In accordance with Article 13-4 of the Enforcement Regulations of the Electronic Signature, Rules on Accredited Certification Authority's Protective Measures are notified as follows.
November 15, 2002
Minister of the Ministry of Information and Communication

Rules on Accredited Certification Authority's 
Protective Measures

Article 1 (Object) The object of these regulations is to lay down details of the protective measures that certification authorities must take to ensure the safety of certificatory service facilities in accordance with Article 18-3 of the Electronic Signature Act and Article 13-4 of the Enforcement Regulations of the same Act.
Article 2 (Definition) Terms used in these regulations are defined as follows:
  1. “The "Accredited Certification Facilities" refer to the facilities necessary for certification practices that provide certification services in accordance with Clause 9 of Article 2 of the Electronic Signature Act.
  2. The "Accredited System" refers to the system essential for provision of certification services such as key generation, certificate generation, subscriber certificate registration, certificate and certificate revocation list notification, and time stamping.
  3. The "Safe Network Operating System" refers to the system for safe operation of the network, such as firewall and the intrusion detection system.
Article 3 (Protective Measures) The protective measures that certification authorities must take to ensure the safety of certification facilities are described in detail in the appendix.

Supplementary Provisions

① (Effective Date) These regulations will go into effect as of the date of announcement. 
② (Interim Measures) Measures relating to security guards among the protective measures including access control for certification facilities as described in appendix 2 will go into effect six months after these regulations are officially announced.

< Appendix >
1. Measures to protect certification facilities from electronic intrusions
Goal
	Item
	Subitem
	Description
	
Network

Protection
	Makeup
	Safe Network Operating System
	· The safe network operating system must be installed in accordance with Rules on Accredited Certification Authority's Facilities and Equipments.
	
	Management
	Network Lines
	· Separate network lines must be used to provide certification services.
	
		Safe Network Operating System
	· Only proper software must be installed in the safe network operating system.

· The safe network operating system must be set up and run safely.

 ­ The rules for the firewall system must be permitted only when they are essential for operation.

 ­ The database of the intrusion detection system must be updated periodically.

 ­ The network management system must be monitored continuously.

· Network logging must be analyzed periodically so that intrusion attempts and network loads can be identified and that appropriate measures can be taken.

· Logical access control must be established for safety of the network operating system.
	
		Addition/Revocation/Change
	· Matters concerning addition/disuse/change of the safe network operating system (router access list, firewall rule set change, etc.) must be recorded in the management log.

· The procedure must be prepared for addition/disuse/change of the safe network operating system.
	
System

Protection
	Makeup
	Server Management System
	· A system must be installed that is capable of checking whether the main programs or processes related to certification practice are functioning properly.
	
		Limiting Root Privilege
	· Software must be installed that is capable of limiting the privilege of the root manager.
	
	Management
	System Management
	· Only programs necessary for running the system must be installed.

 ­ What's not needed by the operating system must be deleted.

 ­ Latest patches must be installed to solve problems of the operating system.

· The accredited system must be kept in a secure cabinet with a lock, and the key to the lock must be kept in a separate box.

· Logical access control must be established for the system.
	
		Addition/Revocation/Change
	· Matters concerning the addition/disuse/change of the system (changing and disusing the operating system) must be recorded in the management log.

 ­ The name and purpose of all software installed in the system must be recorded.

· A detailed procedure must be prepared for addition/disuse/change of the system.

2. Protective measures for certification facilities including access control
Goal	Item	Subitem	Description	
Access Control 	Makeup	Access Control System	· The access control system and the access control devices must be installed in accordance with Rules on Accredited Certification Authority's Facilities and Equipments.	
		Security Guards	· There must be security guards 24 hours of the day.	
	Management	Access Control for Outsiders	· Security guards must use the CCTV or their eyes to monitor and manage the visits of all outsiders 24 hours of the day by means of CCTV.
· The visits of all outsiders must be recorded in the visitation log.
· All outsiders must be accompanied by one or more insiders when they enter the premises.
· No outsider should be allowed to enter the room where the accredited system is without proper authorization.	
		Access Control for Insiders	· Security guards must use the CCTV or their eyes to monitor and manage the visits of all outsiders 24 hours of the day by means of CCTV.
· No insider should be allowed to enter the room where the accredited system is without proper authorization.	
		Access Control System	· Access authorization to the access control system must be set up appropriately for the duty of each employee.
· Only authorized managers must be given access to the access control device setup and control function for the access control system.	
Detection/Surveillance of Physical Intrusion	Makeup	Intrusion Detection and Alarm System	· Intrusion detection and alarm devices must be installed in accordance with Rules on Accredited Certification Authority's Facilities and Equipments.
· The intrusion detection devices installed on the windows and the walls must be on for 24 hours of the day.	
		Monitoring System	· The intrusion monitoring system must be installed in accordance with Rules on Accredited Certification Authority's Facilities and Equipments.	
	Management	Intrusion Detection Alarm	· In case an alarm goes off, security guards must immediately identify the cause of the alarm, report to the security manager, and take appropriate actions according to the directions of the security manager.
· Only the security guards or the security manager must be allowed to cancel the intrusion detection alarm.
· The fact that the intrusion detection alarm went off must be recorded in the log.	
		Monitoring	· Only the authorized manager must be given access to the CCTV setup and control function of the CCTV monitoring system.
· The CCTV system recording log must be backed up at least once a month.	

3. Measures to ensure the continuous and stable operation of certification facilities against various threats such as fire and flooding
Goal	Item	Subitem	Description	
Disaster Prevention	Makeup	Fire	· Fire detection and fire extinguisher must be installed in accordance with Rules on Accredited Certification Authority's Facilities and Equipments.	
		Others	· Disaster management devices other than those for fire must be installed in accordance with Rules on Accredited Certification Authority's Facilities and Equipments.	
	Management	Fire
	· Fire fighting equipments must be inspected at least once every quarter.
· The receiving and control board of fire detection equipments must be inspected at least once a quarter.
· The fire extinguishing agent of the gas-type fire extinguisher must be replaced regularly.
· Employees must be aware of how to use the portable fire extinguisher.	
		Flooding	· For protection from flooding, the accredited system must be installed at least 30cm from the floor.	
		Earthquake	· For protection from an earthquake, the accredited system must be kept in a security cabinet.	
		Others	· The grounding for various power supplies must be inspected at least once a year.	
System Failure Prevention	Makeup	Power Failure	· Uninterruptible power supplies must be installed in accordance with Rules on Accredited Certification Authority's Facilities and Equipments.
· Independent power generators must be installed in accordance with Rules on Accredited Certification Authority's Facilities and Equipments.	
		Constant Temperature & Humidity	· Constant temperature & humidity conditioners must be installed in accordance with Rules on Accredited Certification Authority's Facilities and Equipments.	
		Network Redundancy	· Network lines and network devices must be redundant and installed in accordance with Rules on Accredited Certification Authority's Facilities and Equipments.	
		System Redundancy	· The accredited systems must be redundant and installed in accordance with Rules on Accredited Certification Authority's Facilities and Equipments.	
	Management	Power Failure	· UPS must be inspected at least once a quarter.
· The batteries for UPS must be replaced regularly.	
		Constant Temperature & Humidity	· Constant temperature and humidity conditioners must be inspected at least once a quarter.	
		Network Redundancy	· Redundant network lines must be automatically switchable in case of a failure.
· Internal network devices and routes must be automatically switchable in case of a failure.	
		System
Redundancy	· Redundant accredited systems must have the same operating system, the same patches, and the same software to perform the same functions
· The data or database of the redundant systems must be coherent.	
		Backup	· The  accredited system must be regularly backed up to a storage device other than a  hard disk.
 ­ The online accredited system must be backed up at least once a week.
 ­ The offline accredited system and other systems must be backed up at least once a month.
· A copy of the backup data must be stored on the main site and in a remote location at least 10Km away (or a backup site).	

4. Managerial measures to ensure the safety of other certification facilities
Goal	Item	Subitem	Description	
Human Security	Makeup	Supervisor	· A supervisor must be appointed to be in charge of planning, supervising and controlling all protective measures.	
		Security Manager	· A security manager must be appointed who carries out all protective measures 	
		Security Staff	· There must be one or more professional staff members in charge of system management and network management of main facilities (with over 2 years of experience in related fields).	
	Management	Education	· The supervisor must take necessary measures like internal education to make sure that employees are fully aware of the details of protective measures.
· The supervisor must ensure that the security manager, the security staff members, and the employees managing the accredited system management will receive internal or external education on information security at least once a year.	
		Personnel	· The employee who manages the accredited system must sign a confidentiality agreement.
· If changes in the working environment require modification and supplementation of the protective measures, the supervisor must review them and make necessary supplementation immediately.
· If the employee managing the accredited system moves to a different department or retires, necessary measures must be taken according to internal regulations by, for example, deleting the account and returning storage devices.	
Effective Management of Emergency Situations	Makeup	Emergency Plan	· Emergency plans and disaster recovery plans must be made to effectively cope with an emergency such as a disaster and intrusion.	
	Management	Emergency Measures	· Employees managing the accredited system must take immediate reactions in accordance with emergency plans in case of an emergency situation like a disaster or intrusion.	
Logging	Management	Logging	· The following logs must be kept for at least 2 years from the date of backup.
 ­ Network logging
 ­ Audit records concerning accesses to the access control system
 ­ Intrusion detection alarm logs
 ­ CCTV system logs	
		Management Log	· The following management logs must be kept for at least 2 years from the date of recording.
 ­ Network system management log
 ­ Accredited system management log
 ­ Access log for outsiders	
Audit	Management	Audit Trail	· The supervisor must back up the audit trail of the accredited system to a storage device other than a hard disk at least once a month.
· The integrity of the backup audit trail must be ensured.