3.1. DATA ENCRYPTION METHODOLOGY
Encryption is the conversion of electronic data into a form, called cyphertext/ciphertext that cannot be easily understood by unauthorized people. The primary purpose of encryption in the Visa Biometrics system is to protect the confidentiality of electronic data of the applicants stored on computer systems and transmitted via the internet and other computer networks to the data center. The security assurance of the Visa Biometric system must therefore be guaranteed by the presence of the following key elements against which the Assessor must conduct checks.
- Authentication: assessor must determine whether the source of an application received within the system can be verified.
- integrity: proof that the contents entered by an applicant have not been changed since the application was made.
- Non-repudiation: the applicant cannot deny making the application.
The Assessor must confirm what encryption package has been installed e.g. SSH, S/MIME and SSL/TLS. Issues related to the number of hacks will help the Assessor determine whether hackers are using brute force; trying every key to hack until the right one is found. Frequency of hacking will determine whether or not to advise installation of longer keys since encryption strength is directly tied to key size.
3.2. DATA BACKUP RECORD
This requirement is to ensure that sensitive data are duplicated and saved in remote locations in case anything goes badly wrong with the visa storage device. There are variety of ways data stored can be lost unexpectedly, namely: computer crashes, virus infection, hard drive failure, physical damage to the equipment, theft, etc. The Assessor must demand to know how the Visa Platform data is backed up. It is important to know whether it is an automatic online backup or a periodic manual type.
PAPER BACKUP
Paper backup of the Visa Biometrics payment records, visa applications, maintenance & operation manuals, etc. are important reference and control documents required to preserve the functionality and integrity of the platform. They serve as oversight of “hard” over “soft” data as well as a means of platform authentication. The necessity for a second opinion in the cyberspace cannot be over-emphasized. The Assessor must therefore ensure the presence of paper backup.
TECHNICAL DOCUMENTATION OF INSTALLED ANCILLARIES
This requirement is to determine that the Service Provider has a complete documentation of appliances or equipment deployed or installed for the project. This will include a full list of hardware, network equipment, data center equipment, servers, biometric equipment etc. The documentation will state clearly the manufacturer and specifications of each equipment, the type or model, the rated output, the actual output, their current locations and Asset Number. The Assessor must determine whether or not redundancy provisions have been made for critical infrastructure capable of bottlenecking platform processes and functionality.
3.3. PLATFORM OPERATIONS TRAINING MANUAL
This requirement is to determine the availability of a User Guide or Operation Manual for endusers of the eVisa Biometrics asset. The manual will ordinarily contain written guides and images including screenshots of various interfaces and how each interface works. The Assessor must understand that this requirement is different from the First-Level Technical Support Manual.
The User Guide or manual provides an overall explanation of each component, module, interface, features and the link between them as well as how to use the functions embedded in the software. The User Guide is like the Bible of the software, providing appropriate easy to comprehend reference on the entre application. The Assessor must demand to see a copy of the Manual or Guide. If it is not available the Service Provider’s attention must be immediately drawn to the lapse.
SERVICE PROVIDER’S SOFTWARE TECHNICAL MANUAL
This critical requirement is to determine if the Service Provider has developed the documentation that clearly and comprehensively describes how the software or system operates and how to use it. This will include technical specifications, API documentation, description of modules, components, functions, codes, algorithms and interfaces etc. The documentation will describe in detail the design, architecture and testing requirements of the system.
It will include reports of all tests carried out on the system. It will contain overview of the entire system and more detailed descriptions of each aspect of the system. The Technical documentation will also include description of the system architecture, architecture of each sub-system, a description of each component, its functionality and interfaces as well as the source code listing for future reference, maintenance and interoperability.
The Technical Documentation will describe in detail how each unit, module, sub-system is validated. The document will provide insight into the development environment and technology- namely: software language, back-end database. The document will describe system requirements needed for it to operate efficiently – OS, CPU, Memory, Hard Disk Space, Hardware requirements etc. mention will also be made of the system maintenance guide which should describe what parts of the system are hardware and software dependent etc.
The documentation must indicate the version of the system currently being operated or used. The Assessor must demand to see a copy of the Software Technical Documentation and review it to see if it addresses areas specified above and how effective it is in meeting the Owner’s requirement. Where this document is not available, the Service Provider’s attention must be drawn to the lapse.
3.4. PLATFORM TROUBLE SHOOTING MANUAL
The requirement is to determine if the end-users have technical support manual that they can reference to provide simple first-level and basic support to the system before escalating the issue to the Service Provider. The Assessor must request for this and determine its effectiveness if available. Where it is not available the Assessor must document how end-users currently handle basic first-level support.
The Assessor must find out if there is an overall System Administrator or a group of users that have been trained and appointed to perform basic technical support roles at the Embassy/Mission. The Assessor must also find out if the manual contains a listing of Frequently Asked Questions that will help the end-users perform basic troubleshooting before escalating any issue to the Service Provider.